Data Processing Agreement.
Last updated 12 November 2026.
This agreement applies when you use ACPpotamia to process personal data on behalf of yourself or your own customers. It forms part of the Terms of Service between you (the "customer") and Examopotamia ("we"), and it applies automatically: you do not need to sign anything. If you need a countersigned copy, write to us.
1. Roles
For personal data in the calls you send through ACPpotamia, and in the records we keep about those calls, you are the controller (or a processor acting for your own customers) and we are your processor. We process that data only on your documented instructions, which are these terms and the settings you choose in the console and the API. For your own account, sign-in and billing details we are a controller; the Privacy Policy covers those.
2. What is processed
| Purpose | Checking your limits and policies, forwarding calls to the model provider you chose, metering their cost, and keeping the audit log you can search and export. |
|---|---|
| Duration | For as long as you have an account, and until the retention periods below end. |
| Data in transit | The full content of each request and response passes through ACPpotamia to and from your model provider. It is not stored unless you turn on payload logging. |
| Data stored for every call | Time, agent, session and tenant names you send, model, token counts, cost, outcome, timing and a one-way hash of the request. Kept 365 days. |
| Data stored only if you turn it on | The first 64 KB of each request and response (payload logging, Pro and Enterprise). Kept 30 days. |
| People concerned | Whoever your agents handle data about: typically your own users, customers and staff. |
| Kinds of data | Whatever you send. Do not send special-category data (such as health data) or payment card numbers unless you have a lawful basis and have turned payload logging off. |
3. Our obligations
- We process the data only to provide the service and as you instruct, and we tell you if we believe an instruction breaks data-protection law.
- Everyone with access to production data is bound by confidentiality, and access is limited to the people who run the service.
- We do not sell the data, use it for advertising, or use it to train AI models.
- We help you answer requests from individuals (access, correction, deletion) and with impact assessments, as far as the data we hold allows. Audit exports and deletion are available from the console and the API.
4. Security
- All traffic is encrypted with HTTPS (TLS). Data at rest is encrypted by Cloudflare.
- Your model provider API keys are forwarded with each call and never stored or logged.
- ACPpotamia API keys and session tokens are stored only as SHA-256 hashes; passwords as salted PBKDF2 hashes.
- Each team's limits and records are kept apart from every other team's, and every change made by our operators is logged.
- Request and response text is off by default and, when on, is deleted after 30 days.
5. Sub-processors
You authorise us to use the sub-processors below. We will post changes on this page and email account owners at least 14 days before adding a new one; you may object by writing to us, and if we cannot resolve it you may end your plan.
| Sub-processor | What it does | Data |
|---|---|---|
| Cloudflare, Inc. | Runs the gateway and stores its data (Workers, Durable Objects, D1, R2, KV) | Everything in section 2 |
| Zoho Corporation | Delivers our emails (verification, password reset, receipts, alerts) | Email address, name |
Model providers are not our sub-processors. OpenAI, Anthropic, and any other provider or model server you connect (for example DeepSeek, Mistral, Groq or one you host yourself) receive your calls because you instruct us to forward them, using your own account and key with that provider. Your agreement with each provider governs what it does with the data and where. PayPal and Wayl process payments as independent controllers and receive no call data.
6. Where data is processed
Calls are handled at the Cloudflare location nearest your agent. Account data and the audit index are stored in Cloudflare D1 in Europe; log files in Cloudflare R2. Where personal data from the EEA, the UK or Switzerland is transferred to a country without an adequacy decision, the EU Standard Contractual Clauses (and the UK Addendum, where it applies) are incorporated into this agreement, with you as exporter and us as importer; we rely on the same clauses with our sub-processors.
7. Personal data breaches
If we become aware of a breach of security that leads to the loss, alteration or unauthorised disclosure of your personal data, we will tell the account owner by email without undue delay and within 72 hours, with what we know about its nature, the data and people affected, and what we are doing about it.
8. Deletion and return
You can export your audit records at any time from the console or the API. Records are deleted automatically at the end of the retention periods in section 2. When you close your account we delete account data within 30 days, apart from records the law requires us to keep.
9. Audits
On written request, and not more than once a year, we will answer a reasonable security questionnaire and provide the information needed to show we meet this agreement. If that is not enough to meet a legal requirement you are under, we will agree the scope of an audit with you, at your cost and with reasonable notice.
10. Order of terms
If this agreement and the Terms of Service conflict about personal data, this agreement applies. The liability limits in the Terms apply to this agreement.
Contact
Examopotamia ยท acp@examopotamia.com