Data Processing Addendum
This page shows the standard terms. To execute it, email [email protected] with your company name and the agreement it attaches to; we return a signed copy within two business days.
1. Parties and roles
"Customer" is the entity named in the underlying agreement. "Provider" is Fedimoss (the Hong Kong company operating ainetcafe; legal name to be inserted on execution of any written agreement). For content the Customer sends through the API ("Customer Data"), Customer is the controller and Provider is the processor. Provider is an independent controller of account and billing data as described in the Privacy Policy.
2. Scope of processing
| Item | Detail |
|---|---|
| Subject matter | Provision of model inference through the API |
| Duration | Term of the underlying agreement plus the retention periods in section 6 |
| Nature and purpose | Transmit Customer Data to the model, return outputs, meter usage |
| Types of data | Any content Customer chooses to send: text, code, images, tool definitions |
| Data subjects | Customer's staff and end users, as determined by Customer |
3. Provider obligations
- Process Customer Data only to provide the service and on Customer's documented instructions, which include the API request itself and the agreement.
- Not store prompt or output content beyond transient processing, unless Customer opts in to logging in writing.
- Ensure staff with access are bound by confidentiality and trained in handling.
- Maintain the security measures in section 5 and assist Customer with data-subject requests and impact assessments at reasonable cost.
- Notify Customer without undue delay, and no later than 72 hours after confirmation, of a personal-data breach affecting Customer Data, with the information Customer needs to meet its own notification duties.
4. Sub-processors
Provider uses the following sub-processors: payment providers (Stripe; WeChat Pay for CNY payments), transactional email delivery, and cloud or colocation providers hosting the gateway. Model inference for Kimi K3 runs on infrastructure Provider operates. Provider gives 30 days' notice of new sub-processors; Customer may object on reasonable grounds and terminate the affected service if no resolution is found.
5. Security measures
- TLS for all traffic in transit; keys stored hashed; role-based access to production; logging of administrative access.
- Network isolation of inference nodes; no public exposure of internal management interfaces.
- Rate limiting and anomaly detection on the gateway.
- Backups of account and billing data; Customer Data content is not backed up because it is not stored.
6. Retention and deletion
Usage metadata is retained 30 days then deleted or aggregated. Any content logging Customer opts in to is retained for the period Customer specifies, not exceeding 90 days, then deleted. On termination Provider deletes or returns Customer Data within 30 days, except where retention is required by law.
7. Processing location
Self-serve and trial traffic is processed on Provider's clusters in China. For committed and core tiers the processing region is specified in the order form and may be located to meet Customer's requirements. Where Customer Data is transferred across borders, the parties rely on the contractual safeguards in this addendum and any additional clauses attached to the order form.
8. Audit
Once per year, on 30 days' notice, Customer may request a written description of Provider's controls and evidence reasonably needed to verify compliance. On-site audits are available to core-tier customers at Customer's cost.
9. Liability
Liability under this addendum is subject to the limits in the underlying agreement.
Signature block
| Customer Company: ______________________ Signed: ______________________ Name and title: ______________________ Date: __________ |
Provider Company: Fedimoss ______________________ Signed: ______________________ Name and title: ______________________ Date: __________ |