Data Processing Addendum

Last updated: 5 November 2026.

This Data Processing Addendum (DPA) applies when a customer uses Valefront to process personal data in prompts, responses, or other API content. The customer is the controller (or processor on behalf of another controller) and Valefront is the processor. This page describes the terms available for signing; contact us to sign.

1. Instructions and scope

Valefront processes customer data only on the customer's documented instructions, including to provide, secure, monitor, and support the API and to route requests to the provider selected by the service. The customer is responsible for ensuring its instructions and use of the service comply with applicable law and for giving required notices to data subjects.

2. Confidentiality

Valefront will ensure that people authorised to process customer data are bound by confidentiality obligations and receive appropriate instructions. Valefront will not disclose customer data except as instructed, required by law, or through the subprocessors needed to provide the service.

3. Security

Valefront will maintain appropriate technical and organisational measures for the risks of processing, including access controls, authentication, encryption in transit, service monitoring, least-privilege operational access, and resilience measures appropriate to the service. Customer data sent to model providers is handled according to the applicable provider terms and data-processing agreement.

4. Subprocessors

Valefront may engage subprocessors to provide infrastructure, accounts, model or speech inference, email, payments, security, and support. The current list is at /subprocessors. Customers are told before material changes and may contact Valefront with questions or objections where required by law.

5. Assistance

Taking into account the nature of processing, Valefront will reasonably assist the customer with requests from data subjects, security obligations, impact assessments, and consultations with supervisory authorities. Requests should be sent to [email protected].

6. Personal data breaches

Valefront will notify the customer without undue delay, and where feasible within 72 hours, after becoming aware of a personal data breach affecting customer data. The notice will describe, as far as then known, the nature of the breach, the categories and approximate volume of data concerned, the likely consequences, and the measures taken or proposed. Valefront will provide further information as it becomes available and will take reasonable steps to contain and remedy the breach.

7. International transfers

Customer data may be processed in the locations listed on the subprocessors page. Where applicable law requires safeguards for a transfer, Valefront relies on the Standard Contractual Clauses or an equivalent mechanism, and on its providers' data-processing terms, and completes any filings required under Vietnamese personal data protection law.

8. Retention, return and deletion

Valefront does not store the content of prompts or responses after a request is answered. Account details, API keys, usage and billing records are kept while the account is open. When the customer closes the account or asks for deletion, Valefront deletes or returns the customer's personal data within 30 days, except records it must keep by law: accounting and billing records, including invoices and payment records, are kept for 10 years under Vietnamese accounting law.

9. Audits and information

Valefront will make available the information reasonably necessary to demonstrate compliance with this DPA, including summaries of its security measures and its subprocessors' certifications where available. Where that information is not sufficient and the law requires it, the customer may request an audit once a year, with at least 30 days' notice, at its own cost, carried out in a way that protects other customers' data and Valefront's confidential information.

10. Term, liability and order of precedence

This DPA lasts as long as Valefront processes customer data for the customer. It forms part of the Terms of Service, and the limitations of liability in the Terms apply to it. If the DPA and the Terms conflict on the protection of personal data, the DPA prevails.

11. Signing and contact

To sign this DPA, or for any question about it, contact [email protected].