Data Processing Addendum

This Data Processing Addendum (the “DPA”) forms part of the Terms between Alumia and the organization that uses the Service (the “Customer”). It applies where Alumia processes personal data on the Customer’s behalf. In this DPA, the Customer is the controller and Alumia is the processor.

1. Roles and scope

The Customer determines the purposes and means of processing the personal data it submits to the Service (“Customer Personal Data”). Alumia processes Customer Personal Data only to provide the Service and only on the Customer’s documented instructions, which include the Terms, this DPA, and the configuration choices the Customer makes in the Service.

2. Nature and purpose of processing

Alumia processes Customer Personal Data to host and operate the Service, to run the agents and automations the Customer configures, to deliver AI features, to provide support, and to keep the Service secure. The categories of data subjects and personal data are determined by the Customer through its use of the Service and typically include the Customer’s users and the content they submit.

3. Subprocessors

The Customer authorizes Alumia to engage the subprocessors listed on our Subprocessors page to process Customer Personal Data. Alumia imposes data protection obligations on each subprocessor that are no less protective than those in this DPA, and remains responsible for their performance. We will give notice of a new subprocessor before it starts processing Customer Personal Data so the Customer has the opportunity to object. The inference hosts in entry 5 are selected by OpenRouter for each request and can change without individual notice; their providers and jurisdictions are as described above.

4. Artificial intelligence processing

AI features send the Customer’s prompts and submitted content to model providers that act as subprocessors so they can return a result. Alumia does not use Customer Personal Data to train foundation models, and passes an allowTraining:false setting to its model providers. The AI subprocessors and their upstream inference providers are listed on the Subprocessors page.

5. Confidentiality and security

Alumia ensures that personnel authorized to process Customer Personal Data are bound by confidentiality. Alumia maintains technical and organizational measures designed to protect Customer Personal Data, including encryption in transit, access controls, and isolation between organizations, appropriate to the risk.

6. Assistance and data subject requests

Taking into account the nature of the processing, Alumia will provide reasonable assistance to help the Customer respond to data subject requests and to meet the Customer’s obligations relating to security, breach notification, and data protection impact assessments. If Alumia receives a request directly from a data subject, it will refer that person to the Customer.

7. Personal data breach

Alumia will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will provide the information reasonably needed for the Customer to meet its own notification obligations.

8. International transfers

Paid plans are offered only to customers with a billing address in the United States. Where the GDPR applies to a transfer of personal data out of the EEA or the UK, we rely on the safeguards the law requires — an adequacy decision or standard contractual clauses — under the agreement with the partner concerned. No EEA or UK personal data is routed to a provider or host without those safeguards.

9. Deletion and return

On termination of the Service, and at the Customer’s choice, notified in writing to [email protected], Alumia will delete or return Customer Personal Data, and delete existing copies, except where retention is required by law. Deletion from routine backups follows the retention window described in the Privacy Notice.

10. Audits

Alumia will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, subject to reasonable confidentiality and security controls.

Contact

To raise a data protection matter or request a signed copy of this DPA, contact us. See also our Privacy Notice and our Subprocessors list.