Tokely01Scope and roles
This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Tokely and a business customer (“Customer”) when Tokely processes personal data on the Customer’s behalf. It applies automatically; no signature is required. Customers who need a countersigned copy can request one at sup@tokely.me.
For personal data contained in request content, generated output, Playground conversations and webhook payloads (“Customer Personal Data”), the Customer is the controller and Tokely is the processor. Tokely is a controller for account, billing, security and website analytics data, which are covered by our Privacy Policy.
02Details of processing
- Subject matter and purpose: providing AI model access through the Tokely API, dashboard and Playground, including routing, billing, history and webhooks.
- Duration: for the term of the Customer’s use of the service and until deletion under this DPA.
- Nature: receipt, transmission to upstream AI providers, storage, retrieval and deletion.
- Data subjects: the Customer’s users, employees, end users and any person whose data the Customer submits.
- Categories of data: any personal data the Customer includes in prompts, files, media, conversation history or generated output.
- Special categories: not intended. The Customer will not submit special-category data without prior written agreement.
03Customer instructions
Tokely processes Customer Personal Data only on the Customer’s documented instructions, which are the Terms, this DPA and the Customer’s use and configuration of the service, unless law requires otherwise. Tokely will tell the Customer if it believes an instruction breaks data-protection law. The Customer is responsible for having a lawful basis and giving any required notices for the data it submits.
04Confidentiality and security
People authorised to access Customer Personal Data are bound by confidentiality. Tokely maintains technical and organisational measures appropriate to the risk, including:
- TLS encryption for traffic to the website, API and providers;
- authenticated, account-scoped access to data and API keys, with secrets stored outside source code;
- restricted administrative access and alerts on administrative and server logins;
- monitoring of service health, payment integrity and unusual account activity;
- backups of service databases and controlled deployment with rollback.
05Subprocessors
AI Providers. “AI Provider” means any third party that provides a model, model API, inference infrastructure, moderation or routing service used to fulfil a request. By selecting a model, the Customer authorises Tokely to engage the AI Providers that serve that model, including fallback routes, as subprocessors. No separate prior notice is required for each AI Provider. Tokely will notify Customers who have asked for email notices when it adds a new AI Provider. If the Customer objects to an AI Provider, its remedy is to stop using the affected model or route.
Infrastructure subprocessors. The Customer gives general authorisation for the other subprocessors listed on the Subprocessors page. Tokely will update that page before adding a new infrastructure subprocessor, except for urgent security or availability changes, and will notify Customers who have asked for email notices. The Customer may object on reasonable data-protection grounds within 14 days of the notice; if the parties cannot resolve the objection, the Customer may stop using the service, and any refund of unused balance follows our Refund Policy.
Tokely remains responsible for its subprocessors’ performance of their obligations as required by law. Upstream retention and training settings vary by provider, as described in the Privacy Policy.
06International transfers
Where Customer Personal Data from the EEA, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, the EU Standard Contractual Clauses (Commission Decision 2021/914, Module 2 or 3 as applicable) are incorporated into this DPA by reference, together with the UK International Data Transfer Addendum and the Swiss amendments where relevant. Tokely is the data importer. Clause 7 applies, Option 2 of Clause 9 applies with the notice period set out above, the optional wording in Clause 11 does not apply, and Clauses 17 and 18 select the law and courts of Ireland. Annexes I and II are completed by the sections of this DPA.
07Assistance and data subject requests
Tokely will promptly forward to the Customer any request it receives from a data subject about Customer Personal Data and will not respond except on instruction. Taking into account the nature of the processing, Tokely will reasonably assist the Customer with data subject requests, data protection impact assessments and consultations with supervisory authorities.
08Personal data breaches
Tokely will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe what is known about the breach, its likely consequences and the measures taken or proposed, and Tokely will provide further information as it becomes available.
09Deletion and return
The Customer can delete Playground conversations at any time. When the Customer closes its account, Tokely will delete or anonymise Customer Personal Data it holds within 30 days, except where retention is required by law. Copies in backups are overwritten in the normal backup cycle. Data held by upstream providers is subject to their retention terms.
10Information and audits
Tokely will make available the information reasonably necessary to demonstrate compliance with this DPA, including written responses to security questionnaires. Where that information is not sufficient, the Customer may request an audit with at least 30 days’ notice, no more than once a year unless required by a supervisory authority or after a breach, at the Customer’s cost and subject to confidentiality.
11US state privacy laws
Where the California Consumer Privacy Act or a similar US state law applies, Tokely acts as a service provider or processor. Tokely will not sell or share Customer Personal Data, will not retain, use or disclose it outside the direct business relationship or for any purpose other than providing the service, and will not combine it with other personal data except as permitted by law. Tokely will notify the Customer if it can no longer meet these obligations.
12Liability and precedence
Each party’s liability under this DPA is subject to the Terms of Service, except where law does not allow limitation. If there is a conflict, the Standard Contractual Clauses prevail over this DPA, and this DPA prevails over the Terms for the processing of Customer Personal Data. Questions about this DPA can be sent to sup@tokely.me.