Data processing agreement

This agreement is between you (the controller) and José Cabrero-Holgueras, trading as Perdurance (the processor). It applies whenever we process personal data on your behalf, and it forms part of the terms of service.

You do not need to ask us for a signed copy. These terms are offered openly and bind us on acceptance of the terms of service. If your procurement process requires a countersigned document, write to hello@perdurance.dev and we will sign this text as it stands.

Where this agreement conflicts with the terms of service on a question of personal data, this agreement prevails. Terms used here that are defined in the GDPR — controller, processor, personal data, processing, personal data breach, data subject — carry the meaning the GDPR gives them.

1. Which of us is which

For everything you send through the service — request bodies, responses, stored chunks, and the provider credentials you configure — you are the controller and we are your processor. You decide what is in that content and why it is sent. We hold it, execute against it, and give it back.

For the data that exists because you hold an account with us — your users’ email addresses, credentials, billing records, our server logs — we are the controller, and the privacy policy rather than this agreement is the notice for it.

2. We act only on your instructions

We process personal data only on your documented instructions, including on transfers, unless EU or Spanish law requires otherwise — in which case we will tell you before processing, unless that law forbids us to.

Your instructions are: the terms of service, this agreement, and what you do through the service’s own interfaces. Submitting a request instructs us to execute and store it. Configuring a backend instructs us to hold that credential and use it. Deleting a request instructs us to delete it.

We will tell you if, in our opinion, an instruction infringes the GDPR or the LOPDGDD. We are not obliged to police your lawful basis, and we do not.

3. Confidentiality

Anyone authorised to process personal data on our behalf is bound to confidentiality and has committed to it in writing. Access is granted only to those who require it to operate the service, and is withdrawn when that requirement ends.

4. Security

We implement appropriate technical and organisational measures under article 32, described in Annex II. Those measures may change as the state of the art does; they will not drop below the level they describe.

5. Subprocessors

You give us general written authorisation to engage the subprocessors listed in Annex III. We impose data protection obligations on each of them no less protective than those in this agreement, and we remain fully liable to you for their performance.

Before adding or replacing a subprocessor we will give you at least 30 days’ notice by email. If you reasonably object on data protection grounds within that period, tell us and we will work to offer you a change that avoids it; if we cannot, you may terminate the affected part of the service without penalty and be refunded any unused prepaid balance.

Model providers are not our subprocessors. The service calls an upstream provider using your credential under your contract with that provider. That provider is therefore your processor, engaged by you directly. Choosing which provider to route to, and on what terms it handles your content, is your decision and not ours.

6. Helping you answer data subjects

Taking account of the nature of the processing, we assist you by appropriate technical and organisational measures in fulfilling your obligation to answer data subject requests. In practice, the service lets you retrieve, export and delete any stored request by its identifier, and delete a workspace or a tenancy wholesale — so you can satisfy access, portability and erasure requests without us.

Where a data subject approaches us directly about content you control, we will not answer it ourselves. We will tell them to approach you, and tell you promptly.

7. Helping you with articles 32 to 36

We assist you in ensuring compliance with the obligations in articles 32 to 36, taking into account the nature of the processing and the information available to us. That includes providing what you reasonably need for a data protection impact assessment or a prior consultation with a supervisory authority.

8. Breach notification

We notify you without undue delay after becoming aware of a personal data breach affecting personal data we process on your behalf, and in any event within 48 hours. The notice will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed.

Making the regulatory notification under article 33, and any notification to data subjects under article 34, is yours to make as controller. We will give you what you need to make it.

9. Deletion and return

At your choice, we delete or return all personal data we process on your behalf after the end of the service, and delete existing copies, unless EU or Spanish law requires us to keep it.

In practice: closing an account deletes its content within 30 days. Ask for an export before you close it — once deleted we cannot produce one, because we no longer have it. Backups age out on their own cycle and are never restored selectively to recover deleted content.

10. Information and audits

We make available to you the information necessary to demonstrate compliance with article 28 and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate.

Audits are on reasonable notice of at least 30 days, no more than once in twelve months unless a breach or a regulator’s requirement makes another necessary, during business hours, without unreasonable disruption, and subject to confidentiality. You bear your own costs; we bear ours.

11. International transfers

Personal data processed on your behalf is held in the European Economic Area. Where a transfer outside it is necessary, we make it under an adequacy decision where one covers the destination, and otherwise under the European Commission’s standard contractual clauses, which are incorporated into this agreement by reference and take effect on such a transfer. We assess whether local law permits those clauses to be honoured before relying on them.

12. Liability

The limitations and exclusions of liability in the terms of service apply to this agreement, save that nothing here limits a data subject’s rights under article 82 GDPR or either party’s liability to a supervisory authority.

Annex I — The processing

Subject matter

Accepting, executing, storing and returning large language model requests submitted through the Perdurance service.

Duration

For as long as you hold an account, plus the deletion window in section 9.

Nature and purpose

Storage, transmission to a model provider you nominate, retrieval, replay and deletion, for the purpose of providing the service you contracted for.

Types of personal data

Whatever your request bodies and their responses contain — determined entirely by you, and unknown to us. Plus the account identifiers of the users who submit them.

Categories of data subject

Determined by you. Typically your own users and staff, and any person whose data appears in a prompt you submit.

Special categories

The service is not designed for special category data under article 9. It does not prevent you sending it, and if you do, you are responsible for the additional conditions article 9 requires.

Annex II — Security measures

• Passwords are hashed with Argon2id and never stored recoverably.
• API keys and session keys are stored as a public prefix and a keyed BLAKE3 hash, compared in constant time. The secret half exists only in the reply that issued it.
• Provider credentials are encrypted at rest, held as ciphertext and nonce, with a single component holding the only path back to plaintext.
• Transport is TLS.
• Isolation. Tenancies are separated from one another, and access within a tenancy is decided per workspace by role rather than by credential.
• Sessions expire 24 hours after they are opened, and using one does not extend it. A password set by anyone but its holder must be replaced before the account reaches anything.
• Deployment. One container image and one Postgres, with self-applying migrations — a deliberately small surface to patch, monitor and reason about.
• Dedicated deployment is available: the enterprise offering runs on infrastructure dedicated to you, in our cloud or in your own cloud account, and no content of yours passes through the shared service. We operate it either way.

Annex III — Subprocessors

Three of these serve the hosted service only, and a dedicated or isolated deployment reaches none of them: it is configured with no identity provider, no mailer and no sign-up challenge, so people sign in against a credential it holds itself and a tenancy is created by whoever operates it. That is a property of what is deployed rather than a setting to be maintained.

This list is the notice required by section 5. A dedicated deployment engages only the subprocessors its own contract names, which on a deployment in your own cloud account may be none of these.