01Parties, roles & scope
This Data Processing Addendum ("DPA") forms part of the Terms & Conditions (or a separately executed agreement) between JettySoft LTD, the company that provides AirLLM ("AirLLM", "Processor") and the customer accepting it ("Customer", "Controller") (together, the "Agreement"). It applies whenever AirLLM processes personal data contained in Customer Content on Customer's behalf through the Services (as defined in the Terms, including Air Router, AirGPU, AirCode CLI, AirCode Studio, and Alina), and is designed to help Customer meet its obligations under the GDPR, UK GDPR, Swiss FADP, CCPA/CPRA, and similar laws.
- For Customer Content, Customer is the controller (or a processor acting for its own controller) and AirLLM is the processor (or subprocessor).
- For account, billing, and telemetry data, Alina support chats, and safety records, AirLLM is an independent controller as described in the Privacy Policy.
- Under US state privacy laws, AirLLM acts as Customer's "service provider" and will not sell or share personal data, retain it outside the Agreement, or combine it with data from other sources except as permitted for service providers.
02Definitions
"Data Protection Laws" means all laws applicable to the processing of personal data under this DPA, including the GDPR, UK GDPR, Swiss FADP, and applicable US state privacy laws. "Personal data", "processing", "controller", "processor", and "personal data breach" have the meanings given in the GDPR. "Customer Content" has the meaning given in the Terms. "Subprocessor" means a third party engaged by AirLLM to process personal data in Customer Content.
03Details of processing
| Item | Description |
|---|---|
| Subject matter | Provision of the Services, including the AirLLM platform, Air Router, AirGPU, AirCode (AirCode CLI and AirCode Studio), and Alina |
| Duration | The term of the Agreement, until Customer's account and its data are deleted 1 year after the account is closed, or sooner where Customer instructs earlier deletion (Section 4); deleted data may remain in backups for a limited time until they're overwritten in the normal cycle, and engineering tickets are kept only as long as needed to diagnose and fix the problem |
| Nature & purpose | Receiving, routing, short-lived caching, transmitting to model providers, and returning Customer Content to provide the Services; keeping the content of failed requests, with secrets removed, to diagnose failures, including in engineering tickets; keeping samples of responses to check routing quality; relaying AirCode session transcripts live to the Control Plane; and storing AirCode session instructions and control records |
| Storage of content | AirLLM doesn't store prompts to train models. Request content passes through short-lived, account-scoped caches that expire automatically, generally within 24 hours of last use. When a request fails, AirLLM may keep its content, with secrets removed, to diagnose the failure, and it may keep samples of responses to check routing quality; these records are deleted with Customer's account data. The content of a failing request, with secrets removed, may also be attached to a ticket in AirLLM's engineering issue tracker, where it is kept only as long as needed to diagnose and fix the problem, with access limited to AirLLM's engineering staff. AirCode session transcripts are held for at most about a minute to deliver them and are not stored. Instructions administrators type into AirCode sessions, and session control records (pause, resume, end), are stored with the session's records. Safety records, which may include the text that triggered a safety guardrail or Acceptable Use review, are kept for up to 2 years (see Section 4) |
| Categories of data | Any personal data Customer chooses to include in prompts, files, code, completions, and AirCode session instructions; typically identifiers, professional data, and communications content |
| Special categories | Not required by the Services; processed only if Customer includes them, under Customer's responsibility for a lawful basis |
| Data subjects | Customer's personnel, end users, and any individuals referenced in Customer Content |
| Frequency | Continuous, as driven by Customer's API and product usage |
04AirLLM's obligations as processor
AirLLM will:
- Follow instructions. Process Customer personal data only on Customer's documented instructions — the Agreement, this DPA, and Customer's configuration of the Services — unless required otherwise by law, in which case we will inform Customer unless legally prohibited. We will notify Customer if, in our opinion, an instruction infringes Data Protection Laws.
- Ensure confidentiality. Restrict access to personnel who need it and are bound by confidentiality obligations.
- Secure the data. Implement the technical and organizational measures in Section 8, designed to provide a level of security appropriate to the risk under GDPR Article 32. No set of measures can guarantee security.
- Assist Customer. Provide reasonable assistance with data-subject requests (Articles 12–23), security, breach notification, data-protection impact assessments, and prior consultation (Articles 32–36), taking into account the nature of processing and the information available to AirLLM.
- Never train on the data. Never use Customer Content, including Customer personal data, to train, fine-tune, or improve any AI model, and never sell it. On paid plans, AirLLM avoids model providers that use prompts to train models; on the Free plan, model providers may use prompts to train models and may retain them (Section 5).
- Minimize storage. Keep Customer Content only where the Services need it. Request content — the prompts and responses of requests sent through Air Router or the AirLLM API, including the model calls AirCode makes — passes through short-lived, account-scoped caches that expire automatically, generally within 24 hours of last use. The content of a failed request, with secrets removed, may be kept to diagnose the failure, and samples of responses may be kept to check routing quality; these records are deleted with Customer's account data. The content of a failing request, with secrets removed, may also be attached to a ticket in AirLLM's engineering issue tracker, kept only as long as needed to diagnose and fix the problem, with access limited to AirLLM's engineering staff. AirCode session transcripts are relayed live, held for at most about a minute to deliver them, and not stored. Instructions administrators type into AirCode sessions and session control records are kept with the session's records, and safety records, which may include the text that triggered a safety guardrail or Acceptable Use review, are kept for up to 2 years for enforcement and legal defense.
- Delete or return. Customer can export the data it needs before its account is closed. One year after the account is closed, AirLLM deletes the account and Customer personal data, except billing records (kept 7 years from the invoice date), Terms-acceptance records (kept 7 years from acceptance), auto-renewal and auto-recharge consent records (kept 3 years from when consent was given), and engineering tickets (kept only as long as needed to diagnose and fix the problem), support communications such as contact-form messages (kept only as long as needed to handle the request and for legal defense), or where retention is required by law (see the Data Retention Policy). Deleted data may remain in backups for a limited time until they're overwritten in the normal cycle. Customer may instruct AirLLM to delete Customer personal data sooner by writing to our Legal Cell at legal@airllm.ai.
- Demonstrate compliance. Maintain records of processing as required by Data Protection Laws, and make available information reasonably necessary to demonstrate compliance with this DPA — such as security documentation and responses to reasonable security questionnaires. Where that information is not sufficient, Customer may audit on reasonable terms: no more than once a year (or after a personal data breach, or when a supervisory authority requires it), on at least 30 days' notice requested from our Legal Cell at legal@airllm.ai, during business hours, under confidentiality, without access to other customers' data, and at Customer's cost.
05Subprocessors
Customer provides general authorization for the subprocessors below, which are listed by name or by category. We will post changes to this list and, for customers who have asked our Legal Cell at legal@airllm.ai to be notified, give at least 30 days' notice before adding a subprocessor that will process Customer personal data. Customer may object on reasonable data-protection grounds within that window; if we cannot resolve the objection, Customer may terminate the affected Services with a pro-rata refund of prepaid, unused fees. We engage each subprocessor under written terms that include the data-protection obligations required by Data Protection Laws, and remain responsible for their performance to the extent Data Protection Laws require, subject to Section 9.
Model providers as independent controllers. The upstream model providers in the table below (for example Anthropic, OpenAI, and Google, whether reached directly or via an aggregation provider such as OpenRouter) act in a dual capacity. When generating a completion for Customer they act as AirLLM's subprocessor, and AirLLM remains responsible for that processing to the extent set out above. Separately, to the extent a provider stores, retains, logs, or uses Customer Content for its own independent purposes — such as abuse and security monitoring, retention required by its own policies or applicable law, or any model training it carries out under its own terms — that provider acts as an independent controller under its own terms and privacy policy. AirLLM does not control, and to the maximum extent permitted by law is not responsible or liable for, a provider's processing, retention, availability, outputs, or security in that independent-controller capacity. The same applies to third-party GPU capacity used when AirGPU falls back to it. Model providers may retain prompts under their own policies, for example to monitor for abuse. On paid plans, AirLLM avoids model providers that use prompts to train models; on the Free plan, model providers may use prompts to train models and may retain them.
| Subprocessor | Purpose | Data touched | Location |
|---|---|---|---|
| Microsoft (Azure) | Cloud hosting of the AirLLM API servers, databases, and short-lived account-scoped caches | All service data | United States |
| Cloudflare | Content delivery, DNS, and network security for our websites and API; bot protection (Turnstile) on sign-in, sign-up, and the contact form; secure connections to AirGPU capacity | Website and API traffic in transit, including request / response content; IP addresses and browser and device signals for bot checks | Global network; United States |
| OpenRouter | Model access and dispatch to upstream model providers | Request / response content in transit | United States |
| Anthropic | Model inference (Claude family) | Request / response content under its own terms | United States |
| OpenAI | Model inference (GPT / Codex families) | Request / response content under its own terms | United States |
| Model inference (Gemini family) | Request / response content under its own terms | United States | |
| Other model and GPU capacity providers | Model inference reached through OpenRouter, and third-party GPU capacity when AirGPU falls back to it | Request / response content under their own terms | Varies by provider; current names on request from our Legal Cell |
| Stripe | Payment processing and invoicing | Billing contact and payment data | United States |
| Amazon Web Services (Amazon SES) | Sending service, security, and billing emails, such as receipts, payment notices, and renewal reminders | Name, email address, email content | United States |
| Google (Firebase) | Sign-in with Google (Firebase Authentication), and website analytics only if a visitor accepts them (Google Analytics) | Name, email address, and sign-in identifiers; for analytics, pages viewed, approximate location, and device and browser details | United States |
| Just Host | Hosting of our website, and of the mailboxes for our airllm.ai email addresses | Website visitors' technical data, such as IP address and browser; email sent to our airllm.ai addresses | United States |
| Microsoft (Azure DevOps) | Engineering issue tracking, and filing contact-form messages | Content of failed requests, with secrets removed, attached to engineering tickets; problem reports sent from AirCode; contact-form messages | Microsoft data centers; region on request from our Legal Cell |
Where Customer uses a tenant-scoped provider key, dispatch to model providers runs under Customer's own provider agreement, and Customer's data-handling elections with that provider govern that leg of the processing.
06International transfers
Where processing involves a transfer of personal data from the EEA, UK, or Switzerland to a country without an adequacy decision, the parties incorporate the EU Standard Contractual Clauses (Module 2: controller→processor, and Module 3: processor→processor, as applicable), with the UK International Data Transfer Addendum and Swiss adaptations where relevant. The details of processing in Section 3 populate the SCC annexes, and the security measures in Section 8 populate Annex II. In case of conflict between the SCCs and this DPA, the SCCs prevail.
07Personal data breach
AirLLM will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data, as required by Data Protection Laws, and will provide the information reasonably available to help Customer meet its own notification obligations: the nature of the breach, categories and approximate volumes affected, likely consequences, and measures taken or proposed. Where not all of that information is available at once, we will provide it in phases. We will take reasonable steps to contain the breach and cooperate with Customer's reasonable investigation and remediation. Our notice is not an admission of fault or liability; liability is governed by Section 9. Customer can report a suspected personal data breach, or ask about a notice, through our Legal Cell at legal@airllm.ai.
08Annex: technical & organizational measures
AirLLM maintains the measures below and may update them over time, provided the overall level of protection is not materially reduced. They are designed to reduce risk; no measure can guarantee security.
| Control area | Measures |
|---|---|
| Encryption | Industry-standard encryption in transit; stored data may be encrypted at rest where our hosting providers support it |
| Tenant isolation | Logical separation per organization; tenant-scoped upstream keys so traffic and billing do not cross tenants; cache entries scoped per account |
| Access control | Administrative access to the AirLLM control plane requires a named operator account with multi-factor authentication; access follows least privilege; administrative actions are logged with the operator's name |
| Data minimization | Request content kept only where needed: short-lived account-scoped caches that expire automatically (generally within 24 hours of last use); the content of failed requests, with secrets removed, for diagnosis; samples of responses for routing-quality checks; AirCode session transcripts relayed live and not stored; retained usage metadata contains no content |
| Application security | Secure development practices, code review, dependency and secret scanning, and periodic security testing |
| Resilience | Service monitoring with alerts to operators; data may be backed up, and we aim to be able to restore service and data after an incident |
| Personnel | Confidentiality obligations, background checks where lawful and appropriate, and security training |
| Incident response | Service monitoring with alerts to operators; we aim to respond to security incidents promptly and may review them afterwards; customer notification per Section 7 |
09Liability & order of precedence
Each party's liability arising out of or relating to this DPA is subject to the exclusions and limitations of liability in the Agreement — for customers on our standard terms, the limitation of liability in the Terms & Conditions — except where Data Protection Laws do not permit such limits (including any liability to data subjects under the SCCs that cannot be limited). Disputes are resolved as set out in the Agreement. If there is a conflict, the order of precedence is: (1) the SCCs, (2) this DPA, (3) the Agreement. This DPA terminates automatically when AirLLM no longer processes Customer personal data.
10How to execute this DPA
This DPA is automatically incorporated into the Agreement for all customers whose use involves personal data subject to Data Protection Laws — no signature required. If your procurement or legal team needs a countersigned copy, or you require the SCC annexes populated for your records, request it from our Legal Cell at legal@airllm.ai and we will return an executed copy.