Privacy

https://usagemill.com is operated by Media Yard LLC, PO Box 73, Pennsauken, NJ 08110. Contact hello@usagemill.com.

If you are in the United Kingdom or the European Economic Area, UK GDPR and EU GDPR apply to personal data we process about you. Media Yard LLC is the controller of account and billing data described here. Usage events and related identifiers you send are handled as a processor under the DPA. We have not appointed a DPO. We have not appointed an Article 27 representative in the Union. If we do, this section will name them.

We do not sell personal data. We do not run advertising pixels on the product. We do not train a model on your usage events.

Roles in one line

Account email, magic-link session, API-key hashes, and Stripe billing identifiers for UsageMill Pro and Scale: Media Yard LLC is the controller. Usage events, meter configuration, idempotency keys, aggregates, and Stripe customer or subscription identifiers you map so we can write invoice items: you are the controller and Media Yard LLC is the processor (DPA).

What we collect as controller

• Account email for magic-link authentication
• API key hashes (we do not email the secret again after you copy it)
• Plan, Stripe billing identifiers, and invoice status on Pro and Scale (we do not store full card numbers; Stripe is not used for UsageMill subscription billing on Starter)
• A session cookie after sign-in
• Server logs (IP, user agent, timestamps) needed to keep the site and API up
• What you write to hello@usagemill.com or support@usagemill.com

We do not ask for phone numbers. We do not collect advertising identifiers.

What we process as processor

When you POST usage or configure meters we process, to run the ledger and optional Stripe writes:

• Meter slugs and configuration you create
• Usage events: meter, quantity, optional timestamp, optional idempotency key, and any identifiers you choose to send
• Aggregates and dashboard log rows derived from those events
• Your Stripe credentials (when configured) and the Stripe customer / subscription / price identifiers you map, used only to create invoice items or metered usage records in your Stripe account on your instruction

Retention of usage events lasts so invoices can be reconstructed for the life of the workspace unless you ask us to delete. See the DPA. Do not send card numbers or government IDs in usage events.

Your Stripe account (not our subprocessor for end-customer billing)

Invoice writes to your Stripe account use your Stripe credentials under your Stripe agreement. You are the merchant of record for invoices to your customers. Stripe’s processing of your end customers is between you and Stripe. That is analogous to how CostSlice treats a customer’s own OpenAI API key: we are not Stripe’s customer for that pile. Separately, Stripe, Inc. processes UsageMill subscription billing for Pro and Scale where Media Yard LLC is the controller — that account-billing path is listed below.

What we do not collect

We do not sell personal data. We do not run advertising or remarketing pixels on the product. We do not ask for phone numbers for SMS. We do not run a model over your usage events.

How we use controller data

We use email to sign you in and to send transactional notices. We use Stripe to bill Pro and Scale. We use logs to keep the product up and to enforce the Acceptable Use Policy. We do not use usage payloads to train a Media Yard model.

Cookies and analytics

We only use cookies that are strictly necessary to run a session or keep you signed in after a magic link. We do not use advertising, analytics, or remarketing cookies on the product. If that changes, this page will say so before any tracking script ships.

Who else processes data

Processor data (usage ledger — DPA Annex 3)

Account processors (we are controller)

Your own Stripe account (invoice-item / usage-record writes) is not listed as our subprocessor of the usage pile. Those writes use your credentials under your Stripe agreement.

Before a new party begins processing usage (processor) data we will update this page and the DPA and email the account owner at least 30 days in advance. We may disclose data if the law requires it, or if Media Yard LLC is sold, to the buyer under this notice.

International transfers

The product is hosted in the United States. For EEA, UK, or Swiss personal data in the usage pile, transfer terms are in the DPA (2021 EU SCCs Module Two / Three, UK Addendum, Clause 7 docking off). We have documented the transfer impact assessment of US law and will make it available on request. We are not certified under the UK–US Data Bridge or the EU–US Data Privacy Framework.

Security and breach

Traffic uses TLS. API keys are stored hashed. Stripe credentials you configure for invoice writes are stored so the cron can call Stripe; rotate them if they leak. Access is limited to people who run UsageMill. If we become aware of a personal-data breach, we notify affected account holders without undue delay and, where the law requires, within 48 hours. Processor-data breach notice under the DPA is also within 48 hours.

Retention

Usage events and meter configuration: for the life of the workspace, so invoices can be reconstructed, until you ask us to close or delete. Account records stay until you ask us to close the account. Invoice and tax records stay as the law requires. Magic-link tokens expire in 15 minutes. Backups age out.

Your rights

Email hello@usagemill.com from the account email to access, correct, export, or delete your account data. If UK GDPR or EU GDPR applies, you may also object, restrict, or complain to a supervisory authority (ICO, your EU SA, or Swiss FDPIC). We answer within one month. Erasure still respects legal holds on invoices.

CCPA and similar US state laws

We do not sell or share personal information as those words are used in the CCPA/CPRA. We do not use it for cross-context advertising. Virginia, Colorado, Connecticut, Utah, and New Jersey: email hello@usagemill.com from the account email.

Children

UsageMill is a B2B product for indie SaaS teams. You must be 18 or older. We do not knowingly create accounts for anyone under 18.

Changes

We will date this page when it changes and, for a material change, email the account if we have one.

Contact

Media Yard LLC, PO Box 73, Pennsauken, NJ 08110 · hello@usagemill.com

No advertising pixels. No model over your usage events.