Data Processing Agreement

This Data Processing Agreement ("Agreement") forms part of the Terms of Service between the user ("Controller") and Oxlo.ai ("Processor").

1. Roles

1.1 Data Controller

The user is the Data Controller of all data submitted for inference jobs.

1.2 Data Processor

Oxlo.ai acts as a Data Processor and processes data strictly based on Controller instructions.

2. Purpose & Scope

2.1 Processing Purpose

Data is processed to provide model inference, benchmarking, latency evaluation, and API workload execution.

2.2 No Resale or Advertising

The Processor does not analyze or store data for resale or advertising purposes.

3. Data Collection Principles

3.1 Sensitive Data Restriction

Do not send personal or highly sensitive data in inference prompts. The Controller is solely responsible for the content of data submitted through the Platform.

3.2 Data Minimization

The Processor enforces data minimization and may reject high-risk data patterns.

4. Datacenter Processing Disclosure

4.1 Processing Location

GPU inventory used for early access may be hosted in United States-based datacenters.

4.2 Performance Variability

Performance may vary based on location, availability, or priority levels (batch to high priority).

4.3 Cluster Configuration

Cluster configuration, including interconnect, network fabric, or tenancy, is determined by the underlying provider and is not uniform across all nodes.

5. Security Measures

The Processor shall implement the following security measures:

• Encryption in transit where supported
• DNSSEC and registrar lock
• Secure API key issuance
• Restricted internal access
• Usage logs containing model used, timestamp, latency, request priority, and job status

6. Breach Notification

6.1 Notification Timeline

The Processor shall notify the Controller within 72 hours if a data breach is detected.

6.2 Notification Contents

Notification will include the scope of the breach, its impact, and the mitigation steps being taken.

7. Data Retention & Deletion

7.1 Controller Deletion Rights

The Controller may request deletion of their data at any time by contacting support.

7.2 Deletion Timeline

The Processor will delete inference job data within 30 days of account cancellation or a Controller deletion request.

8. Sub-processors

8.1 Sub-processor Use

The Processor may route jobs through sub-processors including GPU datacenter partners or decentralized inference nodes.

8.2 Sub-processor Obligations

All sub-processors are bound by the same security and purpose limitations as the Processor under this Agreement.

9. Audits & Logs

9.1 Usage Logs

The Processor provides request-level usage logs for attribution, including model used, timestamp, latency, and job status.

9.2 Audit Access

Logs may be audited by the Controller or their authorized engineer. Audit requests can be submitted via support.

10. Data Residency Changes

10.1 Future Locations

Future infrastructure expansions may introduce new processing locations.

10.2 Controller Notification

The Controller will be notified of any material changes to data residency in advance.