Data Processing Addendum

Last updated 2026-10-23

This Data Processing Addendum ("DPA") forms part of the agreement between the customer ("you", the controller) and Keyveve, Inc. ("we", the processor) for Veqen. To sign a copy, print or save this page as a PDF, or email support@veqen-app.com and we'll countersign.

1. Subject matter and duration

We process personal data only to provide Veqen to you: recording, pricing and reporting the metadata of your AI model calls, and running your organization's account. We do so for as long as you use the service, and then delete it as described in section 8.

2. The data


Data subjects	Your members (people who sign in), and your end users or customers, if you choose to tag calls with identifiers for them
Personal data	Members' names, emails, sign-in times and IP addresses; any identifiers you put in tags. Never prompts, responses or other content: the service has nowhere to put them
Special categories	None. Don't put them in tags
Processing	Storage, aggregation, pricing, reporting, alerting, export and deletion

3. Our obligations

We process the data only on your documented instructions: the agreement, this DPA, and how you configure the service. If we believe an instruction breaks the law, we tell you.
Everyone with access is bound to confidentiality.
We keep appropriate technical and organizational measures, described in Security and privacy and on the trust page: encryption in transit and at rest, hashed API keys, encrypted credentials, tenant isolation, least-privilege access and audited operator access that needs your approval.
We help you answer data-subject requests and with impact assessments, as far as the service allows.

4. Sub-processors

You authorize the sub-processors listed on the trust page. We bind each to data-protection terms at least as protective as these, and stay responsible for them. We announce a new one there at least 30 days before it starts; you can object, and if we can't address the objection, end the affected service with a refund of prepaid fees.

5. International transfers

The service runs in the United States. Transfers from the EU, the UK and Switzerland rely on the European Commission's Standard Contractual Clauses (module two, or module three for our sub-processors) and the UK Addendum, which are incorporated by reference.

6. Security incidents

We notify you without undue delay, and within 72 hours of becoming aware of a personal-data breach affecting your data, with what we know and what we're doing, and update you as we learn more.

7. Audits

We answer reasonable security questionnaires once a year, and give you the results of our independent assessments when we have them. Other audits are by agreement, at your cost, with reasonable notice.

8. Return and deletion

You can export your organization's data at any time. When you delete the organization, or the agreement ends, we delete its data within 30 days, and from backups within the 14 days they're kept, unless the law requires us to keep it.