Data Processing Agreement

1. Roles and definitions

You are the data controller: you decide what personal data you send to the service and why. We are the data processor: we process that personal data only to provide the Unbar service to you.

A prompt is the input that you send to a model. A completion is the output that a model returns. A sub-processor is a third party that processes personal data on our behalf.

2. Processing on your instructions

We process personal data only to provide the service and on your documented instructions. Your API requests and your account settings are your instructions. We do not use your prompts or completions to train models.

If law requires us to process personal data in another way, we will tell you first, unless the law prohibits that notice.

3. Security and confidentiality

We apply technical and organizational measures appropriate to the risk. We host the service in Switzerland, encrypt personal data in transit, and control access to our systems and records. People with access are bound to keep personal data confidential.

We do not retain prompts or completions after a request is processed.

4. Third-party model providers

We engage third-party model providers to process prompts and return completions. They act as sub-processors.

You can object to our use of a sub-processor. Where we can reasonably accommodate the objection, we restrict your account to a reduced set of providers. Where we cannot, you can stop using the affected models or end this agreement.

5. International data transfers

Personal data may be processed in countries outside Switzerland and the European Union. You are responsible for making sure that your use of the service to transmit personal data is lawful for you.

6. Your responsibilities

You must have a lawful basis for the personal data that you send. You decide what personal data enters a prompt. Do not send personal data that you are not permitted to share with third-party model providers.

7. Helping you meet your obligations

We assist you with requests from data subjects and with data protection impact assessments, so far as our role allows. A data subject is the person that personal data relates to. We do not retain prompts or completions. Your account, usage, and billing records are covered by the Privacy Policy.

8. Personal data breach

A personal data breach is a security failure that leads to loss, disclosure, or alteration of personal data. If we become aware of a breach that affects personal data we process, we notify you without undue delay and give you the information that you need to meet your own obligations.

9. Deletion and return of data

We do not retain prompts or completions after processing. We keep account, usage, and billing records as described in the Privacy Policy. On request, or when your account ends, we delete or return those records as that policy and applicable law allow.

10. Audit

On request, we make available the information reasonably necessary to demonstrate our compliance with this agreement.

11. Details of processing

Subject matter

Access to AI models through the Unbar API.

Duration

For as long as you use the service.

Nature and purpose

Receiving a prompt, transmitting it to a third-party model provider, and returning the completion to you.

Types of personal data

Any personal data that you choose to include in a prompt, and the resulting completion.

Categories of data subjects

Any person whose personal data you choose to include in a prompt.

Security measures

Hosting in Switzerland, encryption in transit, access control, and zero retention of prompts and completions.

12. Term, changes, and contact

This agreement applies while you use the service. We publish changes to this agreement on this page with a revised date.

Governing law: [JURISDICTION]. Any dispute is subject to the courts of [JURISDICTION].

Company: [ENTITY LEGAL NAME], [COMPANY REGISTRATION NUMBER], [REGISTERED ADDRESS].

For questions or data requests, email support@unbar.sh.