Data Processing Addendum

“Personal data”, “processing”, “controller” and “processor” have the meanings given in applicable data protection law. “Customer Data” means personal data you or your end users submit to the Service, including data in requests sent through the API-Pay gateway or to AI Studio.

For Customer Data, you are the controller (or a processor acting for your own controller) and Infinite AI is your processor. For account and billing information we collect to run our business, we act as an independent controller as described in our Privacy Policy.

We process Customer Data only to provide, secure and support the Service and in accordance with your documented instructions, which include the Terms, this DPA and your configuration of the Service. If we believe an instruction infringes data protection law, we will tell you.

• Subject matter: provision of API gateway, monetization, AI and agent services.
• Duration: the term of your agreement plus any period needed to return or delete data.
• Categories of data subjects: your users, customers and personnel whose data you submit.
• Types of data: identifiers, contact details, usage metadata and any content you choose to send through the Service.

We ensure that anyone authorized to process Customer Data is bound by appropriate obligations of confidentiality and accesses it only as needed to deliver the Service.

We implement appropriate technical and organizational measures to protect Customer Data, taking into account the nature of the processing and the risks involved. These include:

• Deny-by-default access controls and least-privilege administration.
• Encryption of data in transit and protection of secrets on the server side.
• API keys stored as secure fingerprints rather than in readable form.
• Audit logging of privileged actions and continuous monitoring for threats.

More detail is available on our Security page.

You authorize us to engage subprocessors — such as hosting, database, payment and AI infrastructure providers — to help deliver the Service. We impose data protection obligations on each subprocessor that are no less protective than those in this DPA and remain responsible for their performance.

A current list of subprocessors is available on request. We will give notice of new subprocessors, and you may object on reasonable data protection grounds.

Taking into account the nature of the processing, we will provide reasonable assistance to help you respond to requests from individuals exercising their data protection rights. If we receive such a request directly for Customer Data, we will refer the individual to you where possible.

We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Data, and provide information reasonably available to us to help you meet your own obligations.

Where Customer Data is transferred across borders, we will rely on a lawful transfer mechanism recognized by applicable data protection law, such as standard contractual clauses where required.

On termination of the Service, we will delete or return Customer Data at your choice within a reasonable period, unless retention is required by law. You can delete much of your data yourself at any time from your command center.

We will make available information reasonably necessary to demonstrate compliance with this DPA and allow for reasonable audits, subject to appropriate confidentiality, frequency and scope limits agreed in advance.

If there is a conflict between this DPA and the Terms regarding the processing of Customer Data, this DPA prevails. Questions about this DPA can be sent through our contact page.