Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between DocInfra (the “Processor”, “we”) and the customer that uses the Service on its own behalf (the “Customer”, “you”). It applies whenever the content you submit through the API or the dashboard contains personal data of which you are the controller. It is written so that a business customer can rely on it without negotiating a separate contract; where a customer needs additional clauses (for example a specific international transfer mechanism), we can sign them as part of an Enterprise agreement.

1. Subject matter, duration, nature and purpose

Subject matter. Processing of personal data contained in the texts and documents the Customer submits for rewriting or conversion, and in the account and usage data of the Customer’s users.

Duration. The term of the Customer’s use of the Service, plus the retention periods in section 8.

Nature. Receipt, temporary storage, transformation by software (including a language model run on Cloudflare Workers AI), return of the result, deletion.

Purpose. To provide the Service as instructed by the Customer through the API and the dashboard. We do not process the content for any other purpose, and we do not use it to train models.

2. Categories of data and data subjects

The Customer decides what it submits. Typically: names, contact details, identifiers, professional or academic information, and any other personal data present in business documents and texts. Data subjects are the people the Customer’s content refers to (employees, customers, users, authors, third parties) and the Customer’s own users of the dashboard. The Customer must not submit special categories of data (health, biometric, political, religious or similar) or data of minors unless it has a lawful basis to do so and has considered the risk.

3. Roles

For the content it submits, the Customer is the controller (“Responsable”) and DocInfra is the processor (“Encargado”). For the account, billing, security and analytics data described in the Privacy Policy, DocInfra is the controller. The Customer warrants that it has the authorizations or legal basis needed to submit the content, including for its transfer to DocInfra and to the subprocessors in section 6.

4. Instructions

We process the content only on the Customer’s documented instructions, which are the API calls and dashboard actions the Customer performs, the options it selects (mode, intensity, protected terms) and this DPA. If we believe an instruction breaches the law, we tell the Customer. We do not access content for any purpose other than providing the Service, handling a support request the Customer opened, or investigating a security incident.

5. Confidentiality and security

Everyone who operates the Service is bound by confidentiality. We apply the measures described on the security page at apidocinfra.com/security/, among them: encryption in transit, engines with no internet access, malware scanning of uploaded files, hashed API keys, secrets outside the code, restricted and logged production access, an append-only audit trail, deletion of documents 24 hours after the operation, no storage of rewritten text, and application logs without content. We keep the measures up to date and do not lower them for the Customer during the term.

6. Subprocessors

The Customer authorizes the subprocessors listed at apidocinfra.com/subprocessors/, with their function and location. We impose on each subprocessor data protection obligations consistent with this DPA through its published terms or a signed agreement. Before adding a subprocessor that would process the Customer’s content, we update the list at least 15 days in advance and announce it on that page; the Customer may object on reasonable data protection grounds, in which case we look for an alternative or the Customer may terminate the affected part of the Service without penalty.

7. Assistance

We help the Customer meet its obligations towards data subjects and authorities, taking into account the nature of the processing: we answer requests about how the Service works, we provide the export of the Customer’s account and usage data, and, when the Customer receives a request from a data subject about content processed through the Service, we assist within a reasonable time. Because content is not stored after the retention periods, most requests are satisfied by the deletion that already happens automatically.

8. Deletion and return

Rewritten text is not stored. Documents are deleted 24 hours after the operation and, at the latest, 2 days later by the storage lifecycle rule. The Customer can delete a document earlier from the API or the dashboard. At the end of the agreement we delete or anonymize the Customer’s account and workspace data within 30 days, except the records we must keep by law (billing evidence, acceptance records), which stay isolated and are not used for any other purpose.

9. Incidents

If we become aware of a security incident that affects the Customer’s personal data, we notify the Customer without undue delay after confirming it, with the information we have (nature, categories and approximate number of records and people, likely consequences, measures taken) and update it as the investigation progresses. Our internal procedure covers identification, containment, evidence, scope, risk assessment, notification decision, communications, closure and postmortem.

10. Audit and information

On request, no more than once a year unless an incident justifies it, we provide the information reasonably needed to demonstrate compliance with this DPA: the security documentation, the subprocessor list, the retention schedule and answers to a written questionnaire. If that is not enough for a legal obligation of the Customer, we agree on a review by an independent auditor under confidentiality, at the Customer’s cost and without disrupting the Service.

11. International processing

The Service runs on providers located in the United States and other countries (see the subprocessor list), so content may be processed outside Colombia and outside the Customer’s country. We rely on the data processing terms and transfer mechanisms published by those providers (for example Cloudflare’s Data Processing Addendum, which includes standard contractual clauses for transfers from the European Economic Area). We do not draft our own standard clauses. Where a transfer requires a specific contractual mechanism between the Customer and DocInfra, we sign the applicable module of the official clauses as part of an Enterprise agreement.

12. Liability and precedence

Liability under this DPA is subject to the limitations of the Terms of Service, without limiting the rights of data subjects. If this DPA and the Terms conflict on a data protection matter, this DPA prevails.

13. How to accept this DPA

This DPA applies automatically to every business customer that uses the Service on its own behalf and accepts the Terms of Service; no signature is needed. A customer that needs a countersigned copy or additional clauses can request it at [email protected].