Data Processing Addendum
Last updated: October 18, 2026
This Data Processing Addendum ("DPA") is part of the Terms of Use between TryAii, Inc.("TryAii", processor) and the Customer (controller). It applies when TryAii processes personal data on the Customer's behalf, and it meets Article 28 of the GDPR and the UK GDPR. It applies automatically with the Terms; to receive a countersigned copy, write to [email protected].
1. Details of the processing
| Item | Description |
|---|---|
| Subject matter and nature | Hosting, analysing and displaying the usage records the tryaii SDK sends about the Customer’s applications, and the Customer’s content on tryaii.com, to provide the Services |
| Duration | The term of the Terms of Use, plus the deletion periods in section 7 |
| Data subjects | The Customer’s Authorized Users; people whose data the Customer submits |
| Categories of data | Account identifiers, names and email addresses of Authorized Users; usage records (application and process names, file paths, function names, model names, token counts, costs, timings, a keyed prompt hash, a task profile); content submitted on tryaii.com |
| Special categories | None intended. The Customer does not submit them in usage records. |
2. TryAii's obligations
- Process personal data only on the Customer's documented instructions, which are the Terms, this DPA and the Customer's use of the Services; tell the Customer if an instruction seems to break the law.
- Make sure the people who process it are bound by confidentiality.
- Apply the security measures in our security overview (Article 32), and keep them at least at that level.
- Help the Customer answer data subject requests and meet its obligations under Articles 32 to 36, taking into account the information TryAii has.
- Make available the information needed to show compliance with this DPA, and allow an audit by the Customer or an auditor it appoints, once a year, on 30 days' notice, at the Customer's cost, under confidentiality.
3. Subprocessors
The Customer authorizes the subprocessors on our subprocessors page. TryAii gives at least 30 days' notice of a new subprocessor there and by email; the Customer may object on reasonable data protection grounds, and if we cannot address the objection, the Customer may end the affected Service and receive a refund of prepaid unused fees for it. TryAii binds each subprocessor by contract to obligations at least as protective as this DPA and remains responsible for them.
4. International transfers
Personal data is stored in the European Union. Where it is transferred to a country without an adequacy decision, the European Commission's Standard Contractual Clauses (Decision 2021/914; Module 2 between the Customer and TryAii, Module 3 between TryAii and a subprocessor) and, for the UK, the International Data Transfer Addendum, apply and are incorporated by reference. Data a user chooses to send on tryaii.com to a model of a provider outside the EU goes to that provider as described in the Privacy Policy.
5. Personal data breaches
TryAii notifies the Customer without undue delay and within 72 hours of becoming aware of a personal data breach affecting Customer personal data, with what is known about its nature, likely consequences and the measures taken, and updates the Customer as more becomes known.
6. Anonymous statistics
TryAii may create anonymous statistics from Customer data, in a separate table with no field that identifies a user, application, process, file, function or prompt, where every row combines at least 3 applications, and use them to improve the Services. Such statistics are not personal data and not Customer data.
7. Deletion and return
Usage records are deleted 90 days after they are received. A deleted application is purged 30 days after deletion. When the Terms end, the Customer may request an export within 30 days; TryAii then deletes Customer personal data within a further 30 days, and backups expire within their retention period, unless the law requires TryAii to keep it.
8. Liability and precedence
The limitations of liability in the Terms apply to this DPA. If this DPA conflicts with the Terms about personal data, this DPA wins; if the Standard Contractual Clauses apply and conflict with this DPA, they win.