Data processing agreement
This agreement applies when your task inputs contain personal data that you control, and Tovano processes it for you. It forms part of the terms of service. No signature is needed; it applies from the day you accept the terms. If you need a signed copy, write to legal@tovano.ai.
1. Roles
You are the controller. Tovano, a company registered in Hong Kong, is the processor. We process personal data only on your documented instructions, which are the API requests you send.
2. Scope
| Item | Detail |
|---|---|
| Subject matter | Running AI models on inputs you send |
| Duration | While you use the Service, plus 30 days |
| Data subjects | Whoever appears in your inputs, such as your end users |
| Data types | Text, images, audio and video you send, and the outputs |
| Special categories | Not intended. Don't send them unless agreed in writing |
3. Our duties
- Keep the data confidential and bind every person with access to confidentiality.
- Apply the technical and organisational measures in security.
- Use only the subprocessors listed, and tell you 30 days before adding one. You can object.
- Help you answer requests from data subjects and authorities.
- Tell you without undue delay, and within 48 hours, after we learn of a personal data breach.
- Delete task data 30 days after the task, or earlier on request.
- Allow audits once a year with 30 days' notice, or provide a recent third-party report instead.
4. Transfers
Tovano is based in Hong Kong and hosts the Service in Germany (EU). Transfers of EU personal data outside the EU, including to Tovano in Hong Kong and to model providers, rely on the EU Standard Contractual Clauses. The subprocessor list shows where each one processes data.