Data Processing Addendum

How oi handles personal data that you, not oi, decide to publish or collect.

Last updated 15 August 2026. Applies to oi.mrdk.io and every Site served from it.

1. Roles

For the account itself — your email address, your API keys, the operational records tied to them — oi decides the purposes and is the controller. The privacy notice describes that processing.

For anything you put inside a Site, oi is the processor and you are the controller. That includes the files you publish and any records collected through Site Data. oi processes that content to store and serve it, on your instructions, and for nothing else.

2. Subject matter and duration

Subject matter: hosting and serving the files and records you place on oi.
Duration: for as long as the Site exists — until you delete it, or until an anonymous Site expires after 24 hours.
Nature and purpose: storage, transmission, deduplication by content hash, access-control enforcement, thumbnail generation, and aggregate analytics for the Site owner.
Types of data and data subjects: whatever you choose to publish or collect, about whoever you choose to collect it from. oi does not require or inspect any particular category.

3. Processing instructions

oi processes Site content only as needed to provide the service, or where the law requires otherwise — in which case we tell you first unless the law forbids it. Your API calls and your Site settings are the instructions. There is no other use: your content is not read for product development, not used to train models, and not shared with anyone for their own purposes.

4. Confidentiality

Access to stored content is limited to the people who operate the service, only where operations require it, and under a confidentiality obligation that survives the end of their involvement.

5. Security measures

The technical measures are described on the security page. In summary: transport encryption in front of the public origin; signature-verified, time-limited, single-purpose upload URLs; server-side access checks performed before any byte of a gated Site is served; content-addressed storage; and per-agent revocable API keys.

6. Sub-processors

oi stores and serves your content itself. There is no content delivery network, third-party object store, or analytics vendor in the path of your files. If that ever changes, the sub-processor is listed here and on the status page before it starts processing, giving you time to object.

Outbound email — sign-in codes and Site invitations — is the one place a provider is involved, and it carries only the email address and the message.

7. International transfers

Content is stored and served from the service's own origin. Where a transfer of personal data crosses a border, it happens under an appropriate legal mechanism, and we will tell you which one applies to your deployment if you ask.

8. Data subject requests

Requests from your users belong to you. Because you can read, edit, and delete Site content and Site Data records directly through the API, you can satisfy access, correction, and erasure requests yourself. Where a request reaches oi instead, we forward it to you rather than answering it, and we will assist you with anything the API does not already let you do.

9. Return and deletion

Deleting a Site deletes its files. Deleted content is removed from live storage immediately; residual copies in operational backups age out on the backup rotation. Expiry of an anonymous Site does the same thing automatically, leaving only the tombstone that lets the URL answer 410 Gone.

10. Information and audits

On request, oi provides the information reasonably necessary to demonstrate compliance with this addendum. There is no formal audit program yet; the security page states plainly what exists and what does not.

11. Incidents

If oi becomes aware of a breach affecting your content, we notify you without undue delay with what we know: what happened, what was affected, what we are doing, and what you may need to do. Interim notice comes first; detail follows as it is established.

Contact

Questions about this page go to hi@oi.mrdk.io. Abuse reports are handled faster through the abuse page.