Data Processing Agreement

This Data Processing Agreement ("DPA") applies when a business customer uses Tokentide to process personal data for which it is the controller, or which it processes on behalf of its own clients, and Tokentide processes that personal data on the customer's behalf. It supplements our Terms of Service and sets out the terms required by Article 28 of the GDPR. Capitalized terms not defined here have the meaning given in the Terms.

1. Parties and roles#

• Customer (or you): the business customer that signs this DPA.
• Tokentide (or we): Pending: [Company legal name], NIF Pending: [NIF], with registered office at Pending: [registered office address], Spain.
• Customer Personal Data: personal data contained in the Content (Inputs and Outputs) that Tokentide processes on your behalf when providing the Service.

For Customer Personal Data, you are the controller (or a processor acting for your own clients) and Tokentide is your processor (or sub-processor). For account, billing and request metadata, Tokentide is an independent controller under its Privacy Policy; that data is not covered by this DPA. If you act as a processor, you confirm that your controller has authorized your instructions to us and our use of sub-processors under this DPA.

2. Definitions#

• GDPR: Regulation (EU) 2016/679. LOPDGDD: Spanish Organic Law 3/2018 on the protection of personal data and the guarantee of digital rights. Data Protection Law: the GDPR, the LOPDGDD and any other data protection law of the EU or its Member States that applies to the processing under this DPA.
• Personal data, processing, controller, processor, data subject, personal data breach and supervisory authority have the meaning given in the GDPR.
• SCCs: the standard contractual clauses for transfers of personal data to third countries adopted by Commission Implementing Decision (EU) 2021/914.
• Sub-processor: a third party engaged by Tokentide that processes Customer Personal Data.

3. Subject matter, duration, nature and purpose#

• Subject matter: the processing of Customer Personal Data needed to provide the Service to you.
• Duration: while you use the Service under the Terms. Each Request is processed only for the time it takes to complete.
• Nature: transient processing in memory. We receive your Request over an encrypted connection, validate it, forward its Content to the model you selected through Venice, and relay the Output back to you. We don't store Content.
• Purpose: providing the Service as you request it.

Annex I gives further details.

4. Your instructions#

• We process Customer Personal Data only on your documented instructions. Your instructions are the Terms, this DPA, the settings you choose (such as the privacy mode of each API key) and the Requests you send. For example, choosing a model is an instruction to send the Content of that Request to that model's provider.
• If the law requires us to process Customer Personal Data in another way, we'll tell you before doing so, unless the law prohibits it.
• We'll tell you immediately if, in our opinion, an instruction infringes Data Protection Law.
• You are responsible for the lawfulness of the processing: having a legal basis, informing data subjects, and deciding whether to send special categories of personal data. We recommend using Private models.
• Anonymized models. If you enable Anonymized models (an API key with privacy mode all), the Content of those Requests is sent through Venice to the third-party provider of the chosen model, which may retain it under its own policy, without your identity. Enabling them is your instruction to make that transfer. Those providers act under their own terms with Venice, and we can't pass the obligations of this DPA on to them, so don't send personal data to Anonymized models unless your own assessment allows it.

5. Confidentiality#

We ensure that everyone we authorize to process Customer Personal Data is bound by confidentiality. Because we don't store Content, our staff have no access to Customer Personal Data after a Request completes.

6. Security#

We implement the technical and organizational measures described in Annex II, which ensure a level of security appropriate to the risk, as required by Article 32 GDPR. We may update these measures as long as the overall level of security is not reduced.

7. Sub-processors#

• General authorization. You authorize us to engage the sub-processors listed on our sub-processors page, which forms Annex III of this DPA.
• Changes. We announce any intended addition or replacement of a sub-processor at least 30 days before it takes effect, on the sub-processors page and by email to the contact you gave us when signing this DPA.
• Objections. You can object on reasonable data protection grounds within that notice period by writing to privacy@tokentide.app. We'll work with you in good faith to find a solution. If we can't, you may terminate the affected part of the Service before the change takes effect, and we'll refund your unused paid balance.
• Urgent replacements. If we must replace a sub-processor urgently, for example for security reasons or because it can no longer provide its service, we'll tell you as soon as possible, and your right to object still applies.
• Same obligations. We impose on each sub-processor, by written contract, data protection obligations equivalent to those in this DPA, as required by Article 28(4) GDPR, and we remain responsible to you for their performance.
• Venice. Venice's terms allow it to monitor information transmitted through its service. On Private models, Venice retains no prompts or outputs.

8. Assistance with data subject requests#

Taking into account the nature of the processing, we help you respond to requests from data subjects exercising their rights under Chapter III GDPR. Because we don't store Content, there is normally no Customer Personal Data for us to access, correct or delete after a Request completes; our assistance consists of giving you the information you reasonably need. If we receive a request from a data subject about Customer Personal Data, we'll forward it to you without undue delay if we can identify you, and we won't answer it ourselves except to redirect the data subject to you.

9. Assistance with DPIAs and prior consultation#

We give you the information you reasonably need about the Service, including this DPA, Annex II and our Security page, to help you meet your obligations on security (Article 32), data protection impact assessments (Article 35) and prior consultation with a supervisory authority (Article 36).

10. Personal data breaches#

• We notify you without undue delay, and at the latest within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.
• Our notice describes, as far as we know at that point, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, the measures taken or proposed, and a contact person. We provide further information in phases as it becomes available.
• We take reasonable steps to contain and investigate the breach and cooperate with you.
• Notifying a breach is not an admission of fault.

11. Deletion and return#

Content is never retained beyond the processing of each Request, so when the Service ends there is no Customer Personal Data to return or delete. The only exceptions are the opt-in features described in Annex I, whose data is deleted automatically within the periods stated there. On request, we confirm this in writing.

12. Audits and information#

• We make available the information necessary to demonstrate compliance with Article 28 GDPR, including this DPA, Annex II, our Security page and, under a confidentiality agreement, summaries of independent security test results. We answer a reasonable security questionnaire once a year.
• If that information is not enough to demonstrate compliance, if a supervisory authority requires it or after a personal data breach, you (or an independent auditor bound by confidentiality whom you appoint) may audit our compliance. Audits require at least 30 days' notice, take place during business hours at most once every 12 months (unless a supervisory authority requires more), are carried out at your cost and must not give access to other customers' data. For sub-processors, we rely on their own audit reports and certifications.

13. International transfers#

• Processing in the United States. We process Customer Personal Data in transit on our servers in the United States (Vercel functions in US East). Every Request therefore involves a transfer of Customer Personal Data to the United States. Sub-processors such as Venice process it as described in Annex III; Venice decides where inference runs and doesn't publish its location.
• Storage in the United States. We don't store Customer Personal Data (section 3). The data we store as an independent controller (account, billing and request metadata and the ledger) is stored in the United States (AWS US East: Neon Postgres and Upstash Redis), under our Privacy Policy.
• Safeguards. Where a transfer of Customer Personal Data to a country without an adequacy decision requires safeguards under Chapter V GDPR, we rely on the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the SCCs, together with the supplementary measures in Annex II (encryption in transit and at rest, and zero retention of Content). For our sub-processors, we rely on the EU-US Data Privacy Framework where the sub-processor is certified under it, and otherwise put in place the SCCs (Module Three, processor to processor), or rely on another adequacy decision. To the extent the SCCs are needed between you and us, they are incorporated by reference: Module Two where you are a controller and Module Three where you are a processor, with Annexes I to III of this DPA completing their appendices; the optional docking clause (Clause 7) applies; Clause 9(a) Option 2 (general written authorization, with the notice period in section 7) applies; the optional wording of Clause 11 does not apply; and for Clauses 17 and 18, the law and courts of Spain apply.
• You can ask us for a copy of the SCCs we have in place with sub-processors, with commercial information removed.

14. Liability#

Each party's liability under this DPA is subject to the limitations in section 17 of the Terms, except where the law doesn't allow them to be limited. Nothing in this DPA limits the rights of data subjects under Article 82 GDPR.

15. Term and termination#

This DPA takes effect when it is signed and stays in force until the Terms end and we no longer process Customer Personal Data for you. Obligations that by their nature should continue after that, such as confidentiality, continue.

16. Precedence, law and jurisdiction#

• If the SCCs apply, they prevail over this DPA; this DPA prevails over the Terms on data protection matters.
• This DPA is governed by Spanish law and subject to the courts of Pending: [city], Spain, except where the SCCs provide otherwise.

17. How to sign#

To sign this DPA, email support@tokentide.app from the email address of your Account with your company's legal name, registered address, VAT or registration number, and the name and role of the person signing. We'll send you a countersigned copy. The version of this DPA in force when you sign applies; we notify you of later changes in advance.

Annex I. Details of the processing#

A. Parties#

• Data exporter: the Customer, with the name, address and contact person given when signing this DPA. Activities: use of the Service. Role: controller, or processor on behalf of its own clients.
• Data importer: Tokentide (Pending: [Company legal name], Pending: [registered office address], Spain). Contact: privacy@tokentide.app. Activities: providing the Service. Role: processor or sub-processor.

B. Description of the processing#

C. Competent supervisory authority#

The Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) for Tokentide. Where the SCCs apply, the supervisory authority determined under their Clause 13.

Annex II. Technical and organizational measures#

Zero-logging architecture#

• Request and response bodies are streamed through memory and never logged, written to disk or sent to telemetry, error tracking or analytics.
• Code rules and automated tests prevent logging of bodies. Every day, canary tests send a unique marker through the Service and search logs, error tracking, databases, caches and queues for it; any hit raises a high-priority alert.
• Upstream error messages, which can echo Inputs, are stored only when they match a list of known templates.

Encryption#

• TLS 1.2 or higher for all connections, with HSTS preload on our domains.
• Encrypted connections to the database; encryption at rest by our infrastructure providers.
• The most sensitive secrets, such as our keys with the upstream model provider, are sealed with AES-256-GCM authenticated encryption under keys held only in our hosting provider's encrypted environment variables, outside the database; they are never stored in plaintext.
• Support for end-to-end encrypted models, where we only relay ciphertext.

Data location and minimization#

• All stored data is stored in the United States (AWS US East: Neon Postgres and Upstash Redis), encrypted at rest; Requests are processed in transit in the United States (Vercel functions in US East).
• Supplementary measures for transfers to the United States: encryption in transit and at rest, zero retention of Content, pseudonymous identifiers towards Venice and hashed IP prefixes.
• Venice receives a pseudonymous per-account identifier, never the customer's identity, IP address, cookies or user agent.
• IP addresses are stored only as hashes of the network prefix with a daily-rotating salt; request metadata keeps them for 30 days.
• Request metadata is kept in full for 90 days and then reduced to hourly aggregates.

Access control#

• Separate least-privilege database roles for each application; balances change only through audited database functions; row-level security as an additional layer.
• API keys stored only as HMAC-SHA-256 hashes, with checksummed prefixes that secret scanners can detect.
• Administrators must use passkeys (with TOTP as a backup factor), have sessions of at most 12 hours and re-authenticate for sensitive actions. Support impersonation is read-only, time-limited and audited.
• No staff access to Content, because it is not stored.

Monitoring and audit logging#

• A hash-chained, append-only audit log of security-relevant actions, verified daily.
• Alerts on anomalies such as unusual spend, key or sign-in activity.
• Error monitoring that receives metadata only, never Content.

Application security#

• Nonce-based Content Security Policy with strict-dynamic, and no third-party scripts on authenticated pages.
• Input validation at every boundary, a fixed upstream host and allowlisted paths to prevent server-side request forgery.
• Rate limiting and a web application firewall.
• Security updates: critical vulnerabilities patched within 24 hours and high ones within 7 days.

Incident response and testing#

• Documented incident response runbooks, including for suspected data leaks.
• The breach notification commitments in section 10.
• An external penetration test before public launch, and a privacy audit of all log sinks.

Sub-processor management#

• Written agreements with each sub-processor, with data protection obligations and transfer safeguards.
• Review of each provider's security before onboarding, and data minimization towards each of them.

Annex III. Sub-processors#

The current list of sub-processors, with their purpose, the data they process, their location and the transfer safeguard, is on our sub-processors page, which forms part of this DPA. Changes follow section 7.