Data Processing Addendum

This Data Processing Addendum (DPA) forms part of the agreement between Skytells, Inc. and an organization using the service where Skytells processes personal data on that organization's behalf. If this DPA conflicts with the agreement on personal-data processing, this DPA controls to the extent of that conflict.

The organization is the controller and Skytells is the processor for customer personal data. Skytells will process that data only on the organization's documented instructions, including the agreement and use of the service, unless applicable law requires otherwise.

Processing may include hosting, storing, organizing, retrieving, transmitting, generating requested AI output, securing, supporting, and deleting customer personal data. The processing continues for the term of the agreement and until deletion or return is required.

Relam enforces access, permissions, memory settings, connected tools, sharing, and model routing on the server. Customer personal data submitted for AI features is handled through that governed environment before any provider processing occurs.

Skytells-native model requests are processed on Skytells private network infrastructure. From the moment Skytells receives request content for those models, inference workloads are handled inside our controlled internal environment and are not exposed to the public internet for model processing.

Third-party model requests are routed through enterprise deployments operated by leading cloud providers—for example, Microsoft Azure OpenAI Service and comparable governed offerings—not through mass-market public API products sold directly to general consumers. The providers engaged depend on the model, feature, and deployment configuration applicable to the organization's account.

Skytells will limit access to personnel and subprocessors who need it to provide the service and who are bound by confidentiality duties. Skytells will maintain appropriate technical and organizational measures designed to protect customer personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Those measures include server-side access controls, private networking for Skytells-native model processing, and contractual requirements for enterprise AI subprocessors.

The organization authorizes Skytells to engage subprocessors to provide the service, subject to written obligations materially consistent with this DPA. Current categories, governance approach, and applicable provider types are described on our Subprocessors page. Where a transfer requires a recognized transfer mechanism, Skytells will use an appropriate mechanism.

Taking into account the nature of processing and information available to us, Skytells will provide reasonable assistance with data-subject requests, security assessments, and regulatory obligations. We will notify the organization without undue delay after becoming aware of a confirmed security incident affecting its customer personal data.

Following account closure or a deletion request, Skytells will delete the affected customer personal data within 14 days, subject to applicable legal requirements. The organization may request return of its data before deletion. On reasonable written request, we will make available information necessary to demonstrate compliance with this DPA, subject to confidentiality, security, and reasonable audit limitations.

For an executed enterprise agreement, security addendum, or processing question, contact our team through the contact page.