Skip to content

Privacy

Data Processing Agreement (DPA)

Stand: October 2026

1. Scope and parties

This Data Processing Agreement under Article 28 GDPR applies between the customer (controller) and anycast.io UG (haftungsbeschränkt), Hintere Straße 125a, 90768 Fürth, Deutschland (processor), where personal data is processed on the customer's behalf when using 2342.ai.

It forms part of the service agreement for business customers. Organization owners and admins accept the current version electronically in the organization area. The acceptance record contains the version, timestamp, accepting person and the SHA-256 fingerprints of this agreement and its annexes. The PDF generated at that moment carries the processor's electronic countersignature, is delivered by email and can be downloaded in the organization area at any time.

Annexes: Annex A is this agreement, Annex B the list of subprocessors (https://2342.ai/en/subprocessors), Annex C the model datasheet (https://2342.ai/en/model-datasheet). The technical and organizational measures are set out in section 10. All annexes are pinned by fingerprint at acceptance and remain available in that version.

2. Subject matter, duration, nature and purpose

The subject matter is operation of the 2342.ai platform: AI chat, API gateway, research functions, file storage and vector stores, automations, team administration and budget management, and the guided creation of advertising material (ad videos) with research on public sources, text and image generation, speech synthesis, video generation and automated cutting.

The duration corresponds to the term of the service agreement. The purpose is to provide the platform functions used by the customer, including forwarding requests through the selected AI data path.

3. Data types and data subjects

Data subjects include in particular the customer's employees and end users, as well as third parties whose data the customer submits to the platform, such as contact persons at business partners.

  • Account and master data (name, email address, roles)
  • Content data (chats, prompts, tool calls, files, vector stores, research results)
  • Usage and billing data (model, data path, tokens, costs, timestamps)
  • Technical data (IP addresses, device information, logs)

4. Processor obligations

  • Process data only on documented instructions from the customer (Article 28(3)(a) GDPR); instructions are given through the platform configuration (model choice, data paths, unlocks, project permissions) or in text form
  • Duty to inform: the processor informs the customer without delay if, in its opinion, an instruction infringes the GDPR or other data protection provisions (Article 28(3), second subparagraph GDPR) and may suspend execution until the customer confirms
  • Confidentiality obligation for every person involved in processing (Article 28(3)(b) GDPR)
  • Technical and organizational measures under Article 32 GDPR (section 10)
  • Notification of personal data breaches under section 8
  • Support for the customer with data subject rights, data protection impact assessments and supervisory authority inquiries (Article 28(3)(e) and (f) GDPR)
  • Maintenance of a record of processing activities as processor (Article 30(2) GDPR), provided on request
  • Demonstration of compliance with this agreement and enabling audits, including inspections after reasonable notice (Article 28(3)(h) GDPR)
  • Data protection contact: Franz Bettag, anycast.io UG (haftungsbeschränkt); reach us through the contact details in the imprint at https://2342.ai/en/imprint with the subject "Data protection"

5. Subprocessors

The customer grants general authorization for the subprocessors listed in Annex B. For the customer, the version of Annex B pinned by fingerprint at acceptance applies; it remains available at its versioned address.

The processor contractually binds every subprocessor to the same data protection obligations set out in this agreement, in particular to sufficient guarantees for appropriate technical and organizational measures under Article 32 GDPR. Where a subprocessor fails to fulfil its obligations, the processor remains liable to the customer for the performance of those obligations (Article 28(4) GDPR).

The processor announces intended additions or replacements of subprocessors to organization owners and admins by email before they take effect and publishes the new version of Annex B. The customer may object to the change for compelling data-protection reasons. If no agreement is reached, the customer may terminate the affected services or the service agreement for cause; unused credit is refunded. Until then, the accepted version remains authoritative.

Transfers to third countries rely on appropriate safeguards under Chapter V GDPR. Annex B names the basis per subprocessor: an adequacy decision (such as the EU-U.S. Data Privacy Framework) or EU Standard Contractual Clauses under Implementing Decision (EU) 2021/914 with a documented transfer impact assessment.

6. AI model use and data paths

Every model is assigned to a data path. Provider, processing region, provider-side retention, abuse monitoring and training use are recorded per model in the model datasheet (Annex C) and published machine-readably in the model catalog at GET /v1/models in the fields data_path, zero_data_retention, provider_may_train and requires_org_unlock. Datasheet, catalog and model picker derive from the same routing configuration.

EU data path: inference takes place exclusively in data centers within the EU/EEA. Providers do not use inputs and outputs for training. Any provider-side abuse monitoring and its retention period is stated per model in Annex C. This data path is open to every organization.

External data path: processing outside the EU/EEA, without an EU commitment, or at a provider that reserves the right to train on inputs and outputs. These models are locked by default and only reachable after an organization owner or admin explicitly enables them. The customer ensures that no personal data lacking a legal basis and an appropriate safeguard is processed through enabled external models.

GLM 5.3 and GLM 5.3 Flash run on the EU data path through in-region routing to EU endpoints with zero data retention. GLM 5.2 and the Mistral route for GLM (Public Preview with a training reservation) are external data paths.

The customer can define per project which models are permitted. The gateway rejects requests from chats, automations and API keys of that project to any other model. 2342.ai does not use customer data to train its own foundation models.

Web search in research functions: search queries are automatically checked for personal data before they reach the search service and rejected on a match; they carry no user identifiers. Push notifications to mobile devices contain no prompt or response content, only neutral status wording.

For ad videos, image generation, speech synthesis and video generation run on Microsoft Azure and Google Cloud in EU regions on the EU data path. Only content produced within the platform is transmitted to these providers: scene descriptions written by the model, AI-generated images and the spoken text, no account or user data. Names of people found during research are not included in these requests. Uploaded images showing recognizable people are marked and stay on the EU data path. Should the customer enable external data paths for ad videos, Annex B names the providers involved.

7. Logging and retention

Prompt and response content is never written to technical logs. Error responses from model providers are logged only as length and hash. The following retention periods apply:

  • Technical access and error logs (IP address, timestamp, endpoint, status code, duration, request ID; no content): 14 days centrally, rotated locally and deleted after 30 days at the latest
  • Usage events for billing and budgets (user and key identifier, model, data path, tokens, costs, duration, status; no content): 24 months; billing records for the statutory commercial and tax retention periods
  • Organization audit log (time, user, project, model, data path, tokens, costs, and prompt and response encrypted with AES-256-GCM): 365 days, then automatic deletion; accessible only to the organization's owners and admins
  • Rate-limit counters per IP address and account: volatile, deleted when the respective window expires
  • Acceptance records for terms and DPA (version, fingerprint, timestamp, IP address, browser identifier): contract term plus statutory limitation periods

8. Notification of personal data breaches

The processor notifies the customer of every personal data breach affecting the customer's data without undue delay and at the latest 24 hours after becoming aware of it, by email to the organization's owners and admins and to a data protection contact address provided by the customer.

The notification contains, to the extent already known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the affected models, data paths and subprocessors, the likely consequences, the measures taken and proposed, and the contact point. Missing details are provided without undue delay so that the customer can meet its 72-hour deadline under Article 33 GDPR. The processor documents every breach with its course, effects and remedial measures and supports the customer with notifications to supervisory authorities and data subjects.

9. Deletion and return

Customers can delete content, projects, accounts and organizations themselves at any time; a complete data export is available through the platform.

After the service agreement ends or the organization is deleted, the processor deletes all personal data of the customer within 30 days unless a statutory retention obligation applies. Database backups are created daily and deleted automatically after 14 days, so deleted data disappears from backups no later than 14 days after deletion. Audit logs are deleted at the latest when their period under section 7 expires, technical logs after 30 days at most. Backups serve recovery only and are not evaluated individually.

Billing records are kept for the statutory commercial and tax retention periods; they contain no content data.

10. Technical and organizational measures (Article 32 GDPR)

These measures apply to the core platform operated by 2342.ai. The measures of the subprocessors follow from their agreements and certifications named in Annex B.

  • Physical access control: operation on own dedicated hardware in the access-controlled Deutschherrnkarree data center in Nuremberg (colocation by Core-Backbone GmbH); entry only for individually authorized persons, logged by the data center operator
  • System access control: passwordless sign-in through single-use, time-limited magic links; session tokens valid for 24 hours and revocable refresh tokens; API keys stored exclusively as SHA-256 hashes; administrative access to the infrastructure only key-based via SSH for named administrators
  • Data access control: role model of owner, admin and member per organization plus project roles; enabling external data paths and per-project model permissions reserved to owners and admins; client keys with limited scopes
  • Separation control: logical tenant separation through organization and project identifiers in every database query; separate vector stores per project; test systems without production data
  • Encryption: transport encryption with TLS for every connection from users, apps and API clients and to every model provider and service; audit content, integration credentials and secrets are stored encrypted at the application level with AES-256-GCM and rotatable keys. The core platform's storage media are not fully encrypted; protection of data at rest relies on dedicated hardware, physical access control and field-level encryption of particularly sensitive data
  • Transfer control: no prompt or response content in technical logs; provider error responses only as hashes; automated filter for personal data before web search; push notifications without content; transmission to model providers only through the designated data path
  • Input control: audit log per organization with time, user, project, model and data path; fingerprinted acceptance records for contract documents
  • Availability and resilience: at least two API instances running in parallel with graceful shutdown; daily database backup with 14 days retention; recoverability verified at least annually by a test restore; rate limits and budget caps against abuse and cost spikes
  • Processing control: processing only within the platform configuration and the customer's instructions; data processing agreements with every subprocessor; review of new subprocessors before inclusion in Annex B
  • Review and improvement: automated tests before every release, continuous dependency updates, logging of administrative access to the infrastructure; review of these measures, the deletion periods and the subprocessors at least annually; changes to this agreement and its annexes remain available as immutable versions
  • Incident handling: documented notification path under section 8 with a 24-hour deadline, a named contact point and a fixed notification template

11. Final provisions

German law applies. If individual provisions are invalid, the remaining provisions remain effective.

In the event of conflicts between this DPA and the Terms of Service, this DPA prevails with regard to data protection.

Electronic acceptance in the organization area is the standard method of concluding this DPA. The PDF generated at acceptance with the processor's electronic countersignature is the countersigned version; an additional handwritten signature is not required but is provided on request.