Data Processing Addendum
Last updated: 2026-11-07
In short: a plain-language summary, not legally binding
- When you send your own users’ personal data through the API, you are the controller and we act as your processor.
- We process that data only to provide the service, keep it confidential and secure, and use only the listed sub-processors.
- We help you answer data subject requests and report personal data breaches without undue delay.
Scope and roles
This addendum forms part of the Terms of Service between you (the customer) and -. It applies when you send personal data of other people (your end users, customers or employees) through the API, the playground or a widget. For that data you are the controller and we are your processor (GDPR Art. 28; under the KVKK, veri işleyen). For your own account and billing data we are an independent controller under the Privacy Policy.
Nature and purpose
We process the content of your requests (prompts, files and model outputs) and related metadata only to forward each request to the model you select, return the response, bill the usage, keep the request history in your dashboard for up to 400 days and protect the service against abuse. The categories of data and data subjects are those you choose to send. You must not send special categories of data unless the law allows it and you have the necessary safeguards in place.
Instructions
We process the data only on your documented instructions, which are these terms, your API requests and your settings. We tell you if we believe an instruction breaks data protection law. We do not use your request content to train models, sell it or use it for advertising.
Confidentiality and security
Everyone we authorise to access the data is bound by confidentiality. We maintain appropriate technical and organisational measures, including encryption in transit, hashed credentials, access controls and logging, and review them regularly.
Sub-processors
You authorise the sub-processors needed to run the service: our model-routing infrastructure provider (an API aggregator for AI models) and the AI model provider you select, which receive the content of your requests to produce the response; Stripe, for card payments, subscriptions, invoices and fraud prevention; an x402 payment facilitator, which receives the signed authorization of USDC top-ups; our email delivery provider, for account, security and billing emails; our hosting and infrastructure providers (servers, database, backups). The model provider you select processes the request content under its own terms. We impose data protection obligations on our sub-processors that are no less protective than this addendum, and remain responsible for them. We announce new sub-processors on the site or by email at least 14 days in advance; you may object on reasonable data protection grounds and, if we cannot address the objection, stop using the affected service.
International transfers
Where data is transferred outside the EEA, the UK, Switzerland or Turkey, the transfer is covered by an adequacy decision or by the standard contractual clauses of the European Commission (Module 2 or 3, as applicable) and, for transfers from Turkey, by the standard contracts of the Personal Data Protection Board under KVKK Article 9, which are incorporated into this addendum by reference.
Assistance
Taking into account the nature of the processing, we help you respond to data subject requests (you can export and delete request history yourself in the dashboard), carry out data protection impact assessments and consult supervisory authorities.
Personal data breaches
We notify you without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting your data, with the information you need to meet your own notification duties (72 hours under GDPR Art. 33 and under the KVKK Board’s decision).
Deletion and audits
When you delete a request record or your account, or when the retention period ends, we delete the data unless the law requires us to keep it. We make available the information necessary to demonstrate compliance and allow reasonable audits with 30 days’ notice, at your cost and no more than once a year, unless a breach or an authority requires otherwise. Send requests to contactmail.bsam@gmail.com.