Data Processing Addendum
This Addendum applies where you use CumuloNimbus as a business customer and, in doing so, you are a data controller and we act as a data processorof personal data on your behalf. It forms part of, and is governed by, theTerms of Service. For consumers using the service for personal use, the Privacy Policy governs and this Addendum does not apply.
1. Roles and scope
You are the controller and we are the processor for the personal data contained in the inputs you send through the service and the account data you provide. We process it only to provide the service, on your documented instructions (which these terms and your use of the product constitute), and as required by law. If the law requires us to process otherwise, we tell you first unless the law forbids it.
2. Subject matter, duration, nature, purpose
Subject matter: providing the cloud companion service and the LLM router. Duration: for as long as you use the service, plus the retention periods in thePrivacy Policy. Nature and purpose: hosting, routing your requests to the model provider you address, metering, automated safety moderation, and support. Types of data: account identifiers (email), usage metadata, and the content of the requests you choose to send. Data subjects: you and the people whose data you include in your inputs.
3. Confidentiality and security
We keep the personal data confidential and require our personnel to do the same. We maintain technical and organizational measures appropriate to the risk; our current security posture is summarized in our public security documentation, and we review it as the service evolves.
4. Subprocessors
You authorize us to engage the subprocessors listed in thePrivacy Policy (hosting, edge, payments, authentication, moderation, and the model providers your traffic is forwarded to at your direction). We impose data-protection terms on them consistent with this Addendum, and we remain responsible for their performance. We give notice of a new or replacement subprocessor by updating that list, and you may object on reasonable data-protection grounds.
5. International transfers
Where personal data is transferred across borders (for example to a US-based model provider you address), the transfer relies on an appropriate transfer mechanism where one is required. When you send an input to a given provider, you instruct that transfer.
6. Assistance
Taking into account the nature of the processing, we assist you, so far as reasonably possible, in responding to data-subject requests (access, deletion, and the like; our self-serve export and delete cover most cases), and in meeting your security, breach-notification, and impact-assessment obligations. We notify you without undue delay after becoming aware of a personal-data breach affecting your data.
7. Deletion and return
On the end of the service, or on your request, we delete or return the personal data we process on your behalf, except where the law requires us to keep it (for example billing records, or moderation records under a legal-preservation obligation).
8. Audit
We make available the information reasonably necessary to demonstrate compliance with this Addendum, and contribute to audits on reasonable notice, in a manner that does not compromise the security or confidentiality of other customers.