Our data processing terms.

"Personal Data", "Controller", "Processor", "Data Subject", and "Processing" have the meanings given in applicable data protection law.

"Subprocessor" means any third party engaged by ValiqAI to process Personal Data on the Customer's behalf.

"Data Protection Law" means all privacy and data protection laws applicable to the Processing, including the GDPR, UK GDPR, and the CCPA/CPRA.

For Personal Data processed under this DPA, the Customer is the Controller and ValiqAI is the Processor. ValiqAI processes Personal Data only on documented instructions from the Customer, including as set out in this DPA and the agreement, and as necessary to provide and support the Service. Details of the Processing are described in Annex I below.

• Process Personal Data only on the Customer's documented instructions.
• Ensure personnel authorized to process Personal Data are bound by confidentiality.
• Implement appropriate technical and organizational security measures (see Annex II).
• Assist the Customer, taking into account the nature of the Processing, in responding to Data Subject requests and meeting its security, breach-notification, and impact-assessment obligations.
• Not sell or share Personal Data, and not retain, use, or disclose it for any purpose other than performing the Service, as required under the CCPA/CPRA.

The Customer provides general authorization for ValiqAI to engage the Subprocessors listed on our Subprocessors page. ValiqAI imposes data protection obligations on each Subprocessor that are no less protective than those in this DPA and remains responsible for each Subprocessor's performance.

ValiqAI will update the Subprocessors page before engaging a new Subprocessor that processes Customer Personal Data. The Customer may object to a new Subprocessor on reasonable data protection grounds by contacting us.

AI Subprocessors (currently Anthropic and OpenAI) receive scan data from the Customer-authorized target: its URL, page content, and screenshots, including pages behind a login when a scan signs in. They do not receive the Customer's ValiqAI account credentials, payment details, API keys, or similar private account data.

Taking into account the nature of the Processing, ValiqAI will assist the Customer by appropriate technical and organizational measures, insofar as possible, to respond to requests from Data Subjects exercising their rights under Data Protection Law. If ValiqAI receives such a request directly, it will, where legally permitted, direct the Data Subject to the Customer.

ValiqAI will notify the Customer without undue delay after becoming aware of a Personal Data breach affecting the Customer's Personal Data, and will provide information reasonably available to it to help the Customer meet its own notification obligations.

Where the Processing involves transfers of Personal Data from the EEA, UK, or Switzerland to a country without an adequacy decision, the parties agree that the applicable Standard Contractual Clauses (and the UK Addendum where relevant) are incorporated into this DPA and apply to such transfers.

Upon termination of the Service, and at the Customer's choice, ValiqAI will delete or return the Customer's Personal Data, and delete existing copies unless retention is required by law. Standard retention periods are described in our Privacy Policy.

ValiqAI will make available to the Customer information reasonably necessary to demonstrate compliance with this DPA. To the extent audits are required, they may be satisfied by providing relevant certifications, reports (such as a SOC 2 report when available), or responses to reasonable security questionnaires.

Subject matter & duration

Provision of the ValiqAI automated quality and security testing Service, for the duration of the Customer’s subscription.

Nature & purpose

Hosting account data, running scans of Customer-authorized targets, generating results and reports, and providing related support. AI Subprocessors receive scan data from the Customer-authorized target (its URL, page content, and screenshots), not the Customer’s ValiqAI account credentials or payment details.

Categories of Data Subjects

Customer’s authorized users (account holders and team members), and any individuals whose data appears within Customer-authorized scan targets.

Categories of Personal Data

Account details (name, email), authentication data, billing contact information, usage and diagnostic data, and any Personal Data incidentally captured in scan results (e.g. screenshots) of the Customer’s own systems.

Special categories

Not intended. The Service is not designed to process special-category data, and the Customer should not direct scans at systems where such data would be captured.

ValiqAI maintains security measures appropriate to the risk, including:

• Encryption of data in transit (TLS) and at rest.
• Access controls and organization-level data isolation.
• Hashing of passwords, and encryption of single sign-on secrets and connected-app tokens.
• Logging and least-privilege access to production systems.

A fuller description is available on our Security & Trust page.

To request a signed DPA or ask questions about data processing, contact abhi@valiqai.com.