Data Processing Agreement (DPA)

This Data Processing Agreement (“DPA”) supplements Velqa's Terms of Service. Quantyl Core LLC, Velqa's publisher, acts as processor within the meaning of the GDPR. The customer, when transmitting personal data of its own end users via the API, acts as data controller.

This DPA applies for the entire duration of the customer's use of the API and ends upon account closure, subject to the legal retention periods described in the Privacy Policy.

Velqa processes data transmitted by the customer solely to route the request to the selected language model, return the generated response, handle usage billing, and detect abuse. The content of requests and responses (prompts/completions) is neither used to train a model nor resold.

Depending on how the customer uses the API, the data processed may include: the content of requests and responses transmitted via the API key, technical metadata (timestamp, model called, token volume), and any other data the customer chooses to include in its calls. The data subjects are the customer's end users.

• process data only on the customer's documented instructions;
• ensure the confidentiality of persons authorized to access the data;
• implement the security measures of GDPR Article 32;
• obtain the customer's prior consent before engaging any new sub-processor;
• assist the customer in exercising data subjects' rights;
• cooperate with any reasonable audit on 30 days' notice;
• notify any data breach without undue delay;
• delete or return the data at the end of the contract, unless legally required otherwise.

The following sub-processors are authorized:

• OVHcloud (hosting, EU — France);
• CMI and Stripe (payment processing only);
• DashScope, DeepSeek, Z.ai (Zhipu), and DeepInfra / Novita (language model inference providers, passthrough processing of requests/responses, no training or retention beyond request processing).

Encryption of data at rest (AES-256) and in transit (TLS 1.3), isolation of virtual API keys, role-based access control, immediate revocation of compromised keys from the dashboard, and technical audit logs.

Primary hosting is located in the European Union (OVHcloud, France). Some inference providers are located outside the EU; the corresponding transfers rely on the European Commission's standard contractual clauses (EU 2021/914) or an equivalent mechanism.

For any question about this DPA, or to sign a countersigned version, contact support@velqa.dev.