MeterFlow Legal
Data Processing Agreement
Last updated: 24 October 2026
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between you (the “Customer”) and Fulvio Antonio Cosco Barletta, a sole trader trading as MeterFlow (“MeterFlow”). It applies whenever the data you send to the Service through the API, SDKs or dashboard (“Customer Data”) includes personal data of your own end users, for which you are the controller and MeterFlow is the processor under the EU General Data Protection Regulation and the UK GDPR (together “Data Protection Law”).
1. Details of the processing
| Subject matter | Provision of the MeterFlow usage-metering and credit-billing Service. |
|---|---|
| Duration | The term of the Customer’s account, plus the deletion period in section 8. |
| Nature and purpose | Receiving, storing, aggregating and reporting usage events and credit transactions so the Customer can meter and bill its own customers; enforcing plan limits; sending webhooks. |
| Categories of data subjects | The Customer’s end users and customers, as identified by the Customer. |
| Categories of personal data | Customer-defined external identifiers (which may be an email or user ID), usage event metadata and any attributes the Customer chooses to attach to events, subscriptions or balances. The Service is not designed for special-category data and the Customer agrees not to submit any. |
2. Customer instructions
MeterFlow processes Customer Data only on the Customer’s documented instructions, which are: the Terms, this DPA, and the Customer’s use of the Service’s features and API. MeterFlow will inform the Customer if, in its opinion, an instruction infringes Data Protection Law. The Customer warrants that it has a lawful basis and any required notices or consents to submit Customer Data.
3. Confidentiality
Access to Customer Data is limited to the operator and any person engaged by MeterFlow who needs it to provide the Service, each bound by a duty of confidentiality.
4. Security
MeterFlow implements appropriate technical and organisational measures, including: TLS encryption in transit; hashed credentials and API keys; role-based access to the dashboard; a network-isolated production database; and client-side encrypted, deduplicated off-site backups with automatic retention pruning. Measures are reviewed as the Service evolves.
5. Sub-processors
The Customer gives general authorisation for MeterFlow to use the following sub-processors:
| Provider | Purpose | Data |
|---|---|---|
| Paddle Paddle.com Market Ltd (UK) / Paddle.com Inc. (US) | Merchant of record: checkout, payments, invoicing, sales tax and VAT | Name, email, billing address, payment details, transaction history |
| Hostinger Hostinger International Ltd (Cyprus / Lithuania) | Virtual private server hosting the API, background workers and the primary database | All Service data at rest (account, billing references, usage events, ledger) |
| Backblaze Backblaze, Inc. (US) | Off-site storage of encrypted database backups (B2) | Full database snapshots, encrypted client-side before upload (Backblaze only holds ciphertext) |
| Cloudflare Cloudflare, Inc. (US) | DNS, edge network and static hosting of this website and the dashboard (Cloudflare Pages) | Technical connection data (IP address, request metadata) |
| Grafana Labs Raintank, Inc. dba Grafana Labs (US); logs stored in its UK region | Application log storage, search and alerting (Grafana Cloud Loki), kept 14 days | Technical log lines: request paths, status codes, request ids, IP addresses, error messages |
| Resend Resend, Inc. (US) | Transactional email delivery (verification, password reset, welcome) | Name, email address, email content |
MeterFlow will give at least 30 days’ notice by email or dashboard notice before adding or replacing a sub-processor that will process Customer Data. If the Customer reasonably objects on data-protection grounds and the parties cannot resolve it, the Customer may terminate its subscription; fees already paid for the remaining period will be refunded pro rata. MeterFlow remains responsible for its sub-processors’ performance of their data-protection obligations.
6. International transfers
Customer Data is stored with the hosting providers listed above. Where a sub-processor processes personal data outside the UK or the European Economic Area, the transfer is covered by the UK International Data Transfer Agreement or Addendum, the EU Standard Contractual Clauses, or an adequacy decision, as applicable.
7. Assistance
Taking into account the nature of the processing, MeterFlow will assist the Customer, at the Customer’s reasonable request, in responding to data-subject requests (the Customer can read back its records through the API at any time; deletion requests for a specific end user are handled by MeterFlow within 30 days of a written request), in meeting its security and breach-notification obligations, and with data-protection impact assessments. MeterFlow will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal-data breach affecting Customer Data.
8. Deletion and return
Customer Data can be retrieved through the API at any time during the term. On termination of the account, or earlier on the Customer’s written request, MeterFlow deletes Customer Data from production systems within 30 days, and it expires from encrypted backups on the rolling schedule described in the Privacy Policy (at most six months), unless retention is required by law.
9. Audit and information
MeterFlow will make available the information reasonably necessary to demonstrate compliance with this DPA, including this document, the sub-processor list and a description of its security measures. Where Data Protection Law gives the Customer an audit right, it is exercised first by written questionnaire, at most once a year, and on-site only if required by a supervisory authority or if a questionnaire is insufficient to resolve a documented concern.
10. Liability and precedence
Each party’s liability under this DPA is subject to the limitations in the Terms. In case of conflict, this DPA prevails over the Terms with respect to the processing of personal data. This DPA is governed by the laws of England and Wales, in line with the Terms.
11. Contact
Processor: Fulvio Antonio Cosco Barletta, a sole trader trading as MeterFlow, 15 Corbet Close, London SM6 7GB, United Kingdom. privacy@meter-flow.com.