Last updated 2026-10-31

Data Processing Addendum

This Addendum forms part of the Terms of Service between [ENTITY NAME] ("Provider") and the customer ("Customer") and applies where the Provider processes personal data on the Customer's behalf and the GDPR, UK GDPR or a US state privacy law applies. This document is a template awaiting legal review and is not in force until the notice at the top of the page is gone.

1. Roles

• For the data of the people who use the Service on a Customer's behalf (account email, billing contact), the Provider is a controller, as described in the Privacy Policy.
• For personal data that the Customer sends through the Service, such as the content of dispatch requests passed to a model provider using the Customer's own provider keys, the Customer is the controller (or "business") and the Provider is the processor (or "service provider").

2. Processing details

• Subject matter and purpose: operating the Service for the Customer.
• Duration: the life of the account plus the retention periods in the Privacy Policy.
• Data subjects and categories: the Customer's personnel and end users; the categories listed in the Privacy Policy.
• The Provider does not store dispatch prompts or responses; only metadata (model, provider, token counts, cost, status) is kept in dispatch receipts.

3. Provider obligations

The Provider will: process personal data only on the Customer's documented instructions (the Terms and the Customer's use of the Service); ensure personnel are bound by confidentiality; apply the measures described on the Security page; help the Customer respond to data subject requests; notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data; and delete or return personal data at the end of the Service on request.

4. Subprocessors

The Customer authorises the subprocessors on the Subprocessors page. The Provider will update that page before adding or replacing one and the Customer may object on reasonable grounds by contacting [CONTACT EMAIL].

5. International transfers

The Service is hosted in the United States. Where personal data from the EU, UK or Switzerland is transferred, the parties rely on the standard contractual clauses (and the UK addendum) which are incorporated by reference, with the Customer as exporter and the Provider as importer.

6. Audits

On reasonable written notice, and no more than once a year, the Provider will give the Customer the information needed to show compliance with this Addendum.

7. Liability and order of precedence

Liability under this Addendum is subject to the limits in the Terms. If this Addendum conflicts with the Terms on the processing of personal data, this Addendum prevails.

Contact: [ENTITY NAME], [POSTAL ADDRESS], [CONTACT EMAIL].