Data Processing Addendum

Capitalised terms not defined here have the meaning in the Agreement. “DPDP Act” means the Digital Personal Data Protection Act, 2023 and rules made under it. “Data Protection Laws” means the DPDP Act, the Information Technology Act, 2000, and any other data-protection or privacy laws applicable to the processing. “Personal Data”, “Data Principal”, “Data Fiduciary”, and “Data Processor” have the meanings in the DPDP Act; “process” is construed accordingly. “Customer Personal Data” means Personal Data within Customer Content that unoblox processes on the Customer’s behalf.

unoblox processes personal data in line with the Digital Personal Data Protection Act, 2023.

1. Roles. For Customer Personal Data, the Customer is the Data Fiduciary (controller) and unoblox is the Data Processor, processing only on the Customer’s documented instructions. For data unoblox handles as a Data Fiduciary in its own right (for example, account and billing data), unoblox’s Privacy Policy applies.
2. Instructions. The Agreement, this DPA, and the Customer’s configuration and use of the Service (including the Providers, routing, guardrails, and zero-data-retention settings it chooses) constitute its documented instructions. unoblox will inform the Customer if, in its opinion, an instruction infringes Data Protection Laws.
3. Scope. The subject matter, duration, nature, purpose, types of Personal Data, and categories of Data Principals are described in Annex A.

• Process Customer Personal Data only on the Customer’s documented instructions, including as to transfers, unless required by law (in which case unoblox will notify the Customer where lawful).
• Ensure persons authorised to process Customer Personal Data are bound by confidentiality.
• Implement and maintain the technical and organisational security measures in Annex B.
• Respect the conditions for engaging sub-processors (section 5).
• Assist the Customer, taking into account the nature of the processing, with data-principal requests (section 8) and with the Customer’s security, breach-notification, and compliance obligations.
• Delete or return Customer Personal Data at the end of the services (section 10).
• Make available information reasonably necessary to demonstrate compliance with this DPA (section 11).
• Not sell Customer Personal Data, and not use it to train unoblox’s own models or for any purpose other than providing the Service.

• The Customer is responsible for the lawfulness of the Customer Personal Data and of its instructions, including having a valid basis (such as consent) under Data Protection Laws to collect the data and to have it processed through the Service and the selected Providers.
• The Customer must provide any notices and obtain any consents required from Data Principals, and must not submit Personal Data in Input beyond what is necessary for its purpose.
• The Customer is responsible for configuring available controls (such as routing restrictions and zero-data-retention) appropriately for the sensitivity of its data.

1. General authorisation. The Customer authorises unoblox to engage the sub-processors listed in Annex C, including the AI Providers that serve the Customer’s requests, to process Customer Personal Data.
2. Obligations. unoblox will impose data-protection obligations on each sub-processor that are materially no less protective than this DPA, and remains responsible for its sub-processors’ performance of those obligations.
3. Changes & objection. unoblox will give notice of intended additions or replacements of sub-processors (by updating Annex C or the provider/model listings and, where the Customer subscribes, by notification), giving the Customer a reasonable opportunity to object on reasonable data-protection grounds. If an objection cannot be resolved, the Customer may, as its remedy, stop using the affected feature or terminate the affected part of the Service.
4. Provider selection. Because the Customer chooses which Providers its requests are routed to, the Customer’s selection constitutes authorisation of that Provider as a sub-processor for those requests.

unoblox implements and maintains appropriate technical and organisational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access, as set out in Annex B. These include encryption at rest (AES-GCM) and in transit (TLS), access controls, tenant isolation, and network-egress hardening. The Customer is responsible for its own security outside the Service, including safeguarding its API keys and credentials.

unoblox will notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data, and will provide information reasonably available to help the Customer meet its own notification obligations to the Data Protection Board of India, other authorities, and affected Data Principals. unoblox will take reasonable steps to mitigate and remediate the breach. Notification is not an acknowledgement of fault.

Taking into account the nature of the processing, unoblox will provide reasonable assistance, including appropriate technical and organisational measures, to help the Customer respond to requests from Data Principals to exercise their rights (such as access, correction, and erasure) under Data Protection Laws. If unoblox receives such a request directly relating to Customer Personal Data, it will, where lawful, direct the Data Principal to the Customer and promptly inform the Customer.

1. India residency. The unoblox platform, databases, and account/usage records are hosted in India with our data-centre provider, Yotta, and payments are processed in India by Razorpay. unoblox is structured to keep its core processing of Customer Personal Data within India.
2. Transfers under the DPDP Act. Any transfer of Customer Personal Data outside India — principally where the Customer routes requests to a Provider whose endpoint is abroad — is made in accordance with section 16 of the DPDP Act, which permits transfer except to territories restricted by the Central Government, and subject to the safeguards in this DPA.
3. Other laws. Where the Customer or its Data Principals are subject to a law (such as the EU/UK GDPR) that requires a specific transfer mechanism, the parties will, on request, enter into the applicable standard contractual clauses or equivalent mechanism, which will govern such transfers.

On termination or expiry of the services, and on the Customer’s request, unoblox will delete or return Customer Personal Data and delete existing copies, unless retention is required by law. Given the metadata-only and zero-data-retention design, prompt and completion content is generally not retained beyond serving requests; residual metadata and backups are deleted in the ordinary course within 90 days (180 days for enterprise Customers), consistent with our security-and-audit-log retention schedule (see the Privacy Policy).

unoblox will make available to the Customer information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by the Customer or an independent auditor it mandates. To protect confidentiality and the Service, audits are on reasonable prior written notice, no more than once per year (except where required by an authority or following a breach), during business hours, subject to confidentiality, and may be satisfied by unoblox providing then-current third-party reports or certifications where available.

Each party’s liability arising out of or related to this DPA is subject to the limitations and exclusions of liability in the Agreement, including the aggregate liability cap. This DPA does not create separate or additional liability caps.

In the event of a conflict between this DPA and the rest of the Agreement regarding the processing of Customer Personal Data, this DPA controls. In the event of a conflict between this DPA and an executed, negotiated DPA signed by both parties, the executed DPA controls. This DPA is governed by the same law and dispute-resolution terms as the Agreement (India).

• Encryption: authenticated encryption at rest (AES-GCM) for sensitive data; TLS in transit.
• Credential handling: API keys stored hashed; BYOK/provider credentials encrypted at rest.
• Access control: role-based access, least-privilege, authentication for administrative access, and audit logging of sensitive actions.
• Network hardening: validation and pinning of server-side requests to mitigate SSRF; segregation of environments.
• Multi-tenancy: logical isolation across organisations and workspaces. Dedicated Private-AI deployments are discussed and arranged on request (see Private AI), not a self-service, in-product control.
• Resilience: monitoring, logging, and backup of platform data.

The following sub-processors are authorised to process Customer Personal Data:

The set of AI Providers changes as the catalogue evolves; the current list is shown on the models and providers pages, which form part of this Annex.