Data processing addendum
This addendum sets out how we process personal data on your behalf when you use HyperAI Inference. It forms part of our terms of service and applies wherever data protection law requires a processing agreement.
This is a drafting baseline. If your organisation needs a countersigned copy, or changes to fit your own requirements, write to our published contact address and we will work through it with you.
1. Definitions and roles
“Customer” means the organisation that holds the account. “Customer Personal Data” means personal data contained in the content you send through the service — chiefly your prompts and the responses returned to them — that we process on your behalf. “Data Protection Law” means the laws that apply to that processing, including, where they apply, the EU GDPR, the UK GDPR and equivalent laws elsewhere.
For Customer Personal Data, you are the controller and we are your processor. For the data needed to run your account — your users' sign-in details, billing records and security logs — we are an independent controller, and our privacy policy applies.
2. Processing on your instructions
We process Customer Personal Data only to provide the service — to serve, meter, cache and display your requests — and on your documented instructions, which are these terms, your account settings and any further written instruction you give us. We will tell you if we believe an instruction breaks Data Protection Law. We do not use Customer Personal Data to train models, we do not sell it, and we do not combine it with other customers' data.
3. Details of the processing
- Subject matter and duration: provision of the service, for as long as you have an account and until deletion under section 9.
- Nature and purpose: receiving prompts, obtaining model responses, returning them to you, caching them for the window you set, metering usage and keeping a request history with a short preview of each prompt and response.
- Categories of data subjects: whoever you choose to include in your prompts — typically your staff, your customers and your end users.
- Categories of personal data: whatever you choose to include in your prompts. You should not send special-category data unless you have a lawful basis and appropriate safeguards for doing so.
4. Our people
Access to Customer Personal Data is limited to the people who need it to run and support the service, and each of them is bound by a duty of confidentiality.
5. Sub-processors
You authorise us to engage sub-processors in the following functions:
- application hosting, which runs the service;
- managed database and authentication, which stores records and credentials;
- payment processing, which handles payment details we never see;
- model serving, which receives the content of a request in order to generate the response.
The current named list is available on request from our published contact address. We bind each sub-processor by written terms that protect personal data at least as strictly as this addendum, and we remain responsible to you for their performance. We will give you notice before adding or replacing a sub-processor, and you may object on reasonable data protection grounds; if we cannot resolve the objection, you may close your account.
6. Security
We maintain the technical and organisational measures in Annex 2, appropriate to the risk of the processing. We may improve them over time, but will not materially weaken them. We claim no security certification or audit attestation; we will share our security documentation on request.
7. Personal data breaches
If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data, we will notify you without undue delay, give you the information we reasonably can to help you meet your own obligations, and take reasonable steps to contain it.
8. Assistance and audits
Taking into account the nature of the processing, we will help you respond to requests from data subjects, carry out data protection impact assessments and consult supervisory authorities where required. We will make available the information reasonably necessary to demonstrate compliance with this addendum, and will answer reasonable written audit questionnaires; any on-site audit is by prior agreement, at your cost, and subject to confidentiality.
9. Return and deletion
Cached responses expire with the cache window you set. When you ask us to delete your account, we delete Customer Personal Data from our active systems, except where the law requires us to keep it, and you may ask us for an export of your request history before we do.
10. International transfers
Customer Personal Data may be processed outside your country, including in the United States. Where it moves out of the European Economic Area or the United Kingdom to a country without an adequacy decision, the transfer is made under the European Commission's standard contractual clauses, with the UK addendum where the UK GDPR applies, which are incorporated into this addendum by reference.
11. General
If this addendum conflicts with the terms of service on the processing of personal data, this addendum prevails. Liability under it is subject to the limits in the terms of service, except where Data Protection Law does not allow that.
Annex 2 — Security measures
- API keys are stored only as a one-way hash; the full key is shown once and cannot be recovered.
- Records and the response cache are scoped per account, so one account cannot be served another's data.
- Sessions use a signed, httpOnly cookie sent only over encrypted connections in production.
- Passwords are handled by the authentication service; we never see them in clear.
- Administrative actions are recorded in an audit log with the actor, the action and the time.
- Per-account rate limits protect against abuse and runaway traffic.
- Access to production data is limited to the people who need it.
- Card details go directly to the payment processor and never reach our systems.