Data processing agreement

1. Scope and roles

• Subject: the personal data inside the files, sources, labels and datasets you send to the service (customer content), about your own customers, employees or other people.
• You are the controller: you decide why the data is processed and you answer for having a legal basis for it, including telling the people concerned.
• We are the processor: we process the data only to run the service for you (masking, structuring, labeling, training, comparison with Jev, delivery of the model), for as long as the retention in the privacy policy allows.

2. Your instructions

Your instructions are the terms of use, this DPA and what you do in the service (uploads, the decisions you choose, labels, trainings, deletions, publishing to Hugging Face). We follow no other use of the data. If we believe an instruction breaks the law, we will tell you and may refuse it.

3. Categories of data and people

• Data: whatever your content holds, typically names, contact details, documents, messages, tickets, reviews and records of your operation.
• People: your customers, users, employees, suppliers and others who appear in your content.
• Sensitive data (LGPD art. 11, GDPR art. 9) and data about children are not to be uploaded unless you have a legal basis and tell us first.

4. Masking and data minimization

• The first thing we do with an upload is mask personal data (names, emails, phone numbers, documents such as CPF and CNPJ, card numbers). The original upload is deleted as soon as the masked copy exists.
• Every later step, including the training machines and language models, receives only masked data.
• If you tell us your files hold no personal data, masking is skipped at your request and responsibility.

5. Confidentiality and security

• Only people and systems that need the data to run the service can reach it, under a duty of confidentiality.
• Traffic is encrypted (TLS), storage is encrypted at rest by our providers, passwords and API keys are stored only as hashes, and training machines are destroyed when each run ends.

6. Sub-processors

• You authorize the sub-processors listed in section 6 of the privacy policy (Cloudflare, Railway, vast.ai and its hosts, OpenRouter and the model providers behind it, Stripe, Resend, Sentry, Better Stack), each under data protection terms at least as protective as this DPA.
• We tell you by email at least 15 days before adding or replacing a sub-processor that handles customer content. If you object on reasonable data protection grounds and we cannot solve it, you may close the account and get back the money of unspent credits.
• We answer to you for the sub-processors we choose.

7. International transfers

Sub-processors may process data outside Brazil, mainly in the United States, and vast.ai machines may be in other countries (never in China). Transfers rely on the mechanisms of LGPD art. 33 and of the GDPR, such as standard contractual clauses and each provider's data processing terms, and only masked data goes to training machines and language models.

8. Requests from the people concerned

If someone asks us to exercise a right over data in your content, we forward the request to you and do not answer it ourselves unless the law requires. We help you answer, mostly through what the dashboard already does: delete datasets, models and the account.

9. Security incidents

If we become aware of an incident affecting personal data in your content, we tell you without undue delay and in any case within 48 hours, with what we know: what happened, the data and people likely affected, the measures taken and a contact. You decide on notifying the ANPD or other authority and the people affected, and we help with the information we have.

10. Deletion and return

• The data is deleted on the schedule in section 8 of the privacy policy: original uploads right after masking, masked data 90 days after last use, model files 30 days after the training, everything 30 days after you close the account.
• Before deletion you can download your models and delete your datasets yourself at any time. Records the law requires us to keep (payments, access logs) are kept only for that purpose.

11. Audits and information

We make available the information needed to show compliance with this DPA: this text, the privacy policy, the list of sub-processors and the audit file of each training. Further questions or a reasonable audit, at most once a year and with 30 days' notice, can be asked at privacy@typestrict.ai; an audit is at your cost and under confidentiality.

12. Term, liability and law

This DPA lasts while we process personal data in your content. Liability follows the limits of the terms of use, except where the law does not allow them. It follows Brazilian law and the courts set in the terms of use.