Data processing addendum

This is a thin, optional Article 28 addendum. It applies when you ask Media Yard LLC to process personal data on your documented instructions — typically a saved prompt and the email on that account. For ordinary website use, Media Yard LLC is the controller and Privacy is enough.

Roles

Default: Media Yard LLC is the controller of the Mentionmill site and of free checks. Optional processor: when you (the customer) are the controller of personal data in a saved prompt or account email, Media Yard LLC acts as processor for that data. You remain responsible for your own lawful basis.

Subject matter

Shop or brand names, prompts, Named or Not named results, cited links, account email, and the history needed to run a weekly watch. Duration: while the prompt is saved and for a short period after deletion as needed for backups, law, or disputes. Nature: run the check, store the prompt, email when names change, operate billing. Purpose: provide Mentionmill. Types of data subjects: your staff or clients whose names or emails you submit.

Instructions

We process that data only to run checks, store the saved prompt, email name-change notices, and operate billing. No other use. No sale of the prompt list. No training a Mentionmill model on the prompt.

Confidentiality

People who can see customer data are under a confidentiality duty and may access it only to operate Mentionmill.

Breach notice

If we become aware of a personal-data breach affecting data we process for you, we will notify you within 48 hours of becoming aware, with the facts we have, unless law forbids it.

Sub-processors

OpenAI and Perplexity receive prompt text when those engines are connected — they are sub-processors for the content of the check. Stripe, Resend, and Vercel Inc. support billing, email, and hosting. We will give 30 days’ notice before we add or replace a sub-processor for this processing, by updating this page or emailing the account. You may object by canceling the plan and asking us to delete the prompt.

International transfers — SCCs

Where a transfer from the EEA requires a tool, the parties incorporate the EU Standard Contractual Clauses. Module 2 applies when you are the controller and we are the processor. Module 3 applies when we are a processor and a sub-processor is a processor. Clause 7 (docking) is off. The competent supervisory authority is the one that has jurisdiction over you as controller, or as described in Annex 1.

UK Addendum

For transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU SCCs applies. Table 1: the parties are you (exporter, as controller or processor) and Media Yard LLC (importer). Table 2: the Addendum is appended to the SCCs named above. Table 3: Annexes 1–3 of this DPA. Table 4: either party may end the Addendum as the Addendum allows.

Switzerland

For transfers subject to the Swiss FADP, the SCCs are read with the Swiss adaptations (including the Federal Data Protection and Information Commissioner where required) so that Swiss data subjects have the same protection.

Return or delete

When the processing ends, we will delete the saved prompt, history, and account email on written request to hello@mentionmill.com, or return a copy if you ask first, except records we must keep for law or disputes.

Audit

No more than once in any 12-month period, you may request information reasonably needed to confirm we follow this addendum. We will answer in writing. On-site audit is only if the written answers are not enough, on reasonable notice, during business hours, and at your cost.

CCPA service provider

Where California law applies, Media Yard LLC is a service provider / contractor. We process personal information only for the Mentionmill business purpose in this addendum. We do not sell it and we do not share it for cross-context behavioral advertising.

New Jersey law

New Jersey law governs this addendum, without regard to conflict-of-law rules, except where data-protection law requires otherwise.

Annex 1 — Parties and transfer

Data exporter: the customer who accepts this DPA, contact as on the Mentionmill account. Data importer: Media Yard LLC, PO Box 73, Pennsauken, NJ 08110, hello@mentionmill.com. Activities: AI mention check and weekly watch as described above. Frequency: each check and each weekly re-run.

Annex 2 — Security

Access limited to operating the product. Signed sessions. Processor access restricted. Prompt text sent to OpenAI and Perplexity only to complete the check. Hosting on Vercel Inc. Breach notice within 48 hours of becoming aware.

Annex 3 — Sub-processors

The current list, including Vercel Inc. for application hosting: