Data Processing Agreement | SLIDINGBOX LLC

This Data Processing Agreement ("DPA") forms part of the Terms of Service between SLIDINGBOX LLC ("Slidingbox," "we," or "us") and the customer using the Service ("Customer," "you"). It applies automatically, without signature, whenever your use of the Service involves personal data subject to the EU General Data Protection Regulation, the UK GDPR, the Swiss Federal Act on Data Protection, or a U.S. state privacy law. A countersigned copy is available on request from support@slidingbox.ai.

Where this DPA conflicts with the Terms of Service, this DPA controls for the processing of personal data.

1. Roles of the parties

For personal data contained in the encrypted items you submit, you are the controller (or a processor acting for another controller) and we are your processor (or subprocessor). For the limited operational data described in section 3 of our Privacy Policy — connection data, operational logs, API-key identifiers, payer wallet identifiers, and support correspondence — we are an independent controller, and this DPA does not apply to it.

2. Nature of the processing

The processing is deliberately narrow. You encrypt an item before it reaches us. We receive ciphertext and an initialization vector, store them for a time-to-live you choose between 60 and 900 seconds, return them once to whoever presents the pointer, and delete them. We hold no encryption key, cannot decrypt any item, and therefore cannot read, index, analyze, enrich, or profile the contents. From our side the personal data is an opaque byte string of known length and unknown meaning.

Details required by Article 28(3) and Article 30 are in Annex I.

3. Processing on documented instructions

We process personal data in the encrypted items only to provide the Service and only on your documented instructions, which consist of the Terms of Service, this DPA, and the API calls you make. We will not process it for any other purpose, and we will not sell it, share it for cross-context behavioral advertising, or retain, use, or disclose it outside the direct business relationship. We will tell you if we believe an instruction infringes applicable data protection law, unless legally prohibited. If law requires us to process personal data beyond your instructions, we will inform you first unless that law forbids it.

4. Confidentiality

Our personnel and contractors with any access to systems processing personal data are bound by written confidentiality obligations that survive the end of their engagement, and access is limited to those who need it to operate or secure the Service.

5. Security

We implement the technical and organizational measures in Annex II, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk to individuals. The primary safeguard is architectural: because encryption happens before data reaches us and keys never do, a compromise of our systems exposes ciphertext rather than personal data in intelligible form.

6. Subprocessors

You give general written authorization for us to engage subprocessors. The current list, with each provider's role and location, is published at Subprocessors. We impose data protection obligations on each subprocessor that are no less protective than those in this DPA, and we remain fully liable to you for their performance.

We will give at least 30 days' notice before adding or replacing a subprocessor to customers who have asked to be notified at support@slidingbox.ai. You may object on reasonable data protection grounds within that period; if we cannot resolve the objection, you may stop using the affected part of the Service, which is your exclusive remedy.

7. Assistance with data subject rights

Taking into account the nature of the processing, we will assist you by appropriate technical and organizational measures, insofar as possible, to respond to requests from individuals exercising their rights. You should understand the practical limit before you rely on it: we operate no user accounts, hold no key, and store items under an opaque pointer, so we cannot locate, identify, produce, correct, or export the personal data inside a specific item. In practice, deletion is the one right we satisfy automatically and completely, because every item is destroyed on first retrieval or at expiry. If we receive a request directly from an individual relating to your data, we will not respond substantively and will refer them to you where we can identify you.

8. Personal data breaches

We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting personal data we process for you. The notice will describe the nature of the breach, the likely consequences, the measures taken or proposed, and a contact point, to the extent that information is available to us. We will assist you in meeting your own notification obligations to regulators and individuals.

9. Data protection impact assessments

We will provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities, to the extent they relate to our processing and taking into account the information available to us. Our Security page, Subprocessors page, and Annex II are intended to supply most of what such an assessment needs.

10. Deletion and return

No action is required at termination and there is nothing to export. Every item is deleted on first successful retrieval or when its time-to-live expires, at most 900 seconds after submission, so we retain no customer personal data on an ongoing basis and hold no archive or backup of item contents from which one could be restored. Operational and payment records that identify you rather than your data subjects are retained as described in section 7 of the Privacy Policy.

11. Audits and information

We will make available the information reasonably necessary to demonstrate compliance with Article 28 and will allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate. Audits are limited to once in any 12-month period unless a supervisory authority or a personal data breach requires otherwise, must be requested at least 30 days in advance, must not compromise the confidentiality or security of other customers, and are at your cost. We will normally satisfy such requests by providing documentation and written responses. We do not currently hold a SOC 2, ISO 27001, or equivalent third-party attestation, and we do not claim one.

12. International transfers

We are established in the United States and process data there and at globally distributed edge locations. Where you transfer personal data to us from the European Economic Area, the United Kingdom, or Switzerland, the following apply and are incorporated by reference:

EEA: the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), or Module Three (processor to processor) where you act as a processor. Clause 7 (docking) applies; the option in Clause 9(a) is general written authorization with a 30-day notice period; the option in Clause 11(a) does not apply; Clause 17 is governed by the law of Ireland; and Clause 18(b) designates the courts of Ireland. Annexes I, II, and III of this DPA populate the corresponding annexes of the Clauses.
United Kingdom: the International Data Transfer Addendum to the EU SCCs issued by the Information Commissioner under section 119A of the Data Protection Act 2018, with Tables 1 to 3 completed by the annexes below and Table 4 selecting "neither party."
Switzerland: the EU SCCs as amended so that references to the GDPR are read as references to the Swiss FADP, the Federal Data Protection and Information Commissioner is the competent authority, and the term "member state" does not deprive data subjects in Switzerland of the right to sue where they are habitually resident.

If a transfer mechanism is invalidated or superseded, we will implement an alternative lawful mechanism without undue delay.

13. U.S. state privacy laws

For personal information subject to the California Consumer Privacy Act as amended, we act as a service provider and not as a third party. We will not sell or share it, will not retain, use, or disclose it for any purpose other than performing the Service, will not retain, use, or disclose it outside the direct business relationship between us, and will not combine it with personal information from another source except as permitted. We certify that we understand and will comply with these restrictions. Equivalent processor obligations apply under the comparable laws of Colorado, Connecticut, Virginia, and other states.

14. Liability

Each party's liability arising out of this DPA is subject to the limitations and exclusions in the Terms of Service, except where applicable data protection law does not permit that limitation, including as between the parties to the Standard Contractual Clauses in respect of data subject rights.

Annex I — Description of processing

A. Parties

Data exporter / controller: the Customer, being the entity that submits encrypted items to the Service, whose identity and contact details are those it provides in correspondence with us. Activities: use of an encrypted relay to hand off short-lived data between its own systems.

Data importer / processor: SLIDINGBOX LLC, 30 N Gould St Ste R, Sheridan, WY 82801, United States. Contact: support@slidingbox.ai. Activities: operation of the Slidingbox encrypted relay described in section 2.

B. Description of the transfer

Categories of data subjects: Determined solely by the Customer. Unknown to Slidingbox, which cannot decrypt the data.
Categories of personal data: Determined solely by the Customer, and received only as ciphertext. Special categories of personal data, and data regulated by HIPAA, GLBA, FERPA, or PCI DSS, are prohibited by the Terms of Service and must not be submitted.
Nature and purpose: Temporary storage of client-encrypted data and one-time retrieval by the holder of a pointer, for the purpose of relaying it between automated systems.
Frequency: Continuous, on each API call the Customer makes.
Duration of processing: Until first successful retrieval or expiry of the Customer-selected time-to-live, between 60 and 900 seconds.
Subprocessors: As published at Subprocessors, for the purposes and durations stated there.

C. Competent supervisory authority

The supervisory authority of the EEA member state in which the Customer is established or, where the Customer is not established in the EEA, has appointed a representative under Article 27. For UK transfers, the Information Commissioner's Office. For Swiss transfers, the Federal Data Protection and Information Commissioner.

Annex II — Technical and organizational measures

Client-side encryption: the Service is designed so that plaintext and encryption keys are never transmitted to us. We receive and store ciphertext and an initialization vector only, and hold no means of decryption.
Encryption in transit: all endpoints are served over TLS. Plain HTTP is permanently redirected, and HTTP Strict Transport Security is applied.
Storage limitation: every item carries a time-to-live of at most 900 seconds and is deleted on first successful retrieval, with expiry enforced both on access and by scheduled cleanup.
Access control: items are addressable only by an unguessable pointer that is strictly validated; the Service does not accept browser cross-origin requests; responses are marked no-store.
Logging minimization: application logs are restricted by allowlist to a request identifier, route, response status, duration, error code, and a truncated pointer prefix. Ciphertext, initialization vectors, keys, and payment signatures are excluded by design.
Abuse and availability controls: request-size validation, per-IP and per-payer rate limits, a penalty circuit breaker for malformed credentials, and edge-level DDoS and bot mitigation provided by our infrastructure provider.
Pseudonymization: no user accounts exist; identification is by opaque pointer, API-key identifier, or public wallet address rather than by name or contact details.
Resilience and recovery: the Service runs on globally distributed edge infrastructure. Because items are ephemeral by design, there is no backup or restore process for item contents, and none is possible.
Governance: vulnerability reports are accepted at support@slidingbox.ai and abuse reports at abuse@slidingbox.ai; changes are version-controlled and covered by an automated test suite before deployment.

These measures are described accurately as implemented. No third-party certification or audit of them is claimed.

Annex III — Subprocessors

The current list is maintained at slidingbox.ai/subprocessors and forms part of this DPA.