Data Processing Agreement

Version 1.4 · last updated 11 October 2026

This Data Processing Agreement (the "DPA") is a contract under Art. 28 GDPR (Regulation (EU) 2016/679, the "GDPR"). It governs how Uprelic processes personal data on your behalf when you use Strom, Uprelic's decision API. It forms part of your agreement with Uprelic under the Uprelic Strom Terms (the "Terms").

§ 1 Parties, definitions and roles

1.1 Parties. This DPA is concluded between:

the business that holds a Strom account and uses Strom under the Terms (the "Customer", "you") — the controller; and
Uprelic GmbH, Liebenwalder Straße 16, 13347 Berlin, Germany, registered with the Amtsgericht Berlin (Charlottenburg) under HRB 288877 B ("Uprelic", "we", "us") — the processor.

1.2 Definitions. In this DPA:

"Service" means the Strom decision API at api.uprelic.com and the console at platform.uprelic.com, including its playground;
"Customer Content" means everything you send to the Service in an API or playground request — the state (text or JSON), the questions and their options, and images (as data URLs or as http(s) URLs) — together with the responses the Service returns;
"Customer Personal Data" means the personal data contained in Customer Content; and
"Request Record" means the stored copy of a request and its response described in § 2.3.

1.3 Uprelic as processor. For Customer Personal Data, you are the controller and we are your processor. This DPA governs that processing.

1.4 Where you are yourself a processor. Where you process Customer Personal Data on behalf of a third party (for example your own client), we act as your further processor. You are responsible for ensuring that your instructions to us are covered by your own contract with that third party. Towards us, you remain the party that gives instructions.

1.5 Where Uprelic is an independent controller. This DPA does not apply to the following processing, for which we act as an independent controller and which is described in our privacy policy:

a) your account and access data — email address, display name, sign-in data and the management of API keys; b) billing and payment — prepaid balance, top-ups, invoices and the processing carried out by our payment provider; c) the usage and billing metadata of requests that we keep after the request content has been deleted (§ 12.4); d) compliance with our own statutory duties, including tax and commercial retention duties and responses to lawful requests from authorities addressed to us; e) the security of our own infrastructure and our server logs — for example when we investigate an attack on our systems; f) a limited review of Customer Content by authorised staff, confined to the requests concerned, to detect and handle abuse, security incidents and breaches of the Acceptable Use Policy, on the basis of Art. 6 (1) (f) GDPR. Calls to the private endpoint (§ 12) are not stored, so their content is not available for this review; and g) the analysis of Customer Content for product development — by automated means and by authorised staff — to understand what the Service is used for, to improve and broaden it, and to develop further products and services and offer them to you, on the basis of Art. 6 (1) (f) GDPR. We analyse Request Records only while they are held under § 12.1, and results tied to individual requests are deleted with them. Findings about your use of the Service as a whole — for example the kinds of tasks you use it for — may be kept for the lifetime of your account; they contain no personal data from Customer Content. Other findings are kept only in aggregated form that identifies neither you nor any person. Calls to the private endpoint (§ 12) are not stored, so their content is not available for this analysis.

§ 3 (no training, no sale or sharing) applies to all processing, in any role.

1.6 Exceeding instructions (Art. 28 (10) GDPR). If we determine the purposes and means of processing in breach of this DPA, we are the controller for that processing.

§ 2 Subject matter, nature and purpose of the processing

2.1 Subject matter. We answer the questions you ask about the content you send. Strom answers typed questions — yes/no with a probability, a choice among up to 256 options with probabilities, or a score on a scale with a distribution — about the state and images in a request.

2.2 Nature of the processing. We receive Customer Content over an encrypted connection; download the images you reference by http(s) URL (public addresses only, no redirects, at most 10 MB and 10 seconds per image); run the Strom model on GPU servers in the EU (§ 9.2); return the response; store Request Records; and delete them. All processing is automated.

2.3 What is stored. For each API and playground request we store a Request Record containing the full input (the state and the question texts) and the full response, together with metadata (time, source — API or playground — name of the API key used, model, number of questions and images, tokens, cost and exchange rate). Images sent as base64 data URLs are not stored: the stored copy keeps only the image type and length. Where you reference an image by http(s) URL, we store the URL as you sent it; we do not store the downloaded image.

2.4 Purposes. We process Customer Personal Data only to:

a) answer your requests and deliver the responses; b) keep Request Records for the retention period in § 12.1 (standard: 90 days) for delivery, debugging and support, and the handling of billing disputes; c) meter and charge each request against your prepaid balance; and d) delete the data in accordance with § 12.

The detection and handling of abuse, security incidents and breaches of the Acceptable Use Policy, and the analysis of Customer Content for product development, are not purposes of processing on your behalf; we carry them out as independent controller (§ 1.5 (f) and (g)).

2.5 Details. The details required by Art. 28 (3) GDPR are set out in Annex 1, which forms part of this DPA.

§ 3 No training, no sale or sharing

3.1 No training. Uprelic never uses Customer Content — requests, images or responses — to train, fine-tune or evaluate Strom or any other model. This applies now and in future, and it applies equally to anonymised or aggregated forms of Customer Content. We train our models on other data: public datasets, synthetic data and Uprelic's own data.

3.2 No sale or sharing. We do not sell Customer Content, and we do not share it, or the results of the analysis under § 1.5 (g) that relate to you, with any third party — except with our subprocessors acting for us (§ 8) and where the law requires it (§ 1.5 (d), § 9.3). We do not use Customer Content for advertising or to profile the persons it concerns.

3.3 Own purposes. Apart from the limited review under § 1.5 (f) and the analysis under § 1.5 (g), we do not use Customer Content for our own purposes.

3.4 Protection of this commitment. § 3 can be changed only with your express agreement in text form. The amendment procedure in § 16.3 does not apply to it.

§ 4 Instructions

4.1 Processing on documented instructions only (Art. 28 (3) (a) GDPR). We process Customer Personal Data only on your documented instructions, including with regard to transfers to a third country, unless Union or Member State law to which we are subject requires otherwise. In that case we inform you of the legal requirement before processing, unless that law prohibits this on important grounds of public interest.

4.2 What constitutes an instruction. Your documented instructions consist of:

a) this DPA, including its annexes; b) the Terms; c) each request you send to the Service, through the API or the playground, including any image URL you ask us to download; d) the settings you make in the console, in particular creating and managing API keys; e) individual instructions given under § 4.3; and f) the operations needed to run, secure, back up and delete the Service's data as described in this DPA.

4.3 Individual instructions. Individual instructions going beyond § 4.2 must be given in text form to privacy@uprelic.com. We document them. The holder of the account and any further persons you name in text form may give instructions on your behalf. We carry out individual instructions that go beyond the functionality of the Service and beyond what Art. 28 GDPR requires against reimbursement of our reasonable effort, which we notify in advance; instructions needed to remedy a breach of duty on our part are carried out at our own cost.

4.4 Unlawful instructions (Art. 28 (3) subparagraph 2 GDPR). We inform you without undue delay if, in our opinion, an instruction infringes the GDPR or other Union or Member State data protection law. We may suspend carrying out that instruction until you confirm or change it. We are not obliged to carry out a legal review of instructions.

4.5 Instruction is not a legal basis. An instruction authorises our processing. It is not itself a legal basis for the processing and not a transfer mechanism. You are responsible for the legal basis (§ 5); transfers are governed by § 9.

§ 5 Your responsibilities

5.1 Lawfulness. You decide what personal data you put into your requests, and you are responsible for the lawfulness of that processing — in particular for a legal basis for collecting the data and sending it to us, and for compliance with the principles of Art. 5 GDPR, including data minimisation. Send only what Strom needs to answer your questions.

5.2 Information of data subjects. You are responsible for informing data subjects under Art. 13 and 14 GDPR, including persons whose data reaches Strom without having been provided by them — for example people named in your customers' messages or depicted in images you send.

5.3 Special categories. You may send special categories of personal data (Art. 9 GDPR) — for example health or biometric data — only if you have a legal basis for doing so and have checked that Strom and the measures in Annex 2 are appropriate for that data. Where you need a higher level of protection than Annex 2 provides, we must agree additional measures in text form before that processing begins.

5.4 Decisions based on Strom's outputs. Strom's outputs are model predictions with probabilities. They can be wrong. You decide how to act on them, for example by setting thresholds or by human review. You must not use Strom as the sole basis for decisions that produce legal effects concerning a person or similarly significantly affect them (Art. 22 GDPR) without human review.

5.5 Image URLs. When you reference an image by URL, we download it from the address you give. You must only give addresses you are entitled to have fetched. The operator of that address is not our subprocessor (§ 8.8).

5.6 API keys. You keep your API keys secret. Requests sent with your keys are treated as your instructions.

5.7 Impact assessment and records. You are responsible for any data protection impact assessment (Art. 35 GDPR) and for your own record of processing activities (Art. 30 (1) GDPR). We support you as set out in § 11.4.

§ 6 Confidentiality

6.1 Undertaking (Art. 28 (3) (b) GDPR). We ensure that everyone we authorise to process Customer Personal Data has committed to confidentiality or is under an appropriate statutory obligation of confidentiality. The undertaking continues after their work for us ends.

6.2 Scope. The undertaking covers employees, freelancers and anyone else acting under our authority with access to Customer Content.

6.3 Training of staff. These persons are made familiar with the data protection rules relevant to their work and with the fact that Customer Personal Data may be processed only on your instructions.

6.4 Evidence. On request we confirm compliance with this § 6 in text form.

§ 7 Security of processing

7.1 Measures (Art. 32 GDPR). We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the risks to the rights and freedoms of natural persons. The measures in force are described in Annex 2, which forms part of this DPA.

7.2 Development of the measures. The measures evolve with technical progress. We may change them provided the agreed level of protection is not reduced. We document material changes in a new version of Annex 2.

7.3 Access by our staff. Access to Customer Content by our staff takes place only through administration tools with access restricted as described in Annex 2, section 3, only on a need-to-know basis, and only as far as needed for the purposes in § 2.4 — in particular debugging, support at your request and the handling of billing disputes — or for the limited review under § 1.5 (f) and the analysis under § 1.5 (g). § 6 applies.

§ 8 Subprocessors

8.1 General authorisation. You give us a general written authorisation to engage other processors ("subprocessors"). The subprocessors we engage are listed, with purpose, data involved, location and transfer safeguard, at /legal/subprocessors. That list forms part of this DPA.

8.2 Selection and contract. Before engaging a subprocessor we satisfy ourselves that it provides sufficient guarantees within the meaning of Art. 28 (1) GDPR. We impose on each subprocessor, by contract, the same data protection obligations as this DPA imposes on us, in particular sufficient guarantees of appropriate technical and organisational measures (Art. 28 (4) GDPR). Where a subprocessor processes outside the European Economic Area (EEA), a safeguard under § 9 must be in place before processing begins. Where we cannot put such a contract and, where needed, such a safeguard in place, we do not engage the provider.

8.3 Liability for subprocessors. If a subprocessor fails to fulfil its data protection obligations, we remain fully liable to you for the performance of that subprocessor's obligations (Art. 28 (4) sentence 2 GDPR).

8.4 Advance notice of changes. We inform you of any intended addition or replacement of a subprocessor at least 30 days in advance, by email to the address of your account and by publishing the intended change, with the date it is to take effect, on the subprocessor list.

8.5 Right to object. You may object to the change on reasonable data protection grounds before it takes effect, in text form to privacy@uprelic.com. Grounds are reasonable where they name a specific data protection concern about the subprocessor concerned.

8.6 Consequences of an objection. If you object in good time, we will look in good faith for a solution within a reasonable period — in particular whether the processing can be carried out without the subprocessor concerned or with an alternative provider. If no solution is found, you may terminate the agreement with effect from the date on which the change takes effect. Unused prepaid balance is then refunded; § 18.5 of the Terms applies as for a termination because of an objection to changed terms.

8.7 Urgent replacement. Where a subprocessor has to be replaced at short notice to maintain the security or availability of the Service, we may make the change with immediate effect and inform you without undue delay afterwards, giving reasons. §§ 8.5 and 8.6 then apply after the event.

8.8 Not subprocessors. The following are not subprocessors:

a) the components we run ourselves on the servers operated for us — the API, the database and the Strom model. They are our own systems, not services of a third party; the GPU cloud providers that operate the servers are subprocessors and are listed; b) the operators of addresses from which you ask us to download images (§ 5.5); and c) providers of telecommunications and network transport, and professional advisers bound by a statutory duty of secrecy.

8.9 No AI model providers. No third-party AI model provider receives Customer Content. The Strom model is Uprelic's own decision model, fine-tuned by Uprelic from open model weights, and runs on model servers that have no route to the internet. Engaging such a provider would be a change under § 8.4.

§ 9 International transfers

9.1 Safeguards required. We transfer Customer Personal Data to a country outside the EEA, or to an international organisation, only on your instructions and only where the conditions of Art. 44 ff. GDPR are met — in particular on the basis of an adequacy decision of the European Commission (Art. 45 GDPR) or of appropriate safeguards such as the Commission's standard contractual clauses (Art. 46 (2) (c) GDPR), supplemented by additional measures where required. The location and the safeguard relied on for each subprocessor are stated on the subprocessor list.

9.2 Where processing takes place. Customer Content is processed on GPU servers in the EU, operated for us by Scaleway SAS in its data centres in France. The API and the database, which holds accounts and stored requests, run on the same servers. Traffic to the Service reaches the servers through a load balancer operated by Scaleway SAS in its data centres in France, where the encrypted connection (TLS) ends before the data is forwarded to our servers over a private network. Encrypted backups are stored in Scaleway Object Storage in Amsterdam, Netherlands (EU).

9.3 Requests from third-country authorities. If an authority of a third country addresses to us or to a subprocessor a binding request for disclosure of Customer Personal Data, we will, as far as legally permitted, inform you without undue delay, challenge the request where there are reasonable grounds to do so, and disclose no more than is required. We do not transfer data on the basis of a judgment or decision of a third-country authority that is not based on an international agreement in force (Art. 48 GDPR), unless another condition of Chapter V GDPR applies.

9.4 Change in the legal position. If a safeguard we rely on ceases to be adequate, we inform you without undue delay, suspend the affected transfers where necessary, and either put an alternative safeguard in place or stop using the recipient concerned. § 8.6 applies accordingly.

§ 10 Data subject rights

10.1 Assistance (Art. 28 (3) (e) GDPR). Taking into account the nature of the processing, we assist you by appropriate technical and organisational measures, as far as possible, in responding to requests from data subjects exercising their rights under Chapter III GDPR.

10.2 How we assist. Strom has no self-service tooling for data subject requests. On your request in text form we will, for Request Records still held, locate the relevant records (for example by time, API key or search terms you give us), provide copies, and delete individual Request Records before the end of the 90-day period (§ 12.1). § 4.3 applies to effort beyond what Art. 28 GDPR requires.

10.3 Requests addressed to us. If a data subject addresses a request to us that concerns processing we carry out for you, we do not answer it in substance. We refer the data subject to you and forward the request to you without undue delay, as far as we can identify you.

10.4 Correction and deletion only on instruction. We correct, delete or restrict Customer Personal Data only on your instructions, unless the law requires us to act.

§ 11 Personal data breaches and further assistance

11.1 Notification (Art. 33 (2) GDPR). We notify you of a personal data breach affecting Customer Personal Data without undue delay after becoming aware of it; our target is to do so within 48 hours. We send the notification to the email address of your account and to any security contact you name in text form.

11.2 Content. The notification contains, as far as available: a description of the nature of the breach, including where possible the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address the breach and mitigate its effects; and a contact point for further information. Where not all information is available at once, we provide it in stages without further undue delay. A notification is not an acknowledgement of fault or liability.

11.3 Support. We support you in investigating the breach, in notifying the supervisory authority (Art. 33 GDPR) and in communicating with data subjects (Art. 34 GDPR), and we document the breach and the remedial measures. You make the notification and the communication, unless you instruct us otherwise in text form.

11.4 Impact assessment and prior consultation. Taking into account the nature of the processing and the information available to us, we assist you with data protection impact assessments (Art. 35 GDPR) and prior consultations of the supervisory authority (Art. 36 GDPR), in particular by providing information on the processing, on the measures in Annex 2 and on our subprocessors.

11.5 Supervisory authorities. We cooperate on request with the supervisory authority competent for you as far as the processing for you is concerned, and inform you without undue delay of any inspection or measure by a supervisory authority that concerns it.

§ 12 Retention, deletion and return

Private endpoint. After we enable zero data retention for your account, calling POST /v1/systemone/private is your documented instruction to process its content without retaining it in application request records. No input, output, image URL or content-bearing error is stored in our database or database backups. Backend exception logging excludes content. Their content is therefore not available for the limited review under § 1.5 (f), the analysis under § 1.5 (g), nor for debugging or support under § 7.3. The standard content-retention periods below apply to standard calls only. Billing and operational metadata are retained under § 12.4. Infrastructure logging and operating-system memory handling retain their normal settings; model-server diagnostics, swap and crash dumps are outside this application-storage guarantee. See Zero data retention.

12.1 Request Records: 90 days, or earlier on your instruction. By accepting this DPA you instruct us to keep the content of each Request Record — the state, the question texts, image URLs and the response — for 90 days after the request and then to delete it automatically (standard retention). You may at any time instruct us to delete Request Records earlier — individual records, the records of a period or of an API key, or all of them — in text form to privacy@uprelic.com. We then delete the content from the live database within 30 days; it disappears from backups as set out in § 12.3.

12.2 Images. Images sent as base64 data URLs are not stored beyond processing the request; the stored copy keeps only the image type and length. Images downloaded from a URL are not stored; only the URL is kept, and it is deleted with the Request Record.

12.3 Backups. Our database is backed up daily, encrypted, and we keep 14 daily, 8 weekly and 12 monthly backups. Backups are not changed individually; data deleted from the database disappears from the backups as they rotate, within at most 12 months. Until then, backups are used only to restore the Service. If we restore a backup, we delete again any Request Records that are older than 90 days or that you instructed us to delete earlier.

12.4 Metadata kept longer. After the content has been deleted, the remaining record contains no request content, only the metadata needed for billing, tax and usage history — time, source, API key name, model, number of questions and images, tokens, cost and exchange rate. We keep it for the lifetime of your account and afterwards as long as statutory retention duties require (under § 147 AO and § 257 HGB, eight or ten years depending on the type of record). We process it as controller (§ 1.5 (c)).

12.5 Server logs. Our server logs contain IP addresses and request metadata and are kept for operation and security for 90 days and then deleted automatically.

12.6 End of the agreement (Art. 28 (3) (g) GDPR). When the agreement ends, we delete or return Customer Personal Data at your choice, and delete existing copies, unless Union or Member State law requires storage. You have received each response when you made the request. If you ask us in text form before the agreement ends, or during the transitional or retrieval period under § 19 of the Terms (EU Data Act), we provide the Request Records still held in a structured, commonly used and machine-readable format (JSON) before deleting them, free of charge. When the retrieval period ends, we delete the remaining Request Records, unless they have been deleted earlier under § 12.1. Backups roll off as set out in § 12.3.

12.7 Subprocessors. We instruct our subprocessors to delete accordingly.

12.8 Confirmation. On request we confirm the deletion in text form.

§ 13 Audits and information

13.1 Information and audits (Art. 28 (3) (h) GDPR). We make available to you all information necessary to demonstrate compliance with Art. 28 GDPR, and allow for and contribute to audits, including inspections, conducted by you or another auditor mandated by you.

13.2 Documentation. On request we provide: this DPA with its annexes in the version in force; the current subprocessor list; an extract of our record of processing activities (Art. 30 (2) GDPR) for the processing carried out for you; answers to a security questionnaire of customary scope within a reasonable period; and our confirmation under § 6.4.

13.3 No certification at present. Uprelic does not currently hold an ISO/IEC 27001 certification or a SOC 2 report. Evidence therefore consists of the documentation under § 13.2 and the reports and certifications of our subprocessors, where available to us and where we may pass them on. If we obtain a certification or audit report in future, we will provide it.

13.4 Inspections. Where the information under §§ 13.2 and 13.3 is not sufficient, or after a personal data breach, you may inspect our processing yourself or through an independent auditor bound to confidentiality who is not a competitor of Uprelic. Inspections require at least 30 days' notice in text form (unless an urgent reason requires less), take place during normal business hours without disrupting operations, are limited to the processing carried out for you, and must protect our trade secrets and the data of other customers. They take place no more than once per calendar year, unless a personal data breach has occurred or a supervisory authority requires it.

13.5 Costs. Information under §§ 13.2 and 13.3 is free of charge. For inspections we may charge our reasonable costs, notified in advance, unless the inspection reveals a material breach of this DPA on our part.

13.6 Supervisory authorities. The powers of supervisory authorities under Art. 58 GDPR are not affected by this § 13.

§ 14 Liability

14.1 Between the parties. Liability between the parties under this DPA is governed by the liability provisions of the Terms. This DPA does not create a separate or wider liability regime.

14.2 Towards data subjects. Liability towards data subjects under Art. 82 GDPR remains unaffected by § 14.1 and by any other provision of the agreement.

14.3 Internal allocation. Where a party has paid full compensation to a data subject under Art. 82 (4) GDPR, it may claim back from the other party the part corresponding to that party's share of responsibility (Art. 82 (5) GDPR). Between the parties, you are responsible for the lawfulness of the processing you instruct and for the matters in § 5; we are responsible for following your instructions, for the duties of a processor under the GDPR and for the measures in Annex 2.

14.4 Fines. Fines imposed by a supervisory authority on a party are borne by that party.

§ 15 Term

15.1 Duration. This DPA applies for as long as you use the Service under the Terms. It continues to apply afterwards for as long as we hold Customer Personal Data, until deletion is complete, including the rotation of backups under § 12.3.

15.2 Termination. This DPA cannot be terminated separately from the agreement. Your right to terminate under § 8.6 and the right of either party to terminate for good cause remain unaffected.

15.3 Survival. §§ 6, 12, 13 and 14 survive the end of this DPA for as long as needed for their purpose.

§ 16 Final provisions

16.1 Form. This DPA is concluded in electronic form, which satisfies Art. 28 (9) GDPR, together with the Terms. No separate signature is required. You accept this DPA before your first use of the Service, together with the Terms and the Acceptable Use Policy, in the version shown to you (§ 3.3 of the Terms). We record your acceptance with the date and the version, and make a copy available to you (as a PDF or by email).

16.2 Precedence. In all matters of data protection, this DPA takes precedence over the Terms and any other part of the agreement. § 14.1 is an exception: liability between the parties follows the Terms.

16.3 Amendments. We amend this DPA in accordance with the amendment procedure of the Terms, with these additions:

a) amendments required by a change in the law, in case law or in the requirements of a supervisory authority may take effect immediately; we inform you without undue delay; b) changes to the subprocessor list are not amendments to this DPA; they are governed exclusively by §§ 8.4 to 8.7; c) changes to Annex 2 are governed by § 7.2; and d) § 3 can be changed only as set out in § 3.4.

Every version of this DPA carries a version number and a date.

16.4 Severability. If a provision of this DPA is or becomes invalid, the rest remains valid. The statutory rules take the place of the invalid provision.

16.5 Governing law and jurisdiction. German law applies. The courts of Berlin have jurisdiction.

16.6 Language. This DPA is provided in English and German. As provided in the Terms, the English version is binding; the German version is provided for convenience.

16.7 Contact. Data protection and instructions: privacy@uprelic.com. We are not required to designate a data protection officer (Art. 37 GDPR, § 38 BDSG).

Annex 1 — Details of the processing

A. Subject matter and duration

Answering the Customer's questions about the content it sends to the Service, and storing requests and responses as described in § 2.3. Duration: as set out in § 15.1. Retention of Request Records: 90 days as the Customer's documented instruction, or earlier on its instruction (§ 12.1).

B. Nature and purpose

Receiving, downloading (images referenced by URL), analysing by the Strom model, returning, storing, restricting and deleting Customer Content — by automated means. Purposes: as set out in § 2.4. Not a purpose: training, fine-tuning or evaluating any model (§ 3). The analysis of Customer Content for product development is carried out by Uprelic as independent controller (§ 1.5 (g)).

C. Types of personal data

Whatever personal data you include in your requests. You decide. Typically:

Data	Examples
Content of the `state` (text or JSON)	Your customers' messages, names, contact details, order or support history, listings, reviews
Questions and options	The texts of your questions and answer options, where they refer to persons
Images	Photos, screenshots or scanned documents that may show persons or personal information
Image URLs	Addresses of images, which may contain identifiers
Responses	Probabilities, choices and scores, which are personal data where the question relates to a person
Request metadata (while the content is held)	Time, source, API key name, model, number of questions and images, tokens, cost
Connection data	IP addresses of the systems that send requests, in server logs

D. Categories of data subjects

You decide. Typically: your customers and end users and the people they communicate with; your employees and other persons who send requests or appear in them; any other persons named, described or depicted in Customer Content.

E. Special categories of personal data

Only where you have a legal basis and have checked that Strom is appropriate for that data (§ 5.3).

F. Retention

Data	Retention
Request Record content (`state`, question texts, image URLs, response)	90 days after the request as your documented instruction, then deleted; earlier deletion within 30 days on your instruction (§ 12.1)
Images sent as base64 data URLs	Not stored; the stored copy keeps only type and length
Images downloaded from a URL	Not stored; the URL is kept with the Request Record
Backups	Rotating: 14 daily, 8 weekly, 12 monthly — deleted data is gone within at most 12 months (§ 12.3)
Server logs	90 days
Billing and usage metadata (no content)	Account lifetime plus eight or ten years (§ 147 AO, § 257 HGB) — processed by Uprelic as controller (§ 12.4)

G. Places of processing

Layer	Location
Platform (API, database)	EU — Scaleway SAS, Paris, France (data centres in France)
GPU servers (Strom model)	EU — Scaleway SAS, Paris, France (data centres in France)
Load balancer — TLS termination (data in transit)	EU — Scaleway SAS, Paris, France (data centres in France)
Encrypted backups	EU — Scaleway SAS, Amsterdam, Netherlands

Annex 2 — Technical and organisational measures

These are the measures in force at the date of this DPA. § 7.2 governs changes.

1. Physical security

The Service runs on GPU servers operated for Uprelic by Scaleway SAS in its data centres in France. Physical access control and environmental protection are provided by the provider under its contract with us.
- Scaleway SAS: certified to ISO/IEC 27001:2022 and HDS; badge access control, access rights by authorisation profile, access logging, supervised visitors, video surveillance at entrances and exits, fire protection.

2. Network and transport

All traffic to platform.uprelic.com and api.uprelic.com is encrypted with TLS. TLS ends at a load balancer operated by Scaleway in its data centres in France; from there traffic reaches our servers over a private network.
Web traffic reaches the servers only through the load balancer. Apart from administrative access (below), no services on the servers are reachable from the internet.
Requests are rate-limited by IP address.
The model server has no route to the internet and cannot send data out.
Images referenced by URL are downloaded only from public addresses, without following redirects, with limits of 10 MB and 10 seconds per image.
Administrative access is possible only over SSH with individual keys; password sign-in is disabled. The database and the administration interface listen only on each server's local interface.

3. Access control

Access to the API requires a per-account API key (upr_ followed by 43 characters, encoding 32 random bytes), which you create in the console and which is shown only once. After creation the console shows only the key's name and its first 12 characters. We store API keys only as a SHA-256 hash; the full key cannot be recovered from our systems.
Sign-in to the console uses an email magic link or, where enabled, Google sign-in.
Every request and Request Record is assigned to the account whose API key was used.
Per-account limits: 500 requests per minute, 8 concurrent requests, 256 questions, 256 options per question and 8 images per request.
Administration tools that show Request Records, including the database administration interface, are reachable only through an SSH connection to the server with an individual key, are limited to named administrators on a need-to-know basis (§ 7.3), and SSH sign-ins are logged.

4. Storage and encryption

Images sent as base64 data URLs are redacted in the stored copy (type and length only).
Encryption of data at rest: backups are encrypted; the disks of the GPU servers are not encrypted at rest.
Backups are encrypted on our servers before they are uploaded (restic) and stored in Scaleway Object Storage in Amsterdam, Netherlands (EU); Scaleway holds no key.

5. Availability and resilience

Daily encrypted backups of the whole database, with 14 daily, 8 weekly and 12 monthly backups kept.
The Service runs with one GPU cloud provider (Scaleway). During the beta there is no availability commitment (SLA).

6. Deletion

Automatic deletion of Request Record content 90 days after the request, by a daily job.
Earlier deletion on your instruction within 30 days (§ 12.1).
Backups rotate out, so that deleted data is gone from them within at most 12 months; deletions are re-applied after any restore.

7. Logging

Server logs (web server and application) contain IP addresses and request metadata and are used for operation and security. Retention: 90 days.
Server and container logs are rotated and deleted automatically after 90 days. Request content is not written to logs.

8. Organisation

Confidentiality undertakings for all persons with access (§ 6).
No use of Customer Content for training, fine-tuning or evaluation, and no sale or sharing with third parties (§ 3).
Subprocessors only under an Art. 28 (4) GDPR contract, with advance notice of changes (§ 8).
We maintain a written procedure for handling security incidents and personal data breaches, including notification of customers under § 11 and of the supervisory authority under Art. 33 GDPR.

9. Certification

Uprelic does not currently hold an ISO/IEC 27001 certification, a SOC 2 report or a comparable third-party attestation (§ 13.3).