Data Processing Agreement

1. Overview

Vaquill AI offers a standard DPA to customers whose organizations require one. The DPA is pre-executed by Vaquill AI and available to attach to any paid plan or credit top-up, including Vaquill API Pro and Vaquill API Business, and to application subscriptions. It governs how Vaquill AI, the service operated by Aralsura Solutions LLP (an India-registered limited liability partnership), processes personal information on behalf of your organization when you use the Service. It does not cover personal data we hold about you as our customer, such as your own account and billing details, which is governed by our Privacy Policy.

The DPA is intentionally straightforward and readable. It aligns with the California Consumer Privacy Act and Privacy Rights Act (CCPA/CPRA), the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA), the Texas Data Privacy and Security Act (TDPSA), the Utah Consumer Privacy Act (UCPA), the GDPR and UK GDPR (where applicable to EEA or UK data subjects), and incorporates the new EU Standard Contractual Clauses for any cross-border transfers.

2. Key DPA Terms

The DPA is the controlling legal document, this page is a plain-English summary. If the summary and the DPA conflict, the DPA governs.

2.1 Roles of the Parties

Your organization is the “Business” and “Controller” of the personal information processed through the Service. Vaquill AI acts as the “Service Provider” under the CCPA/CPRA and as the “Processor” under the GDPR and US state-law equivalents.

2.2 Purpose of Processing

Vaquill AI processes personal information solely to provide, secure, and support the subscribed Service. We do not use personal information for our own commercial purposes, and we do not combine it with data from other customers or third parties except as strictly necessary to operate the Service.

2.3 What the API Processes

The API and MCP server do not persist the text of your queries, request bodies, or parameters. They exist in memory for the length of the request. The personal data in scope is therefore limited to what an account needs: the contact details of your users, API key hashes and prefixes, the billing ledger (account ID, credit amount, endpoint label, timestamp), and, if you use Law Change Alerts, webhook URLs, encrypted webhook secrets and notification email addresses. Delivery logs hold status codes only, for 90 days. Usage counters last 48 hours. Request logs record, for each metered call, the route, status code, response time, credits charged, the API key used and the calling client’s user agent; error reporting runs with personal data collection switched off. The MCP server also holds OAuth sign-in state (client registrations and tokens), encrypted. Section 2.7 of the Privacy Policy has the full table.

If your own product passes personal data about your end users through the API, you decide whether to do that, and you remain responsible for notice, consent, and any end-user requests, as Section 24.4 of the Terms sets out.

2.4 Zero-Data-Retention

Vaquill AI and its LLM sub-processors do not retain Customer Content beyond what is needed to deliver a response or to maintain the Service. Our LLM sub-processors (OpenAI and Anthropic) operate under zero-data-retention (ZDR) agreements, meaning prompts and outputs are not persisted on their systems after the response is returned. The API’s statute-retrieval endpoints do not send your queries to an LLM provider. Search queries are sent to Voyage AI, a sub-processor, to compute embeddings and rerank results.

2.5 No Training on Customer Data

The DPA contractually commits Vaquill AI and its sub-processors not to use Customer Data or Outputs to train, fine-tune, or improve any AI or machine-learning model.

2.6 Data Location

Customer Data is processed and stored by Vaquill AI and the sub-processors listed in our sub-processor register, in the regions recorded there. The register is available to customers and their counsel on request at contact@vaquill.ai.

Transfers of personal data from the EEA or UK are made under the EU Standard Contractual Clauses, with the UK Addendum where applicable. Vaquill AI will give at least 30 days’ written notice before moving primary Customer Data to another country.

2.7 Sub-processors

A current list of authorized sub-processors is available to customers and their counsel on request at contact@vaquill.ai. Vaquill AI will give customers at least 30 days’ advance notice before adding a new sub-processor. Customers who object to a new sub-processor may terminate their subscription as described in the DPA.

2.8 Security Measures

• AES-256 encryption at rest for the database and document storage
• TLS 1.2 or higher in transit, with TLS 1.3 where the client supports it
• Logical tenant isolation so one customer’s data cannot be accessed by another customer
• Role-based access controls, MFA for Vaquill AI personnel, and least-privilege permissions
• Administrative and system audit logs
• Breach notification as set out in Section 2.9, and routine dependency scanning

2.9 Incident Notification

Vaquill AI will notify affected customers without undue delay and, in any event, within 72 hours of becoming aware of a personal-data breach that affects their Customer Data. Notices are sent to the account administrator on file and will include the nature of the incident, the categories of data affected, and the remediation steps being taken.

2.10 Consumer & Data-Subject Rights

Vaquill AI will assist Customer in responding to verified requests from consumers and data subjects to access, delete, correct, or port their personal information, as required by CCPA/CPRA, VCDPA, CPA, CTDPA, TDPSA, UCPA, GDPR, and UK GDPR. Assistance is provided at no additional charge within reasonable limits.

2.11 Deletion on Termination

On termination of the subscription, customers have a 30-day window to export Customer Data. After the export window, Customer Data is deleted from production systems and anonymized in backups according to our standard backup-rotation schedule. For API accounts, keys are revoked and alert settings (webhook URLs, secrets, notification emails) are deleted on termination. The billing ledger is kept as a billing record under the Privacy Policy, because tax law requires it.

2.12 Auditing

Vaquill AI does not currently hold an independent security certification or publish a third-party audit report. Customers may request a written security-questionnaire response, and we will provide the information the law requires us to make available to show we meet our obligations as a processor, such as under GDPR Article 28(3)(h).

2.13 Liability

Liability under the DPA is governed by the Master Subscription Agreement and Terms of Service. The aggregate cap is the greater of (a) the fees paid by the customer in the twelve (12) months immediately preceding the event giving rise to the claim, or (b) one hundred US dollars ($100).

2.14 Governing Law

The DPA is governed by the laws of the State of Delaware, consistent with the Terms of Service.

3. How to Get the DPA

Customers on any paid plan or who have bought credits (Vaquill API Pro, Vaquill API Business, an enterprise order form, or an application subscription) can request a pre-signed DPA by emailing contact@vaquill.ai. Please include:

• Your organization’s legal entity name (as you want it to appear on the signature block)
• Your organization’s registered business address
• The primary contact’s name, title, and email
• The Vaquill AI account email the subscription is associated with

We typically return an executed DPA within 2 business days. There is no additional cost for the standard DPA.

4. Custom Terms

For customers that require bespoke DPA terms, for example, to match a client’s outside-counsel guidelines or a specific industry standard, contact contact@vaquill.ai to discuss. We can accommodate reasonable modifications for annual subscribers and order-form customers, subject to review.

5. Related Documents

The DPA incorporates by reference Vaquill AI’s Privacy Policy and Terms of Service. Please review each document alongside the DPA.

• Privacy Policy
• Terms of Service
• Security