Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms and Conditions (the "Agreement") between haimaker, Inc. ("haimaker") and the customer that accepts the Agreement ("Customer"). It applies automatically when Customer accepts the Agreement, and no signature is required. If this DPA conflicts with the Agreement, this DPA controls with respect to the processing of Customer Personal Data.

1. Definitions

• "Data Protection Laws" means all laws that apply to the processing of Customer Personal Data under the Agreement, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP"), and the California Consumer Privacy Act as amended ("CCPA").
• "Customer Content" means the prompts, files, context, and other inputs Customer submits through the Services and the outputs returned to Customer.
• "Customer Personal Data" means personal data contained in Customer Content that haimaker processes on behalf of Customer.
• "Subprocessor" means a third party that haimaker engages to process Customer Personal Data.
• "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
• "SCCs" means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914.

Terms such as "controller," "processor," "personal data," "processing," and "data subject" have the meanings given in the GDPR.

2. Roles and Scope

For Customer Personal Data, Customer is the controller (or a processor acting for its own controller) and haimaker is the processor (or subprocessor). haimaker is an independent controller of account, billing, usage, and communications data, which it processes as described in its Privacy Policy; this DPA does not apply to that data.

Customer is responsible for the lawfulness of the Customer Personal Data it submits, including providing any required notices and obtaining any required consents. Customer will not submit special categories of personal data, protected health information, payment card data, or other data subject to sector-specific regulation, except where haimaker has agreed to it in writing.

3. Customer Instructions

haimaker will process Customer Personal Data only on Customer's documented instructions, unless required to do otherwise by law, in which case haimaker will inform Customer before processing unless the law prohibits it. The Agreement, this DPA, and Customer's configuration and use of the Services (including Customer's model and provider selections, available routing settings, and the logging and auto router settings on each API key) are Customer's complete instructions. haimaker will tell Customer if it believes an instruction violates Data Protection Laws.

Customer-selected models and providers. Customer is responsible for selecting models, providers, and available routing settings appropriate to its intended use, including its confidentiality, retention, data-location, and regulatory requirements, based on the information made available through the Services and the applicable provider terms.

Customer's selections and enabled routing settings constitute documented instructions to transmit Customer Content to the providers identified for that configuration, including any disclosed fallback providers. Third-party providers' data-handling practices may differ. Geographic processing restrictions apply only where expressly included in the selected service or a written agreement.

This allocation does not limit haimaker's obligations under this DPA, Data Protection Laws, or the SCCs, including obligations relating to providers acting as its Subprocessors, the notice and objection rights in Section 6, and the international transfer safeguards in Section 11.

haimaker will not use Customer Content to train AI models and will not sell or share Customer Personal Data, or retain, use, or disclose it outside the direct business relationship with Customer, as those terms are used in the CCPA. haimaker certifies that it understands and will comply with these restrictions.

4. Confidentiality

haimaker will ensure that personnel authorized to process Customer Personal Data are bound by obligations of confidentiality and access it only as needed to provide the Services, support Customer, prevent abuse, or comply with law.

5. Security

haimaker will implement and maintain the technical and organizational measures described in Annex II to protect Customer Personal Data. haimaker may update these measures, provided the overall level of protection is not reduced.

6. Subprocessors

Customer gives haimaker general authorization to engage Subprocessors. The current list is published on the Subprocessors page. haimaker will update that page at least 30 days before a new Subprocessor starts processing Customer Personal Data. Customer may object on reasonable data protection grounds by emailing [email protected] within that period. If the parties cannot resolve the objection, Customer may stop using the affected model or feature or terminate the Agreement, and haimaker will refund any prepaid, unused credits.

haimaker will bind each Subprocessor to data protection obligations no less protective than this DPA, to the extent applicable to the services it provides, and remains responsible for its Subprocessors' compliance. Where a third-party model provider processes Customer Content under its own published terms, those terms apply to that provider's processing, as described in the Agreement.

7. Assistance

Taking into account the nature of the processing, haimaker will provide reasonable assistance to Customer in responding to data subject requests, and in carrying out data protection impact assessments and prior consultations with supervisory authorities. If haimaker receives a request from a data subject about Customer Personal Data, it will refer the data subject to Customer and will not respond itself unless Customer authorizes it or the law requires it.

8. Security Incidents

haimaker will notify Customer without undue delay after becoming aware of a Security Incident. The notice will describe the incident, its likely consequences, and the measures taken or proposed, as far as that information is available, and haimaker will provide updates as it learns more. Notification is not an acknowledgement of fault or liability.

9. Retention and Deletion

haimaker stores Customer Content only as configured by Customer and as described in Annex I. Logged prompts and responses are deleted automatically after 30 days. On termination of the Agreement, haimaker will delete remaining Customer Personal Data within 30 days, unless the law requires it to be kept.

10. Audits

On written request, no more than once a year, haimaker will provide information reasonably necessary to demonstrate compliance with this DPA, including responses to a reasonable security questionnaire. If that information is not sufficient to meet Customer's obligations under Data Protection Laws, or a supervisory authority requires it, Customer may conduct an audit at its own expense, with at least 30 days' notice, during business hours, subject to confidentiality obligations, and without access to other customers' data.

11. International Transfers

haimaker processes Customer Personal Data in the United States, and its Subprocessors process it in the locations listed on the Subprocessors page. Where Data Protection Laws require a transfer mechanism for Customer Personal Data transferred from the European Economic Area, the United Kingdom, or Switzerland to a country without an adequacy decision, the parties agree as follows:

• EEA: the SCCs are incorporated into this DPA, with Customer as data exporter and haimaker as data importer. Module Two applies where Customer is a controller and Module Three where Customer is a processor. Clause 7 (docking clause) applies. Under Clause 9, Option 2 (general written authorization) applies, with the notice period in Section 6 of this DPA. The option in Clause 11 does not apply. Under Clause 13, the competent supervisory authority is the one determined by Customer's establishment or representative in the EEA. Under Clauses 17 and 18, the SCCs are governed by the laws of Ireland and disputes are resolved by the courts of Ireland. Annexes I and II of this DPA complete the corresponding annexes of the SCCs, and the Subprocessors page completes Annex III.
• United Kingdom: the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0) is incorporated, with its tables completed from this DPA. Either party may end the Addendum as set out in its Section 19.
• Switzerland: the SCCs apply with references to the GDPR read as references to the FADP, the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority, and "Member State" read to include Switzerland.

If haimaker certifies to the EU-U.S. Data Privacy Framework, or its UK or Swiss extensions, it may rely on that certification instead of the SCCs for the transfers it covers.

12. Liability and Term

Each party's liability under this DPA is subject to the limitations of liability in the Agreement, except where Data Protection Laws or the SCCs do not allow such a limitation. This DPA stays in effect as long as haimaker processes Customer Personal Data. haimaker may update this DPA by posting a new version on this page; updates will not reduce the protection of Customer Personal Data except where required by law.

Annex I: Description of Processing

• Data exporter: Customer, as identified in its account. Activities: use of the Services.
• Data importer: haimaker, Inc., 447 Sutter St Ste 405 #122, San Francisco, CA 94108, United States. Contact: [email protected]. Activities: providing the Services.
• Data subjects: any individuals whose personal data Customer includes in Customer Content, which may include Customer's employees, contractors, end users, and customers.
• Categories of personal data: determined by Customer; any personal data contained in prompts, files, context, and outputs.
• Special categories: none, except as agreed in writing under Section 2.
• Frequency of transfer: continuous, for each API request.
• Nature and purpose: receiving Customer Content, routing it according to Customer's model and provider selections and enabled routing settings, returning the output, and, where Customer enables it, storing it for logging or auto router tuning; and preventing abuse of the Services.
• Retention: Customer Content is held in memory while a request is processed. Where logging is enabled for an API key, prompts and responses are stored for 30 days. Where an auto router is enabled, captured prompts and evaluation samples are stored for 30 days, and example prompts saved as part of a routing rule are kept until Customer deletes the rule or router. For free promotional models, keyed one-way fingerprints of request content are kept for 7 days for abuse prevention, longer only where they are evidence in an abuse case.
• Subprocessors: as listed on the Subprocessors page, for the purposes listed there and for the duration of the Agreement.

Annex II: Technical and Organizational Measures

• Encryption: TLS 1.2 or higher for data in transit; encryption at rest for databases and backups.
• Access control: production access limited to authorized personnel with a business need, using individual accounts, multi-factor authentication, and least-privilege roles.
• Tenant isolation: every API request is authenticated by API key and processed under that customer's account; customers cannot access each other's data.
• Data minimization: prompt and response logging is off by default for new API keys and can be controlled per key; stored content is deleted automatically after its retention period.
• Monitoring: logging and alerting for errors, abuse, and security events.
• Availability: managed cloud infrastructure with automated backups and redundancy.
• Change management: code review and automated testing before changes are deployed to production.
• Vendor management: Subprocessors are reviewed before engagement and bound by written terms.
• Incident response: a documented process for investigating, containing, and notifying customers of Security Incidents.