# Data Processing Agreement Source: https://docs.serenityedge.ai/terms/data-processing-agreement/ > **Document control** > > | Field | Value | > | --- | --- | > | Version | 1.1 | > | Effective date | 17 October 2026 | > | Last revised | 17 October 2026 | > | Approved by | Substrate Artificial Inteligence, S.A. | > | Contracting entity | Substrate Artificial Inteligence, S.A. | > > The full version history is available in the [Legal document changelog](https://docs.serenityedge.ai/terms/changelog/). ## Preamble This Data Processing Agreement forms part of the Agreement between Substrate AI and each Commercial Customer of Serenity Edge, in accordance with Article 28 of the GDPR. It applies whenever the Customer's Inputs or Outputs contain Personal Data. This Data Processing Agreement prevails over any conflicting terms of the Agreement in respect of the Processing of Personal Data, but does not otherwise modify the Agreement. Serenity Edge is designed so that the Processing carried out on behalf of the Customer is as limited as an inference service allows: Inputs and Outputs are processed in memory and are never written to disk or logs; prompt prefixes may be kept in volatile memory (a cache) for at most twenty-four (24) hours to speed up repeated requests, after which they are automatically evicted; and nothing is ever used to train any Model or made accessible to staff. This Data Processing Agreement records that design as a binding commitment and sets out the obligations of both Parties around it. ## 1\. Definitions The capitalised words in this Data Processing Agreement shall have the meaning given below: "**Agreement**": means the service agreement entered into by and between the Parties, governing the provision of the Services by Substrate AI to the Customer, consisting of the [Terms of Service](https://docs.serenityedge.ai/terms/terms-of-service/), the [Acceptable Use Policy](https://docs.serenityedge.ai/terms/acceptable-use/), any Additional Terms, this DPA and, where applicable, an Enterprise Agreement. "**Applicable Data Protection Law**": means any applicable national, EU or other privacy, data security or data protection law or regulation, including, to the extent applicable, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the "**GDPR**") and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the guarantee of digital rights (the "**LOPDGDD**"). "**Authorised Recipient**": means (i) Substrate AI's affiliates, (ii) Substrate AI's team members, (iii) Substrate AI's Sub-processors or (iv) any third party that is authorised by the Applicable Data Protection Law to access the Personal Data. "**Authorised Purpose**": means the authorised purpose for the Processing as described in Exhibit 1. "**Customer**": means any legal person, or any natural person acting in the course of its business or profession, that accesses or contracts the Services as a Commercial Customer under the Agreement and, where applicable, its affiliates. "**Data Controller**": means the person who determines the purposes and the means of the Processing. "**Data Processing Agreement**" or "**DPA**": means this data processing agreement governing the Processing carried out by the Parties, which forms part of the Agreement. "**Data Processor**": means the person who carries out the Processing on behalf of the Data Controller and under its documented instructions. "**Data Subjects**": means the natural persons whose Personal Data is processed. "**Inputs**" and "**Outputs**": have the meaning given to them in the Terms of Service. Inputs are the data the Customer submits to the API to prompt a Model, including messages, system instructions, documents, tool definitions and tool results; Outputs are the content the Services generate in response. "**International Data Transfer**": means any disclosure of Personal Data by an organisation established in the EEA to a Restricted Country. "**Personal Data**": means any data relating to an identified or identifiable Data Subject. "**Personal Data Breach**": means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed. "**Platform**": has the meaning given to it in the Terms of Service, that is, a third-party router, gateway or marketplace, such as OpenRouter, cortecs or EUrouter, through which the Customer may access the Services, whether the Platform offers them as a marketplace or resells them. The Platforms on which the Services are available, and those on which their onboarding is in progress, are listed at [https://docs.serenityedge.ai/docs/access/channels](https://docs.serenityedge.ai/docs/access/channels/). "**Platform Partner Addendum**": means the addendum to this DPA signed between Substrate AI and a Platform, as described in clauses 2.3 and 6.5. "**Processing**": means the processing of Personal Data described in Exhibit 1. "**Request Metadata**": means the technical information that the Services record about each request, limited to timestamps, token counts, the Model requested, latency, status codes and the identifier of the API Key used. Request Metadata never includes the content of Inputs or Outputs. "**Restricted Country**": means any country located outside the European Economic Area (EEA) that does not benefit from an adequacy decision from the European Commission. "**SCC**": means the clauses annexed to the EU Commission Implementing Decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, as amended or replaced from time to time. "**Serenity Star**": means the platform operated by Subgen AI Spain, S.L., a company incorporated under the laws of Spain, with Spanish tax identification number (NIF) B40656274, with its registered office at Calle Colón 8, Puerta 2, 46004 Valencia, Spain ("**Subgen AI**"), a group company of Substrate AI, through which the Customer may obtain API Keys and Credits for the Services. "**Services**": means Serenity Edge, that is, the inference API available at `https://api.serenityedge.ai/v1`, the Models it serves and the Documentation, as defined in the Terms of Service. "**Sub-processor**": means any Data Processor appointed by Substrate AI to carry out all or part of the Processing on behalf of the Customer. "**Substrate AI**": means Substrate Artificial Inteligence, S.A., a company incorporated under the laws of Spain, with Spanish tax identification number (NIF) A98306228, registered with the Commercial Registry of Toledo under Section 8, Sheet TO-48960, with its registered office at Avenida Real Fábrica de Sedas 28, 45600 Talavera de la Reina (Toledo), Spain. "**Supervisory Authority**": means any independent public authority competent to supervise the Processing, including the Spanish Data Protection Agency (AEPD). **Terms not defined in this document.** Any capitalised word that is not defined in this DPA shall have the meaning given in the Agreement. ## 2\. Role of the Parties ### 2.1. Substrate AI as Data Processor **Inputs and Outputs.** When the Customer sends Inputs to the API and receives Outputs, whichever access route it uses: - The Customer is the Data Controller of any Personal Data contained in the Inputs and the Outputs; - Substrate AI is the Data Processor for the limited and specific Authorised Purpose set out in Exhibit 1, namely generating the Output requested by the Customer. **Description of the Processing.** Substrate AI processes the Personal Data on behalf of the Customer in order to provide the Customer with the Services under the Agreement. A description of the Processing is available in Exhibit 1 of this DPA. The Customer agrees that Substrate AI may update the description of the Processing from time to time to reflect new Services, features or functionalities, provided that the update does not extend the Processing beyond what is necessary to provide the Services. ### 2.2. Substrate AI as Data Controller **Request Metadata and contract data.** Substrate AI processes as Data Controller, and not on behalf of the Customer, (i) the Request Metadata, for the purposes of billing, security, abuse prevention and capacity planning, and (ii) the identity, contact, contract and billing data of the Customer and of its representatives. That Processing is described in the [Privacy Policy](https://docs.serenityedge.ai/terms/privacy-policy/) and is not covered by this DPA. **No training on Inputs or Outputs.** Substrate AI does not use the Customer's Inputs or Outputs to train, fine-tune, evaluate or otherwise improve any Model, whether an Orion Model or an Open Model, does not retain them for any purpose after the response has been returned beyond the volatile cache described in clause 9.2, and does not share them with the authors of the Open Models. ### 2.3. Access routes **Through a Platform.** Where the Customer accesses the Services through a Platform as a marketplace, the Customer contracts with the Platform under the Platform's own terms, and the Platform meters and bills the Customer's usage and processes the Customer's requests before forwarding them to Substrate AI. The Platform is not a Sub-processor engaged by Substrate AI. This DPA governs the Processing from the moment the request reaches the API. The Customer is responsible for the lawfulness of the leg between the Customer and the Platform, including any International Data Transfer that it entails. **Platform Partner Addendum.** A Platform that resells the Services in its own name must sign a Platform Partner Addendum with Substrate AI, together with its reseller agreement, and any other Platform that processes its customers' Personal Data as their Data Processor may sign one. Under it, the Platform is the Customer under this DPA and Substrate AI acts as the Platform's sub-processor in accordance with Article 28(4) of the GDPR, as described in clause 6.5. For that Platform, the Platform Partner Addendum prevails over this DPA. **With a Serenity Star Account.** Where the Customer accesses the Services with a Serenity Star Account, Subgen AI processes the account, API Key, Credits and billing data of the Customer as operator of Serenity Star, under the Serenity Star terms and privacy policy. Subgen AI does not receive Inputs or Outputs for that purpose. Where the Customer wishes Subgen AI to act as its Data Processor for the account data, the Serenity Star data processing agreement applies to that Processing. **Under an Enterprise Agreement.** Where the Customer has signed an Enterprise Agreement, this DPA applies as part of it, and the Enterprise Agreement may add audit, notification or security provisions that go beyond this DPA. ## 3\. General obligations of the Parties Each Party shall comply with its respective obligations under the Applicable Data Protection Law and shall not, by any act or omission, cause the other to be in breach of any such obligations under the Applicable Data Protection Law. ### 3.1. General obligations of Substrate AI Substrate AI shall: - Process the Personal Data only in accordance with the documented lawful instructions of the Customer as set forth in this DPA, the Agreement or by email, and for no other purpose, unless required to do so by Union or Member State law to which Substrate AI is subject. In such a case, Substrate AI shall promptly inform the Customer of that legal requirement, unless prohibited from doing so by applicable law and/or on important grounds of public interest. The Customer's instructions consist in sending Inputs to the API with the parameters described in the Documentation; each request constitutes an instruction to generate the corresponding Output; - Promptly inform the Customer if, in its opinion, the Customer's instructions infringe the Applicable Data Protection Law. In such an event, Substrate AI is entitled to refuse to perform the Processing that it believes to be in violation of the Applicable Data Protection Law; - Ensure that any person Substrate AI authorises to process Personal Data (including Substrate AI team members and the Sub-processors) is subject to a duty of confidentiality, whether by contract or statutory, and not allow any person to process Personal Data who is not under such confidentiality obligations; - Implement the technical and organisational measures described in clause 5 and Exhibit 2; - Respect the conditions for engaging Sub-processors set out in clause 6; - Taking into account the nature of the Processing, assist the Customer by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Customer's obligation to respond to requests for exercising the Data Subjects' rights, as set out in clause 4; - Taking into account the nature of the Processing and the information available to Substrate AI, upon the Customer's written request and to the extent that is commercially reasonable and required by the Applicable Data Protection Law, provide the Customer with reasonable and timely assistance (i) in the event of an investigation from a Supervisory Authority related to the Processing, (ii) to conduct a data protection impact assessment or a prior consultation with a Supervisory Authority and (iii) to comply with its obligations under Articles 32 to 36 of the GDPR; - At the choice of the Customer, delete or return the Personal Data at the end of the provision of the Services, as set out in clause 9; - Make available to the Customer all information necessary to demonstrate compliance with Article 28 of the GDPR and allow for and contribute to audits, as set out in clause 8; and - Maintain a record of the categories of Processing carried out on behalf of the Customer, as required by Article 30(2) of the GDPR. ### 3.2. General obligations of the Customer The Customer agrees that: - It will comply with its obligations under the Applicable Data Protection Law regarding the Processing and any Processing instruction it issues to Substrate AI, including by determining a lawful basis for any Personal Data it includes in its Inputs; - It has provided notice to the Data Subjects and obtained all consents and rights necessary under the Applicable Data Protection Law for Substrate AI to process Personal Data under this DPA; - It is responsible for providing guidance to its Authorised Users regarding the use of the Services, and in particular the inclusion of Personal Data in Inputs, and for applying any filtering, minimisation or pseudonymisation that its own obligations require before sending Personal Data to the API; - It will not send special categories of Personal Data within the meaning of Article 9 of the GDPR, Personal Data relating to criminal convictions and offences, or Personal Data of children, unless it has determined that it may lawfully do so and that the measures in Exhibit 2 are appropriate for that Processing, and it accepts that Substrate AI applies the same measures to every request without distinction; - It is responsible for ensuring compliance with all security requirements on its side of the API, including the confidentiality of its API Keys and the security of its own systems and Customer Offerings; - It is responsible for complying with the obligations that apply to it as a deployer of an artificial intelligence system under Regulation (EU) 2024/1689, including any obligation to carry out a data protection impact assessment; - Substrate AI's security obligations under this DPA apply without prejudice to the Customer's own security obligations under the Applicable Data Protection Law; and - Where it accesses the Services through a Platform, it is responsible for the Processing carried out by the Platform and for any International Data Transfer that the Platform leg entails. ## 4\. Data Subject rights ### 4.1. Information As Data Controller, the Customer is solely responsible for providing the Data Subjects with any information required by the Applicable Data Protection Law. ### 4.2. Data Subject requests Taking into account the nature of the Processing, and upon the Customer's request, Substrate AI shall provide the Customer with commercially reasonable assistance to enable the Customer to respond to any request from Data Subjects to exercise any of their rights under the Applicable Data Protection Law. The Customer acknowledges that, because Inputs and Outputs are never written to disk or logs and are held only in volatile memory, including the cache described in clause 9.2, which is not accessible to staff and is automatically evicted within twenty-four (24) hours, Substrate AI cannot retrieve, rectify, erase or export the content of past requests. Substrate AI's assistance consists in confirming this design, in providing the information in this DPA and in cooperating with the Customer in respect of any Request Metadata that may be relevant. ### 4.3. Direct requests In the event that any request is made directly to Substrate AI by a Data Subject in respect of the Processing, Substrate AI will not respond to such request directly without the Customer's prior consent, unless required to do so by applicable law. Instead, Substrate AI will transfer that request to the Customer, where the Customer can be identified, who will then be solely responsible for responding to such request. If Substrate AI is legally required to respond to the Data Subject's request, Substrate AI will promptly notify the Customer and provide it with a copy of the request, unless prohibited from doing so by applicable law. ## 5\. Security and Personal Data Breach ### 5.1. Security measures Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the Processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Substrate AI shall implement and maintain appropriate technical and organisational measures to protect Personal Data from any Personal Data Breach and to preserve the security and confidentiality of the Personal Data. These measures, described in Exhibit 2, include: - Encryption of data in transit with TLS 1.2 or higher on every connection; - Processing of Inputs and Outputs in volatile memory only, with no persistence to disk, database or log at any point of the pipeline, and automatic eviction of cached prompt prefixes within twenty-four (24) hours; - Access controls and authentication mechanisms based on the principle of least privilege; - Storage of secrets and credentials in a managed key vault; - Network isolation of the inference path; - Logging that never contains Inputs or Outputs; and - Physical and environmental security of the facility where inference runs. Substrate AI may update the measures in Exhibit 2 from time to time, provided that the updated measures do not reduce the overall level of protection of the Personal Data. ### 5.2. Personal Data Breach In the event of a Personal Data Breach affecting Personal Data processed on behalf of the Customer, Substrate AI shall: 1. Notify the Customer without undue delay after becoming aware of the Personal Data Breach and, in any event, within a period that allows the Customer to meet the 72-hour deadline of Article 33 of the GDPR, to the email address associated with the Customer's Account or Enterprise Agreement or, failing that, to the contact details available to Substrate AI; 2. Provide the Customer with the information available to Substrate AI at the time and complete it as it becomes available, including: - A description of the nature of the Personal Data Breach, including, where possible, the categories and approximate number of Data Subjects and Personal Data records concerned; - The likely consequences of the Personal Data Breach; - The measures taken or proposed by Substrate AI to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects; and - The name and contact details of the point of contact at Substrate AI where more information can be obtained; 3. Cooperate with the Customer in investigating and remediating the Personal Data Breach and in meeting the Customer's own notification obligations; and 4. Document all Personal Data Breaches and the remedial actions taken. The Customer acknowledges that, given the design of the Services, a Personal Data Breach affecting Inputs or Outputs can only concern requests in flight or prompt prefixes held in the volatile cache at the time of the incident, and that Substrate AI may be unable to identify the Data Subjects or the content concerned. ## 6\. Sub-processing ### 6.1. Categories of recipient This DPA distinguishes three categories of recipient, which are subject to different regimes: - **Platform Sub-processors** support the delivery of the Services for every Customer and Process Personal Data irrespective of the access route the Customer chooses. They are listed in section 1 of the [Sub-processors](https://docs.serenityedge.ai/terms/sub-processors/) page. - **Access Route Providers** Process Personal Data only where the Customer has chosen the corresponding access route. They are listed in section 2 of the [Sub-processors](https://docs.serenityedge.ai/terms/sub-processors/) page. - **Platforms**, such as OpenRouter, cortecs or EUrouter, are not Sub-processors engaged by Substrate AI but independent routers, gateways or marketplaces with which the Customer contracts directly. They are addressed in clause 6.5. ### 6.2. General authorisation for Platform Sub-processors The Customer provides prior general authorisation for Substrate AI to engage Platform Sub-processors, subject to the following conditions: - Substrate AI maintains an up-to-date list of Platform Sub-processors on the [Sub-processors](https://docs.serenityedge.ai/terms/sub-processors/) page, stating for each of them the service it provides, the categories of Personal Data it processes, the region in which it processes them and the basis for any International Data Transfer; - Substrate AI provides thirty (30) days' prior notice of any intended addition or replacement of a Platform Sub-processor, as set out in clause 6.6; - Platform Sub-processors are bound, by a contract or another legal act under Union or Member State law, by data protection obligations no less protective than those in this DPA, including sufficient guarantees to implement appropriate technical and organisational measures; and - Substrate AI remains fully liable to the Customer for the performance of the Platform Sub-processors' obligations, in accordance with Article 28(4) of the GDPR. ### 6.3. Objection right The Customer may object, on reasonable grounds relating to data protection, to a new Platform Sub-processor within thirty (30) days of the notification referred to in clause 6.6, by writing to [contact@substrate.ai](mailto:contact@substrate.ai). Substrate AI will use commercially reasonable efforts to address the objection, for example by proposing a change to the Services that avoids the new Sub-processor. If no resolution is reached within thirty (30) days of the objection, the Customer may terminate the affected Services by written notice, without penalty, and clause 9 applies. ### 6.4. Access Route Providers The Services can be accessed with a Serenity Star Account. Where the Customer chooses that route, Subgen AI, as operator of Serenity Star, authenticates the Customer's requests and meters them against the Customer's Credits. For that purpose, Subgen AI Processes the identifier of the API Key and the token counts of each request, and holds the account, contact and billing data of the Customer as described in section 2 of the [Sub-processors](https://docs.serenityedge.ai/terms/sub-processors/) page. Subgen AI does not receive Inputs or Outputs on that basis. By creating a Serenity Star Account and using its API Keys with the Services, the Customer authorises Substrate AI to engage Subgen AI for that Processing. Because Subgen AI Processes no Personal Data on behalf of the Customer until the Customer chooses that route, the notice period in clause 6.2 does not apply to the availability of the Serenity Star route. Substrate AI remains liable to the Customer for the performance of Subgen AI's obligations in accordance with Article 28(4) of the GDPR. The relationship between Substrate AI and Subgen AI is governed by an intra-group data processing agreement, which is in preparation; its existence will be recorded on the [Sub-processors](https://docs.serenityedge.ai/terms/sub-processors/) page once it is signed. ### 6.5. Platforms Where the Customer accesses the Services through a Platform as a marketplace, the Customer determines the recipient of its requests by contracting with the Platform under the Platform's own terms. Substrate AI receives the requests that the Platform forwards to the API and returns the Outputs to the Platform as instructed by the Customer through that route. Substrate AI does not select, evaluate or contract with the Platform on behalf of the Customer, and the Platform is therefore not a Sub-processor engaged by Substrate AI. The Customer is responsible for the lawfulness of the transmission of Personal Data to the Platform, for any agreement required with the Platform and for any International Data Transfer that the Platform leg entails. **Platform Partner Addendum.** Under the Platform Partner Addendum referred to in clause 2.3, the Platform is the Customer under this DPA and Substrate AI acts as the Platform's sub-processor in accordance with Article 28(4) of the GDPR. The Platform accesses the Services exclusively through the API, with partner keys issued by Substrate AI; the Processing of Inputs and Outputs stays in the European Economic Area, with inference only on GPU infrastructure owned and operated by Substrate AI or its group; and Substrate AI notifies Personal Data Breaches to the Platform within forty-eight (48) hours of becoming aware of them. For that Platform, the Platform Partner Addendum prevails over this DPA. ### 6.6. Notification of changes Changes to the list of Platform Sub-processors are notified as follows: - **Channel**: by publication on the [Sub-processors](https://docs.serenityedge.ai/terms/sub-processors/) page and, where Substrate AI holds an email address for the Customer, by email to the address associated with the Customer's Account or Enterprise Agreement. - **Notice period**: at least thirty (30) days before the new Sub-processor starts Processing Personal Data on behalf of the Customer, save where the change is required to address a security incident or a legal requirement, in which case Substrate AI will give as much notice as is reasonably practicable and the Customer's objection right under clause 6.3 remains available. - **Subscription**: the Customer may subscribe to notifications of changes to the Sub-processor list by writing to [contact@substrate.ai](mailto:contact@substrate.ai). ## 7\. International Data Transfers ### 7.1. Location of the Processing All Processing carried out by Substrate AI on behalf of the Customer takes place within the European Union: - **Inference** runs on Substrate AI's own GPU infrastructure in Valencia, Spain, in a facility operated by Subgen AI on Substrate AI's behalf; - **Request handling**, including authentication, rate limiting, routing of the request to the inference infrastructure, the storage of secrets and the operational logs, runs in Microsoft Azure in the Spain Central region; - **Authentication and billing for Serenity Star Account traffic** are processed by Serenity Star in Microsoft Azure in the France Central region; and - **Edge network services** for traffic originating in the European Union are provided from the European Union data centres of the edge provider identified on the [Sub-processors](https://docs.serenityedge.ai/terms/sub-processors/) page. ### 7.2. No transfers outside the European Union Substrate AI does not transfer Personal Data processed on behalf of the Customer to a Restricted Country and does not instruct any Sub-processor to do so. Where a Platform Sub-processor is established outside the EEA, the [Sub-processors](https://docs.serenityedge.ai/terms/sub-processors/) page states the safeguard under which any access to Personal Data from outside the EEA would take place. Substrate AI will inform the Customer in accordance with clause 6.6 before any change that would entail an International Data Transfer, and the Customer's objection right under clause 6.3 applies to such a change. ### 7.3. Standard Contractual Clauses Should an International Data Transfer ever become necessary and the SCC apply to that transfer, the Parties agree to be bound by the SCC, in the module corresponding to their respective roles, which are incorporated by reference into this DPA, together with any supplementary measures required to ensure a level of protection essentially equivalent to that guaranteed within the EEA. ## 8\. Audits ### 8.1. Audit rights Upon reasonable notice and no more than once per year, save where a Supervisory Authority requires otherwise or a Personal Data Breach has occurred, the Customer may audit Substrate AI's compliance with this DPA by: - Requesting the documentation, certifications and audit reports that Substrate AI holds in respect of the Services and of its Sub-processors; - Submitting a written security questionnaire, which Substrate AI will answer within a reasonable period; and - Where the documentation provided is not sufficient to demonstrate compliance, conducting an on-site audit during regular business hours, directly or through an independent auditor bound by confidentiality obligations and reasonably acceptable to Substrate AI. ### 8.2. Audit process - The Customer must provide at least thirty (30) days' notice of an on-site audit, together with its scope; - Audits must not unreasonably interfere with Substrate AI's operations, with the security of the Services or with the confidentiality owed to other customers; - Access to the facility where inference runs is subject to its physical security rules and may be conducted in the presence of Substrate AI or Subgen AI personnel; - The Customer bears the costs of the audit, save where the audit reveals a material breach of this DPA by Substrate AI; - Audit findings must be shared with both Parties and are confidential information of Substrate AI; and - An Enterprise Agreement may provide for additional audit rights. ## 9\. Return or deletion of Personal Data ### 9.1. End of Services Because Inputs and Outputs are never written to disk or logs, Substrate AI holds no Personal Data on behalf of the Customer at the end of the Services other than the prompt prefixes that may remain in the volatile cache for at most twenty-four (24) hours, and there is nothing to return. Upon termination of the Services, and at the choice of the Customer notified in writing before termination or within thirty (30) days after it, Substrate AI shall confirm in writing that no Personal Data processed on behalf of the Customer is held by Substrate AI or its Sub-processors, and shall delete any residual copy that may exist in a cache or in transit, subject to the retention period in clause 9.2 and save where storage is required by Union or Member State law. Substrate AI shall ensure that its Sub-processors comply with the same requirement. ### 9.2. Retention period - **Inputs and Outputs**: never written to disk or logs. They are discarded from memory when the response is complete, save that prompt prefixes may be kept in volatile memory (a cache) for at most twenty-four (24) hours to speed up repeated requests, after which they are automatically evicted. Cached content is never written to persistent storage, is never used for training, is not accessible to staff and is never shared across API Keys. - **Request Metadata**: retained by Substrate AI as Data Controller for ninety (90) days from the request and then deleted, unless a longer retention is required by law. - **Account and billing data** held by Serenity Star: retained in accordance with the Serenity Star terms and privacy policy. ## 10\. Term and termination ### 10.1. Duration This DPA shall commence with the Agreement and continue for as long as Substrate AI processes Personal Data on behalf of the Customer, and until the confirmation referred to in clause 9.1 has been given. ### 10.2. Survival Obligations relating to confidentiality, liability and dispute resolution survive termination of this DPA. ## 11\. Limitation of liability ### 11.1. Liability cap The total aggregate liability of either Party under this DPA shall be subject to the limitations and exclusions set forth in Section 12 (Liability) of the Terms of Service or, where applicable, in the Enterprise Agreement. ### 11.2. Exclusions The liability caps do not apply to: - Wilful misconduct or gross negligence; - Breach of confidentiality obligations; or - Any liability that cannot be limited under the Applicable Data Protection Law, including the liability of each Party towards Data Subjects under Article 82 of the GDPR and any administrative fines imposed on a Party for its own infringement. ## 12\. Compliance with laws and regulations ### 12.1. Compliance framework Substrate AI shall maintain a compliance framework covering: - The GDPR and the LOPDGDD; - The obligations that apply to Substrate AI as a provider under Regulation (EU) 2024/1689 (the AI Act), in respect of the Models it makes available; and - The security obligations that apply to Substrate AI under the applicable law. ### 12.2. Documentation and records Both Parties shall maintain the documentation required by the Applicable Data Protection Law, including: - Records of processing activities under Article 30 of the GDPR; - Data protection impact assessments, where required; - Records of Personal Data Breaches; and - Any certifications or audit reports on which they rely. ## 13\. Changes to this DPA ### 13.1. Modification process - Substrate AI may modify this DPA with thirty (30) days' notice, published in the [Legal document changelog](https://docs.serenityedge.ai/terms/changelog/) and, where Substrate AI holds an email address for the Customer, sent by email; - Modifications that reduce the level of protection of the Personal Data require the Customer's consent; - Changes required by law or by a Supervisory Authority take effect on the date required by the law or the authority; and - Changes to Exhibit 2 that maintain or improve the level of protection are notified through the changelog and do not require consent. ### 13.2. Objection rights - The Customer may object to a modification that reduces the level of protection within fifteen (15) days of the notification; and - If no agreement is reached, the Customer may terminate the affected Services by written notice, without penalty. ## 14\. Dispute resolution ### 14.1. Governing law This DPA is governed by the laws of Spain, without regard to its conflict of law principles, and without prejudice to the direct applicability of the GDPR. ### 14.2. Jurisdiction The courts of the city of Madrid, Spain, shall have exclusive jurisdiction over any dispute arising out of or in connection with this DPA, without prejudice to the competence of the Supervisory Authorities and of the courts designated by Article 79 of the GDPR for claims brought by Data Subjects. ### 14.3. Dispute process 1. The Parties shall first attempt to resolve the dispute amicably in accordance with Section 18.2.1 of the Terms of Service; 2. Either Party may propose mediation through an agreed third party; and 3. Legal proceedings are the last resort. ## Exhibit 1. Description of the Processing Substrate AI may update this description from time to time to reflect new Services, features or functionality, within the limits set out in clause 2.1. ### A. List of the Parties - **Data Controller:** the Customer, identified by the API Keys it uses with the Services or by its Enterprise Agreement. - **Data Processor:** Substrate Artificial Inteligence, S.A. - **Substrate AI privacy contact:** [contact@substrate.ai](mailto:contact@substrate.ai). ### B. Subject matter of the Processing The provision of Serenity Edge, an inference API through which the Customer sends Inputs to a Model and receives Outputs, as described in the Agreement and the Documentation. ### C. Duration of the Processing For each request, from the moment the request reaches the API until the response has been returned to the Customer or, where the Customer uses a Platform, to the Platform, and the Inputs and Outputs have been discarded from memory, and, for prompt prefixes held in the cache, until their automatic eviction, which occurs within twenty-four (24) hours at the latest. Overall, for the term of the Agreement. ### D. Nature and purpose of the Processing - **Nature:** receipt of the Input over an encrypted connection; authentication and rate limiting of the request on the basis of the API Key; transmission of the Input to the inference infrastructure; generation of the Output by the Model; transmission of the Output to the Customer, in a single response or as a stream; discarding of the Input and the Output from memory once the response is complete; recording of the Request Metadata. Where the Customer's request allows it, a repeated prompt prefix may be kept in volatile memory (a cache) for at most twenty-four (24) hours to speed up subsequent requests of the same API Key, after which it is automatically evicted. - **Purpose (Authorised Purpose):** to generate the Output requested by the Customer. Substrate AI does not process the Personal Data contained in Inputs or Outputs for any other purpose. ### E. Categories of Data Subjects - The Customer's Authorised Users, insofar as they include their own Personal Data in Inputs; - The End-Users of the Customer Offerings, insofar as their Personal Data is included in Inputs; and - Any other natural person whose Personal Data the Customer or its Authorised Users include in Inputs, such as the Customer's own customers, employees, suppliers or contacts, or persons mentioned in documents submitted to the API. ### F. Categories of Personal Data Any Personal Data that the Customer chooses to include in its Inputs, and the Personal Data that a Model may generate in the Outputs in response. Substrate AI does not inspect Inputs and cannot restrict the categories of Personal Data they contain. By way of example, Inputs may contain identity and contact data, professional data, the content of communications, transaction data or any other information the Customer submits. ### G. Special categories of Personal Data None are expected. The Customer shall not include special categories of Personal Data within the meaning of Article 9 of the GDPR, Personal Data relating to criminal convictions and offences or Personal Data of children in its Inputs unless it has determined that it may lawfully do so and that the measures in Exhibit 2 are appropriate for that Processing, as set out in clause 3.2. ### H. Frequency of the Processing Continuous, at each request the Customer sends to the API. ### I. Retention periods - **Inputs and Outputs:** never written to disk or logs; discarded from memory when the response is complete, subject to the prompt cache below. - **Prompt cache:** prompt prefixes kept in volatile memory for at most twenty-four (24) hours, then automatically evicted; never written to persistent storage, never used for training, not accessible to staff and never shared across API Keys. - **Request Metadata:** ninety (90) days, held by Substrate AI as Data Controller. ### J. Processing elements specific to each access route - **Through a Platform:** the Input is received from the Platform and the Output is returned to the Platform, which delivers it to the Customer. The Platform is not a Sub-processor; where it has signed a Platform Partner Addendum, that addendum prevails (clause 6.5). - **With a Serenity Star Account:** the API Key is validated and the token counts of the request are reported to Serenity Star for metering against the Customer's Credits. Serenity Star does not receive Inputs or Outputs (clause 6.4). - **Under an Enterprise Agreement:** as above, with any additional provisions of the Enterprise Agreement. ### K. Technical and organisational security measures As detailed in Exhibit 2 of this DPA. ## Exhibit 2. Technical and organisational measures ### 1\. No persistence of Inputs and Outputs - Inputs and Outputs are processed in volatile memory only, at every stage of the pipeline: edge, request handling and inference. - No component of the pipeline writes Inputs or Outputs to disk, to a database, to a message queue with persistence or to a log. - Operational and security logs are designed to exclude request and response bodies; only Request Metadata is recorded. - The prompt cache holds prompt prefixes in volatile memory only, isolated per API Key, for at most twenty-four (24) hours, after which they are automatically evicted; it is never written to persistent storage and is not accessible to staff. - Inputs and Outputs are not sampled, reviewed by staff or used for training, fine-tuning or evaluation of any Model. ### 2\. Encryption - All connections to the API and between the components of the pipeline that cross a network boundary are encrypted with TLS 1.2 or higher. - Secrets, credentials and API Key material are stored in a managed key vault with access logging. ### 3\. Access control - Access to the systems that process Personal Data is restricted to authorised personnel of Substrate AI and of Subgen AI, on the basis of the principle of least privilege, with individual accounts and multi-factor authentication for administrative access. - Access rights are reviewed periodically and withdrawn when no longer needed. - Personnel with access are bound by confidentiality obligations. ### 4\. Network security - The inference path is isolated from the public internet; the inference infrastructure accepts traffic only from the request-handling layer. - The API is protected at the edge against denial-of-service attacks and common web attacks by the edge provider identified on the [Sub-processors](https://docs.serenityedge.ai/terms/sub-processors/) page. - Network segmentation separates the inference infrastructure from other systems. ### 5\. Physical and environmental security - Inference runs in a facility in Valencia, Spain, operated by Subgen AI on Substrate AI's behalf, with controlled physical access restricted to authorised personnel, access logging and environmental controls appropriate to computing equipment. - Request handling runs in Microsoft Azure data centres in the Spain Central region, subject to Microsoft's physical security controls. ### 6\. Availability and resilience - The Services are monitored continuously, and incidents are handled under an incident response procedure. - Capacity controls, including rate limits and the rejection of excess traffic, protect the Services against overload. - Because Inputs and Outputs are never written to disk, no backup of them exists and none is needed for their restoration. ### 7\. Organisational measures - A record of processing activities is maintained for the Processing carried out on behalf of Customers. - Personnel receive training on data protection and security appropriate to their role. - Personal Data Breaches are managed under a documented procedure that includes assessment, containment, notification in accordance with clause 5.2 and documentation. - Sub-processors are assessed before engagement and are bound by written data protection obligations. ### 8\. Data minimisation - Request Metadata is limited to the fields listed in the definition of that term and is deleted after ninety (90) days. - No component of the Services requires the Customer to submit Personal Data other than that contained in the Inputs the Customer chooses to send. ## Exhibit 3. Sub-processors The list of Sub-processors engaged by Substrate AI, with the service each of them provides, the categories of Personal Data it processes, the region in which it processes them and the basis for any International Data Transfer, is published and maintained on the [Sub-processors](https://docs.serenityedge.ai/terms/sub-processors/) page, which forms part of this DPA by reference.