Legal

Data Processing Agreement

Effective date: July 4, 2026

1. Scope & Roles

This Data Processing Agreement (“DPA”) forms part of the agreement between Token Limits (“Processor”) and the customer (“Controller”) for use of the Token Limits service. It applies where Token Limits processes personal data on the Controller's behalf under the GDPR, UK GDPR, and the CCPA. For that data the Controller determines the purposes and means of processing and Token Limits acts only on the Controller's documented instructions.

2. Nature & Purpose of Processing

Token Limits compresses tool responses in AI coding sessions. Content submitted for compression passes through our servers in memory and is never written to disk or retained after the request completes. The personal data we process and store is limited to account and billing metadata.

Categories of data: account email, hashed password, license key, usage count, hashed session tokens, and security audit records (event type and IP address).
Data subjects: the Controller's authorized users who create accounts.
Duration: for the life of the account; audit records for up to 12 months. See our Privacy Policy.

3. Subprocessors

The Controller authorizes Token Limits to engage the following subprocessors. We will give notice before adding or replacing a subprocessor and remain responsible for their performance.

Stripe — payment processing (United States / global).
Resend — transactional email delivery (United States).
Railway — application hosting and PostgreSQL database (United States).
Cloudflare — bot protection on signup (global).
Anthropic — the Claude Code proxy forwards API requests, and optional AI summaries use the Haiku model (United States).

4. Security Measures

Token Limits maintains technical and organizational measures appropriate to the risk, including:

Encryption in transit (TLS) for all connections; passwords hashed with scrypt; session and reset tokens stored only as hashes.
Least-privilege access to production systems and the database; secrets held in environment configuration, never in source control.
Rate limiting, bot protection, and audit logging of authentication and account events.
Content submitted for compression is processed in memory only and never persisted or logged.

5. Data Subject Requests

Token Limits will assist the Controller in responding to data subject requests (access, rectification, erasure, portability, objection). Account holders can export their data from the account page or by emailing [email protected], and can delete their account and associated data at any time.

6. Breach Notification

Token Limits will notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting the Controller's data, and will provide the information reasonably needed to meet the Controller's own notification obligations.

7. Return & Deletion

On termination, or on the Controller's request, Token Limits will delete the Controller's personal data within 30 days, except where retention is required by law or for the limited security-audit window described in the Privacy Policy.

8. International Transfers

Where personal data is transferred outside the EEA or UK, such transfers are made under an appropriate safeguard (such as the EU Standard Contractual Clauses) offered by the relevant subprocessor.

9. Requesting a Signed DPA

Business and enterprise customers who require a countersigned DPA can email [email protected] with “DPA request” and their legal entity details. This page reflects our standard terms; a signed agreement is available on request.