Data processing agreement
In force from 2026-10-13.
This Data Processing Agreement ("DPA") is part of the Terms of Service between the customer ("Customer", "you") and THINGS & STUFF, LLC, a Delaware limited liability company, 390 NE 191st St, STE 31817, Miami, FL 33179, United States ("Zabio", "we"). It applies whenever you send personal data of your own users to the service and the General Data Protection Regulation (GDPR), the UK GDPR or a similar law applies to that data. It is written to follow Article 28 of the GDPR.
1. Definitions
- Data protection law: the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, and any other law that applies to the processing of personal data under this DPA.
- Personal data, controller, processor, data subject, processing, personal data breach and supervisory authority have the meanings given in the GDPR.
- Customer content: the prompts, messages, files, embeddings inputs and other content you or your users send to the API, and the outputs the models return, including stored conversations and logged bodies.
- Sub-processor: a third party we engage to process Customer content on your behalf.
- Service: the Zabio router and related features described in the Terms of Service.
- Standard contractual clauses or SCCs: the clauses adopted by the European Commission in Decision 2021/914 for the transfer of personal data to third countries, and their UK and Swiss equivalents.
2. Subject matter, duration, nature and purpose
Subject matter. The processing of Customer content by Zabio in order to provide the Service.
Duration. For as long as you use the Service and until all Customer content has been deleted under section 5.7.
Nature. Receiving requests over the API, forwarding them to the model vendor that serves them, returning the response, and, where you choose these features, storing conversations and logged bodies encrypted for the retention period you set, and keeping short-lived routing state.
Purpose. To provide the Service to you as described in the Terms of Service and the documentation. We do not process Customer content for any other purpose. In particular, we do not use Customer content to train or improve any model.
3. Categories of data and data subjects
Data subjects. Your end users, your customers, your staff, and any other person whose personal data appears in the content you send. You decide who they are; we do not.
Categories of data. Whatever personal data appears in the content you send. Depending on your use, this may include names, contact details, identifiers, free text written by or about people, and any special categories of data that you choose to include. You are responsible for deciding whether it is appropriate to send special categories of data to the Service and to the model vendors.
What this DPA does not cover. The account data of your staff who use the web app, the command line tool or the API keys (email, name, sign in data, billing data, usage metadata) is processed by Zabio as a controller and is covered by the Privacy Policy, not by this DPA.
4. Roles
You are the controller of Customer content (or a processor acting for your own controller, in which case you confirm that your controller has authorised this DPA and our sub-processors). Zabio is your processor. Each party complies with the data protection law that applies to it.
You confirm that you have a lawful basis for sending the personal data to us, that you have given any notices and obtained any consents the law requires, and that your instructions to us are lawful.
5. Processor obligations
5.1 Documented instructions
We process Customer content only on your documented instructions. Your instructions are:
- the requests you send to the API and their parameters (for example the model, whether a response is stored, the retention of a conversation, the session identifier);
- the settings you choose in the web app or the command line tool (for example body logging per key, the organization's retention period, enabled models and vendors, deletion of conversations);
- this DPA and the Terms of Service;
- any further written instruction you give us and we accept.
If we believe an instruction breaks data protection law, we tell you and may pause the processing concerned. If the law requires us to process Customer content in another way, we tell you before doing so unless the law forbids it.
5.2 Confidentiality
Only our operators who need access to run the Service can reach systems holding Customer content. They are bound by confidentiality obligations. The web app never displays conversation bodies to us; access to stored bodies is limited and audited as described in Annex II. RemarkableCloud, another division of THINGS & STUFF, LLC, operates our infrastructure and can reach our servers for support when needed; that access is limited to RemarkableCloud's own staff, bound by the same confidentiality obligations, and every session is logged and recorded.
5.3 Security
We implement the technical and organizational measures in Annex II. We may update them, but not in a way that reduces the overall level of protection during the term of this DPA.
5.4 Sub-processors
You give us general authorisation to use the sub-processors in Annex III. We impose on each sub-processor data protection obligations that protect Customer content at least as well as this DPA does, and we remain responsible to you for their performance.
Before we add or replace a sub-processor that processes Customer content, we update Annex III and the sub-processor list on our privacy page at zabio.ai/privacy and notify the owners of your organization by email at least 30 days before the change takes effect. If you object on reasonable data protection grounds within that period, we will work with you to find a solution; where none is available, you may close your account and we will refund unused paid credits.
Model vendors are a special case: a request is only sent to a vendor when you name one of its models, or when auto chooses it. You can prevent a vendor from ever receiving your content by switching its models off for your organization or by restricting the vendors an API key may use.
5.5 Assistance with data subject requests and compliance
Taking into account the nature of the processing, we help you respond to requests from data subjects to exercise their rights. The Service gives you direct tools for most cases: you can read, export and delete stored conversations through the API, and delete logged bodies and conversations from the web app. If a data subject contacts us directly about your content, we tell them to contact you and, where we can identify you, we tell you.
We also help you, as far as reasonably possible and taking into account the information available to us, with your obligations regarding security, breach notification, data protection impact assessments and prior consultation of supervisory authorities.
5.6 Personal data breach
If we become aware of a personal data breach affecting Customer content, we notify the owners of your organization by email without undue delay and in any case within 72 hours of becoming aware of it. The notice describes, as far as we know at that time, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. We update the notice as we learn more. We do not describe a breach as yours or notify a supervisory authority on your behalf unless you ask us to.
5.7 Deletion and return
You can delete Customer content at any time:
DELETE /v1/conversations/{id}andDELETE /v1/responses/{id}delete immediately and permanently; owners and admins can delete conversations from the web app;- a nightly job deletes conversations and logged bodies whose retention period has expired;
- when you delete your organization, its API keys stop working at once, its conversations and logged bodies are deleted at once, and the encryption key that protected them is destroyed 30 days later, after which any remaining encrypted copy, including in backups, is unreadable.
You can retrieve stored conversations through the API before deleting them. We do not offer another return format at this time. We keep call metadata (which contains no Customer content) for the periods stated in the Privacy Policy.
5.8 Audit
We make available the information needed to demonstrate compliance with this DPA. On written request, not more than once a year unless a supervisory authority requires it or a breach has occurred, we provide a written report describing our security measures and any relevant third-party reports we hold. Where the written report is not sufficient to meet a legal obligation you have, you or an independent auditor bound by confidentiality may inspect our compliance at a mutually agreed time and scope, during business hours, with at least 30 days notice, without disrupting the Service and at your cost. We may charge a reasonable fee for inspections that go beyond the written report.
5.9 Records
We keep a record of the categories of processing we carry out on your behalf and make it available to a supervisory authority on request.
6. International transfers
All processing under this DPA takes place in the United States, except inference by the model vendors in Annex III that process Customer content in North America (Together AI), in China (DeepSeek), in a region they do not commit to (Mistral AI) or, for Alibaba Cloud (International), anywhere outside mainland China with storage in Singapore, when a request is routed to them. If you are established in the European Economic Area, the United Kingdom or Switzerland, or you send us personal data subject to those laws, sending Customer content to the Service is a transfer to a third country.
The parties intend to rely on the SCCs, Module Two (controller to processor), with you as data exporter and Zabio as data importer, supplemented by the UK Addendum and the Swiss amendments where applicable. The SCCs are incorporated into this DPA by reference and completed as follows: the docking clause in Clause 7 applies; for Clause 9, option 2 (general written authorisation) applies, with the notice period in section 5.4; the optional wording in Clause 11 does not apply; for Clause 13, the competent supervisory authority is the one determined under that clause; for Clauses 17 and 18, the SCCs are governed by the law of Ireland and disputes under them go to the courts of Ireland. Annex I, Annex II and Annex III of this DPA serve as Annex I, Annex II and Annex III of the SCCs. On request, we give you the information you reasonably need for your own transfer impact assessment. Where the SCCs conflict with this DPA, the SCCs prevail for the transfer they govern.
Our sub-processors in Annex III are also in the United States, except Together AI (North America), DeepSeek (China), Mistral AI (no fixed region) and Alibaba Cloud (International) (stored in Singapore, processed anywhere outside mainland China); Alibaba Cloud (US) stores and processes only in the United States. Onward transfers to them are covered by our contracts with them, which include the protections this DPA requires. DeepSeek and Mistral AI receive Customer content only when a request is routed to them. China has no adequacy decision from the European Commission, and Mistral AI does not commit to a region; if you send personal data subject to the GDPR, the UK GDPR or Swiss law, you can make sure they never receive it by switching them off for your organization or restricting the vendors your API keys may use.
7. Liability
Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service. Nothing in this section limits a data subject's rights under the SCCs or a party's liability where the law does not allow it to be limited.
8. Order of precedence
If this DPA conflicts with the Terms of Service, this DPA prevails for the processing of Customer content. If the SCCs conflict with this DPA, the SCCs prevail. This DPA is governed by the laws of the State of Florida, United States, and the state and federal courts located in Miami-Dade County, Florida, have jurisdiction, except where the SCCs require otherwise.
Contact for this DPA: privacy@zabio.ai. EU representative: none appointed yet. Data protection officer: none appointed.
Annex I. Processing details
Data exporter (controller): the Customer, as identified by the organization's account details. Contact: the organization's owners.
Data importer (processor): THINGS & STUFF, LLC, 390 NE 191st St, STE 31817, Miami, FL 33179, United States, privacy@zabio.ai.
Categories of data subjects: the Customer's end users, customers, staff and any other person whose personal data appears in Customer content.
Categories of personal data: any personal data included by the Customer in prompts, messages, files, batch files (the inputs, results and errors of the batch API), embeddings inputs and stored conversations, and in the outputs returned by the models.
Special categories of data: only if the Customer chooses to include them. The Customer is responsible for that decision. Restrictions applied: encryption at rest, access limited to the Customer's own API keys with the conversations scope and to audited owner and admin access; no display in the web app.
Frequency of the transfer: continuous, with each API request.
Nature of the processing: receipt, transmission to the model vendor, return of the response, encrypted storage where the Customer enables it, deletion.
Purpose: providing the Service.
Retention: routing session state, one hour after the last call and 24 hours at most; logged bodies, stored conversations and batch files, the retention period set by the Customer, from 1 to 365 days (30 by default), counted for batch files from the upload for inputs and from the end of the batch for results, with deletion available at any time; all Customer content deleted on closure of the organization, with the encryption key destroyed 30 days later.
Transfers to sub-processors: as listed in Annex III, for the purposes and duration stated there.
Competent supervisory authority: the authority of the EU member state where the data exporter is established or, for exporters outside the EU, the authority determined under Clause 13 of the SCCs.
Annex II. Technical and organizational measures
Encryption in transit. All connections to the Service use TLS, terminated at our network edge provider and carried to our servers over an encrypted tunnel. Connections from our application to its databases use TLS. The rest of our internal traffic (caches and monitoring) travels on a private network between our own servers in the same datacenter.
Encryption at rest. Stored conversations, logged bodies and Customer vendor keys are encrypted with AES-256-GCM under a data key unique to each organization. Each stored item is bound to its own record identifier so that a payload cannot be moved or replayed as another item.
Key management. Organization data keys are wrapped by a master key that lives only in the server's configuration file with restricted permissions, never in the database. The master key can be rotated; rotation re-wraps the data keys without re-encrypting the content. Destroying an organization's data key on closure renders all of its remaining ciphertext unreadable, including in backups.
Access control. Customer content is readable through the API only with an API key of the same organization that has the conversations scope. Logged bodies of stateless calls are readable only by the organization's owners and admins through an audited endpoint, and each read is recorded in the organization's audit log. The web app never displays conversation bodies. The read-only database role used for reporting has no access to the encrypted content columns. Production systems are reachable only by our operators, using key based authentication, with each access path part of a periodic access review.
Isolation. Every stored item, key, setting and record belongs to one organization. Requests to vendors carry only the neutral request, without customer identifiers. Vendor keys supplied by a Customer are used only for that Customer's traffic.
Logging and monitoring. Request logs, audit events, metrics and error messages never contain Customer content, API keys or secrets. Email addresses appear in logs only as hashes. Privileged actions are recorded in an audit log with actor, target, time and request identifier. Operational alerts notify our operators of failures.
Application security. API keys are stored as hashes. Passwords of the Customer's staff are hashed with Argon2id. The web app uses secure, HttpOnly session cookies with CSRF protection. Rate limits apply per client address, per API key and per account. Request bodies are limited in size. Outbound fetches of image URLs are blocked from reaching private networks. Dependencies are checked for known vulnerabilities on every change. Services run as an unprivileged user under operating system sandboxing.
Backups. Backups are encrypted. Because Customer content in backups is encrypted under the organization's data key, destroying that key on closure makes the backup copies unreadable too.
Retention and deletion. Retention is enforced by a nightly job. Deletion through the API is immediate and permanent. Closure of an organization deletes its content at once and destroys its data key 30 days later.
Resilience. Telemetry and billing writes are protected from client disconnects. The Service retries failed vendor calls on other eligible models according to the Customer's settings.
Sub-processor management. Sub-processors are listed in Annex III, bound by written contracts, and changes are notified as described in section 5.4.
Annex III. Sub-processors
| Sub-processor | Purpose | Customer content processed | Location |
|---|---|---|---|
| Anthropic | inference for requests routed to Anthropic models | the content of requests routed to it and the responses it produces | United States |
| OpenAI | inference for requests routed to OpenAI models | the content of requests routed to it and the responses it produces | United States |
| inference for requests routed to Google models | the content of requests routed to it and the responses it produces | United States | |
| xAI | inference for requests routed to xAI models | the content of requests routed to it and the responses it produces | United States |
| Mistral AI | inference for requests routed to Mistral models | the content of requests routed to it and the responses it produces | not fixed: Mistral AI does not commit to an inference location on its global API |
| DeepSeek | inference for requests routed to DeepSeek models through DeepSeek's own API ("DeepSeek (China)") | the content of requests routed to it and the responses it produces | China |
| Together AI | inference for requests routed to open-weight models and to the DeepSeek models labelled "DeepSeek (North America, via Together AI)" | the content of requests routed to it and the responses it produces | North America |
| Alibaba Cloud (Alibaba Cloud Model Studio), shown as "Alibaba Cloud (US)" | inference for requests routed to the models with ids ending in @alibaba-us, served by its Virginia workspace with the US deployment scope |
the content of requests routed to it and the responses it produces | United States (Virginia): data stored and processed only in the United States |
| Alibaba Cloud (Alibaba Cloud Model Studio), shown as "Alibaba Cloud (International)" | inference for requests routed to the Qwen models with plain ids and to the models with ids ending in @alibaba-intl, served by its Singapore workspace |
the content of requests routed to it and the responses it produces | data stored in Singapore and processed anywhere outside mainland China |
| TypeSafe AI | inference for requests that name the jev-1.13.0 decision model and for classification jobs the Service answers with it under auto; the routing classifier, which names the job of an auto request so the Service can choose a model; and the check of the excerpt of an auto request the Service splits |
for requests that name jev-1.13.0, and for classification jobs answered with it under auto (requests whose JSON schema holds only fixed choices, booleans and bounded scores), the content of the request routed to it and the answer it produces; for the routing classifier, an excerpt of the request (the first part of the system prompt, the last user message, tool names, the number of images, a short digest of earlier turns), never full conversations, images, tool results or outputs; for a split auto request, also the excerpt of the source that the extraction step copied, up to 40 percent of the last user message |
United States |
| Cloudflare | network edge: TLS termination, traffic protection, encrypted tunnel to our servers | Customer content in transit | United States |
| OVHcloud US | the datacenters where the servers that run the Service are located (Virginia) and where encrypted backups are kept (Oregon); the servers are operated by RemarkableCloud, a division of THINGS & STUFF, LLC | all Customer content stored by the Service, encrypted | United States |
| Stripe | payment processing | none; Stripe processes the Customer's billing details only, covered by the Privacy Policy | United States |
Every model vendor is enabled by default; you can turn any vendor off for your organization. A model vendor receives Customer content only for the requests routed to it, under that vendor's API terms. The Customer controls which vendors may receive its content by switching models off for the organization and by restricting the vendors an API key may use. Requests sent through the batch API reach the same vendors in the same way; the Service deletes the copies a vendor holds of a batch's inputs and results as soon as it has collected them.