Parties: This Data Processing Agreement (“Agreement”) is entered into between:
- Msty, operated by CloudStack, LLC (“Processor”), and
- You, the user of Msty’s services (“Controller”).
This Agreement forms part of the overall Privacy Policy and Terms of Service between Msty and the Controller (the “Principal Agreement”).
1. Purpose and Scope
This Agreement governs the processing of personal data by Msty solely in the context of providing its modular AI orchestration services, website, contact forms, newsletter forms, product-availability forms, licensing, billing, and related support workflows. Msty does not collect, store, or process product-session content on its own infrastructure.
Limited customer, visitor, and submitter data may be processed through CloudStack systems and trusted service providers used for website delivery, security, email delivery, licensing, and payment processing.
Additionally, Msty allows customers to:
- Connect their own AI language models (LLMs) hosted on third-party platforms.
- Integrate external tools via MCP (Modular Control Protocol).
In such cases, Msty acts as a facilitator and does not process or store data flowing between the customer and these third-party services. It is the customer’s responsibility to vet and secure any third-party integrations they use.
2. Nature of Processing
Msty:
- Facilitates interactions with connected models and tools via user-directed integrations.
- Does not store, log, or analyze any data sent through those integrations.
3. Categories of Data Subjects
Data subjects may include:
- Website visitors who submit contact, newsletter, product-availability, partner, or support forms.
- Customers who purchase licenses through LemonSqueezy or Stripe.
- End users of customer applications, to the extent they interact with third-party tools connected by the customer via Msty.
Msty itself does not collect or process identifiable product-session data from these subjects.
4. Type of Personal Data
Msty does not handle product-session content directly. The following limited personal data may be processed by CloudStack systems or service providers, depending on how you interact with Msty:
- Customer names
- Email addresses
- Payment information
- License key data
- Company, organization, or institution name
- Message content and product interest submitted through forms
- Source page URL, page path, page title, referrer, user agent, submission timestamp, and spam-prevention signals
- Website request metadata needed to deliver and protect the website
Any personal data transferred via third-party LLMs or tools connected through Msty are not processed or retained by Msty.
5. Processor Obligations
Msty shall:
- Avoid retention of product-session content and minimize retention of contact, licensing, billing, and support-related personal data.
- Ensure secure transmission between systems using industry-standard encryption.
- Not engage in profiling, tracking, or secondary processing of any data transmitted via user-initiated integrations.
- Use trusted sub-processors only for the limited purposes described in this Agreement.
6. Use of Sub-Processors
Msty uses the following sub-processors where applicable:
- Cloudflare, Inc. for website hosting, CDN, security, and request routing.
- Resend, Inc. for contact, newsletter, product-availability, partner, and support email workflows when configured.
- LemonSqueezy, LLC and Stripe, Inc. for customer license, subscription, and billing data. LemonSqueezy’s DPA is available at: https://www.lemonsqueezy.com/dpa Stripe’s DPA is available at: https://stripe.com/legal/dpa
Msty may update this list as service providers change.
7. Third-Party Integrations and Customer Responsibility
Msty allows customers to connect:
- External AI models (e.g., OpenAI, Anthropic, Azure)
- Tools and APIs via MCP (Modular Control Protocol)
The customer is solely responsible for:
- Vetting third-party tools and model providers
- Ensuring compliance with privacy laws in their use
- Handling any personal data passed through those systems
Msty does not monitor, store, or log any of the data exchanged with those third parties.
8. Data Subject Rights
Since Msty does not store or control product-session data, requests related to data subject rights (access, deletion, correction, etc.) must be directed to:
- CloudStack for contact, newsletter, product-availability, partner, or support submissions
- LemonSqueezy and Stripe for license/billing information
- Third-party integrations for any data handled during user interactions
9. Data Security
Msty implements:
- HTTPS/TLS encryption for all data in transit
- User data isolation - data is only stored on user’s local machine
10. Termination
Upon termination of services:
- Msty retains no personal data.
- Contact, newsletter, product-availability, partner, and support records are retained only as long as needed for the business purpose for which they were submitted.
- Licensing and transaction records remain with LemonSqueezy and Stripe in accordance with their data retention policies.
11. Governing Law
This Agreement is governed by and construed in accordance with the laws of Delaware, USA.
12. Contact
For questions regarding this DPA, please contact: Email: [email protected]