MediaContext Data Processing Agreement

Effective 2026-10-28

This DPA is an attachment to the MediaContext Terms of Service. Customer accepts it by accepting the Terms of Service. It covers personal data that And/or Labs Inc. processes for Customer. It does not cover Research Data, which the Terms of Service define and which And/or Labs Inc. handles as an independent controller under the MediaContext Privacy Notice at https://mediacontext.dev/privacy.

Using this DPA

This DPA has 2 parts: (1) the Key Terms on this Cover Page and (2) the Common Paper DPA Standard Terms Version 1.1 posted at https://commonpaper.com/standards/data-processing-agreement/1.1 ("DPA Standard Terms"), which is incorporated by reference. If there is any inconsistency between the parts of the DPA, the Cover Page will control over the DPA Standard Terms. Capitalized and highlighted words have the meanings given on the Cover Page. However, if the Cover Page omits or does not define a highlighted word, the default meaning will be "none" or "not applicable" and the correlating clause, sentence, or section does not apply to this Agreement. All other capitalized words have the meanings given in the DPA Standard Terms or the Agreement.

Key Terms

Agreement: This DPA supplements the MediaContext Terms of Service at https://mediacontext.dev/terms, in the version Customer accepted, or a separately signed Order Form between Customer and And/or Labs Inc. that refers to this DPA.

Approved Subprocessors: The list of Subprocessors in the Subprocessors section of this page, at https://mediacontext.dev/dpa#subprocessors.

Provider Security Contact: vj@andorlabs.ca; And/or Labs Inc., 221 27 Ave NW, Calgary, AB T2M 2H5, Canada.

Security Policy: As defined in the Agreement.

Changes to the Agreement

DPA Covered Claim: None.

DPA Liability Cap: None. The liability caps in the Agreement apply.

Governing Law and Chosen Courts: Not selected. The Governing Law and Chosen Courts in the Agreement apply.

Service Provider Relationship: To the extent California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq ("CCPA") applies, the parties acknowledge and agree that Provider is a service provider and is receiving Personal Data from Customer to provide the Service as agreed in the Agreement and detailed below (see Nature and Purpose of Processing), which constitutes a limited and specified business purpose. Provider will not sell or share any Personal Data provided by Customer under the Agreement. In addition, Provider will not retain, use, or disclose any Personal Data provided by Customer under the Agreement except as necessary for providing the Service for Customer, as stated in the Agreement, or as permitted by Applicable Data Protection Laws. Provider certifies that it understands the restrictions of this paragraph and will comply with all Applicable Data Protection Laws. Provider will notify Customer if it can no longer meet its obligation under the CCPA.

Restricted Transfers

Governing Member State:

  • EEA Transfers: Ireland.
  • UK Transfers: England and Wales.

Annex I(A) List of Parties

Data Exporter Name: Customer Address: The address in Customer's account or billing details. Contact person: The owner of Customer's MediaContext account, at the address above. Activities relevant to transfer: See Annex I(B). Role: Controller, or Processor where Customer processes the Customer Personal Data on behalf of its own client.

Data Importer Name: Provider, And/or Labs Inc. Address: 221 27 Ave NW, Calgary, AB T2M 2H5, Canada Contact person: Vishveshwar Jatain, 221 27 Ave NW, Calgary, AB T2M 2H5, Canada; vj@andorlabs.ca Activities relevant to transfer: See Annex I(B). Role: Processor

Annex I(B) Description of Transfer and Processing Activities

Service: MediaContext

Categories of Data Subjects:

  • Customer's end users or customers, meaning the authorized Users of Customer's workspace.
  • Customer's employees.
  • People Customer names in workspace content, such as private notes, notification recipients and feedback.

Categories of Personal Data:

  • Name.
  • Contact information such as email, phone number, or address.
  • Professional or biographic information such as resume or CV, limited to job titles and notes Customer adds.
  • Transactional information such as account information or purchases.
  • User activity and analysis such as device information or IP address.
  • Data from Google Analytics, Search Console, Tag Manager and Ad Manager accounts Customer connects to the Service, read-only.

Special Category Data: Special category data is not Processed. Customer will not submit it. Section 3.2 (Prohibited Data) of the Agreement applies.

Frequency of Transfer: Continuous.

Nature and Purpose of Processing: Provider will Process Customer Personal Data as instructed in Section 2.3 of the DPA Standard Terms. The nature of processing includes:

  • Receiving data, including collection, accessing, retrieval, recording, and data entry.
  • Holding data, including storage, organization, and structuring.
  • Using data, including analysis and consultation.
  • Updating data, including correcting, adaptation, alteration, alignment, and combination.
  • Protecting data, including restricting, encrypting, and security testing.
  • Sharing data, including disclosure, dissemination, allowing access, or otherwise making available, to Approved Subprocessors and the Users of Customer's workspace.
  • Returning data to the data exporter or data subject.
  • Erasing data, including destruction and deletion.

Duration of Processing: Provider will process Customer Personal Data as long as required (i) to conduct the Processing activities instructed in Section 2.2(a)-(d) of the Standard Terms; or (ii) by Applicable Laws.

Annex I(C)

Competent Supervisory Authority: The supervisory authority will be the supervisory authority of the data exporter, as determined in accordance with Clause 13 of the EEA SCCs or the relevant provision of the UK Addendum.

Annex II Technical and Organizational Security Measures

See Security Policy. In addition:

User identification and authorization process and protection: Sign-in through Clerk, with session tokens verified against Clerk's keys. Workspace membership checks and database row-level security restrict workspace data to its workspace. API keys are scoped and revocable, and are stored as peppered hashes; production refuses to start without a unique pepper of at least 32 characters.

Protecting Customer Personal Data during transmission (in transit): The application and website are served over HTTPS. Neon, the database provider, requires TLS for all connections. Calls to Subprocessor APIs use HTTPS.

Protecting Customer Personal Data during storage (at rest): Neon encrypts stored database data with AES-256. Oracle Cloud Infrastructure encrypts the application host's block and boot volumes at rest.

Events logging: Structured request logs record request ID, route template, method, status and latency. URLs, headers, bodies and exception messages are excluded. Logs are kept for 3 days.

Ensuring data minimization: Product analytics are off until a User opts in. Analytics reduce URLs to route templates, session replay masks all text and inputs, and error reports exclude request headers, cookies, bodies, query strings and user identifiers.

Subprocessors

These Subprocessors process Customer Personal Data. Provider gives at least 10 business days' notice by email of a new or replacement Subprocessor, as Section 2.6 (Subprocessors) of the DPA Standard Terms requires. To receive these notices at an address other than the account email, write to vj@andorlabs.ca.

  • Oracle Cloud Infrastructure: application hosting. Canada (Montreal).
  • Neon: primary database for accounts, workspaces and workspace content. United States.
  • Clerk: user authentication. United States.
  • Better Stack: operational logs and uptime monitoring. United States.
  • PostHog: product analytics and masked session replay, only for Users who opt in. United States.
  • Resend: account, notification and digest email. United States.
  • Courier: in-app notification inbox. United States.
  • Composio: connections to the Google Analytics, Search Console, Tag Manager and Ad Manager accounts Customer connects for Inspect. United States (company location; Composio does not publish a hosting country).
  • Steel: remote browser sessions for Inspect runs. United States.
  • Anthropic: explanations of Inspect findings. Data is stored in the United States; Anthropic may route processing to other countries.
  • Modem: in-app feedback and crash reports. Canada and the United States, and other countries per Modem's privacy policy.
  • Sentry: error tracking with request data and user identifiers removed, where configured. United States.
  • Stripe: payment processing and billing records. United States.

Slack receives alert text only when Customer connects its own Slack workspace and chooses that delivery.

Providers that process only Research Data, website visitor data or newsletter data are not Subprocessors under this DPA. The MediaContext Privacy Notice describes them.

Provider and Customer have not changed the DPA Standard Terms except for the details on the Cover Page above.

Built from the Common Paper DPA Cover Page, Version 1.1, available at https://commonpaper.com/standards/data-processing-agreement/ and free to use under CC BY 4.0.