Data Processing Agreement

Last updated: 2026-09-23

This Cover Page and the Common Paper DPA Standard Terms, Version 1.1, together form the Data Processing Agreement (the “DPA”) between U22A8 Inc. (“Provider”) and each customer (“Customer”) whose content submitted to the Service includes personal data. The DPA forms part of the Terms of Use and is accepted with them. For a countersigned copy, write to [email protected].

Key terms

Agreement

The Terms of Use, in the version Customer accepted.

Approved Subprocessors

• Rackspace (United States, Dallas–Fort Worth), which hosts the Service and its database.
• WorkOS (United States), which handles sign-in, accounts, and API key verification.
• OpenRouter (United States), which routes text to be encoded to the encoding model’s host, under zero data retention.
• Nebius (the EU or the United States), which encodes text under zero data retention: it keeps nothing after encoding, and trains on nothing.
• Resend (United States), which delivers the mail we send.

Provider Security Contact

[email protected]

Security Policy

Provider will use commercially reasonable efforts to secure the Service, as described in Annex II.

Governing Law and Chosen Courts

As set out in the Terms of Use: the Province of Ontario, and the courts of Toronto.

Service Provider Relationship

To the extent the California Consumer Privacy Act applies, Provider is a service provider to Customer, and will not sell or share Customer Personal Data, or retain, use, or disclose it for any purpose other than providing the Service to Customer.

Restricted transfers

Governing Member State

• EEA transfers: Ireland.
• UK transfers: England and Wales.

Annex I(A): List of parties

Data exporter

• Name: Customer, as identified by its workspace in the Service.
• Contact: the workspace’s owner.
• Activities relevant to the transfer: use of the Service under the Terms of Use.
• Role: Controller, or Processor where Customer processes on behalf of another.

Data importer

• Name: U22A8 Inc.
• Address: [registered address]
• Contact: Privacy Officer, [email protected]
• Activities relevant to the transfer: providing the Service, including judging and training on Customer’s content for Customer’s workspace only.
• Role: Processor.

Annex I(B): Description of transfer and processing

Service

The models U22A8 serves through its APIs, and the console from which Customer manages its workspace.

Categories of data subjects

• Customer’s employees and contractors who hold accounts in its workspace.
• Any individual whose personal data appears in content Customer submits, including Customer’s end users and customers.

Categories of personal data

• Name and email address of account holders.
• User activity: sign-in events, and per-request usage records (API key, model, time, token count).
• Personal data contained in the content Customer submits, as Customer determines. Provider does not inspect content for it.

Special category data

Not intended. Customer will not submit special category data unless the parties agree in writing on safeguards for it.

Frequency of transfer

Continuous, for as long as Customer uses the Service.

Nature and purpose of processing

• Receiving and holding content Customer submits.
• Using it to return verdicts and scores to Customer.
• Updating Customer’s own models with the corrections Customer submits. Customer content is never used to train or improve any model outside Customer’s workspace.
• Protecting it, as described in Annex II.
• Erasing it, on Customer’s request or when the workspace closes.

Duration of processing

For as long as needed to provide the Service to Customer, then until deleted as set out in the Privacy Policy.

Annex I(C): Competent supervisory authority

The supervisory authority of the data exporter, as determined under Clause 13 of the EEA SCCs or the corresponding provision of the UK Addendum.

Annex II: Technical and organizational security measures

• Isolation.Every item of content is stored and trained under the workspace it came from, and served only to that workspace’s API keys.
• Identification and authorization. Sign-in through WorkOS. Roles within a workspace. API keys carry separate permissions to judge and to train, are verified against WorkOS on use, and stop working within a minute of revocation.
• In transit. TLS on every connection to the Service and between the Service and its subprocessors.
• At rest.[the database’s encryption at rest]
• Pseudonymization and minimization. Source IP addresses are hashed at ingress. Encodings are cached under a one-way hash of the text, holding neither the text nor any link to a workspace. Text sent for encoding goes only to endpoints under zero data retention.
• Logging. Request logs are kept for up to 30 days.
• Retention and erasure. As set out in the Privacy Policy, including deletion within 30 days of a workspace closing.
• Physical security.Provided by Rackspace’s data centers.

Annex III: Subprocessors

The Approved Subprocessors listed under Key terms.

Common Paper Data Processing Agreement (Version 1.1) free to use under CC BY 4.0.