Effective Date: October 24, 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service (the "Agreement") between ModelRiver Inc., a Delaware corporation ("ModelRiver," "we," "us"), and the customer that has accepted the Agreement ("Customer," "you"). It applies whenever ModelRiver processes Customer Personal Data in providing the services. By using the services under the Agreement, you accept this DPA. If you need a countersigned copy, email [email protected].
1. Definitions
- Data Protection Laws: all laws that apply to the processing of Customer Personal Data under the Agreement, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as it forms part of UK law ("UK GDPR"), the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act as amended ("CCPA").
- Customer Personal Data: personal data that ModelRiver processes on Customer's behalf in providing the services, including personal data contained in requests sent through the ModelRiver API, AI responses, request logs and webhook payloads.
- Subprocessor: a third party ModelRiver engages to process Customer Personal Data.
- Security Incident: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
- "Controller," "processor," "data subject," "personal data" and "processing" have the meanings given in the GDPR. "Service provider," "business," "sell" and "share" have the meanings given in the CCPA.
2. Roles and scope
2.1. Customer is the controller (or a processor acting for its own controller) of Customer Personal Data, and ModelRiver is a processor (or subprocessor) processing it on Customer's behalf.
2.2. For personal data about Customer's own account users that ModelRiver uses to run its business, such as account, billing and security data, ModelRiver is an independent controller, as described in our Privacy Policy. This DPA doesn't apply to that data.
2.3. When Customer connects an AI provider with its own API key, or configures a webhook or callback URL, ModelRiver sends Customer Personal Data to that provider or endpoint on Customer's instructions. Those providers and endpoints are chosen and contracted by Customer and are not ModelRiver Subprocessors.
2.4. The details of the processing are in Annex I.
3. Customer's instructions
3.1. ModelRiver processes Customer Personal Data only on Customer's documented instructions. The Agreement, this DPA and Customer's use and configuration of the services (including its workflows, providers, logging and retention settings) are Customer's complete instructions. Additional instructions require written agreement.
3.2. ModelRiver will tell Customer if, in its opinion, an instruction infringes Data Protection Laws, unless the law prohibits it.
3.3. Customer is responsible for having a lawful basis to process Customer Personal Data and to send it to ModelRiver and to the AI providers it chooses, and for any notices and consents this requires. Customer should not send special categories of personal data (for example health data) through the services unless it is necessary and lawful to do so.
4. ModelRiver's obligations
4.1. Confidentiality. ModelRiver ensures that people authorized to process Customer Personal Data are bound by confidentiality obligations.
4.2. Security. ModelRiver implements and maintains the technical and organizational measures in Annex II, and may update them as long as the overall level of protection doesn't decrease.
4.3. No other use. ModelRiver will not sell or share Customer Personal Data, use it to train AI models, or use it for any purpose other than providing, securing and supporting the services. ModelRiver will not combine it with personal data from other sources except as permitted by the CCPA for a service provider.
4.4. Assistance. Taking into account the nature of the processing, ModelRiver will reasonably help Customer meet its obligations to respond to data subject requests, carry out data protection impact assessments, consult supervisory authorities, and keep personal data secure.
4.5. Data subject requests. If ModelRiver receives a request from a data subject about Customer Personal Data, it will refer the data subject to Customer and will not respond itself unless Customer authorizes it or the law requires it.
5. Subprocessors
5.1. Customer gives ModelRiver general authorization to engage Subprocessors. The current list is at modelriver.com/subprocessors.
5.2. ModelRiver imposes data protection obligations on each Subprocessor that are at least as protective as this DPA, and remains responsible for its Subprocessors' performance.
5.3. ModelRiver will update the list and notify owners of paid organizations at least 30 days before a new Subprocessor starts processing Customer Personal Data, except in an emergency where a shorter notice is needed to keep the services available or secure.
5.4. Customer may object to a new Subprocessor on reasonable data protection grounds by emailing [email protected] within that notice period. The parties will discuss it in good faith. If they can't resolve the objection, Customer may terminate the affected services and receive a pro-rata refund of prepaid fees for the remaining term.
6. Security Incidents
6.1. ModelRiver will notify Customer without undue delay, and in any case within 72 hours, after becoming aware of a Security Incident affecting Customer Personal Data.
6.2. The notice will describe, as far as known at the time, the nature of the incident, the categories and approximate number of data subjects and records affected, its likely consequences, and the measures taken or proposed. ModelRiver will provide more information as it becomes available, and will take reasonable steps to contain and remedy the incident.
6.3. Notification is not an admission of fault or liability.
7. Deletion and return
7.1. During the term, request logs are deleted after the retention period of Customer's plan, as described in the Privacy Policy, and Customer can export its project data and configurations.
7.2. After the Agreement ends, or on Customer's written request, ModelRiver will delete Customer Personal Data within 30 days, except data it must keep by law (for example billing records) or that remains in backups until they expire. Retained data stays protected by this DPA.
8. Audits
8.1. ModelRiver will make available the information reasonably necessary to demonstrate compliance with this DPA, including our security overview and written answers to reasonable security questionnaires.
8.2. If that information is not enough to demonstrate compliance, or a supervisory authority requires it, Customer may audit ModelRiver's compliance once a year, at its own cost, with at least 30 days' written notice, during business hours, without disrupting the services or accessing other customers' data, and subject to confidentiality obligations.
9. International transfers
9.1. ModelRiver processes Customer Personal Data in the United States, and its Subprocessors may process it in the countries listed on the Subprocessors page.
9.2. To the extent a transfer of Customer Personal Data from the European Economic Area, the United Kingdom or Switzerland to ModelRiver is not covered by an adequacy decision or another valid transfer mechanism, the Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914 ("SCCs") are incorporated into this DPA by reference, as follows:
- Module Two (controller to processor) applies where Customer is a controller, and Module Three (processor to processor) applies where Customer is a processor.
- In Clause 7, the docking clause does not apply. In Clause 9, Option 2 (general authorization) applies, with the notice period in Section 5.3. In Clause 11, the optional language does not apply.
- In Clauses 17 and 18, the SCCs are governed by, and disputes are resolved by the courts of, Ireland.
- Annexes I and II of this DPA complete Annexes I and II of the SCCs. The competent supervisory authority is the one determined under Clause 13.
9.3. For transfers from the United Kingdom, the International Data Transfer Addendum issued by the UK Information Commissioner applies together with the SCCs. For transfers from Switzerland, the SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner as a competent supervisory authority.
9.4. If the SCCs conflict with this DPA, the SCCs prevail.
10. CCPA
To the extent the CCPA applies, ModelRiver acts as Customer's service provider and will not: sell or share Customer Personal Data; retain, use or disclose it for any purpose other than the business purposes in the Agreement; retain, use or disclose it outside the direct business relationship with Customer; or combine it with personal information from other sources except as the CCPA permits. ModelRiver will comply with the CCPA and notify Customer if it can no longer meet its obligations.
11. General
11.1. This DPA lasts as long as ModelRiver processes Customer Personal Data under the Agreement.
11.2. Each party's liability under this DPA is subject to the limitations of liability in the Agreement, except where Data Protection Laws do not allow such limitation.
11.3. If this DPA conflicts with the Agreement, this DPA prevails for the processing of Customer Personal Data.
11.4. ModelRiver may update this DPA to reflect changes in Data Protection Laws or the services, without reducing the protection it gives. Material changes will be notified as described in the Agreement.
11.5. This DPA is governed by the law that governs the Agreement, except where the SCCs or Data Protection Laws require otherwise.
Annex I: Details of processing
Parties
- Data exporter: Customer, as identified in its ModelRiver account. Contact: the organization owner's email address. Role: controller (or processor).
- Data importer: ModelRiver Inc., a Delaware corporation. Contact: [email protected]. Role: processor (or subprocessor).
Categories of data subjects: Customer's end users and other individuals whose personal data Customer includes in requests sent through the services; Customer's personnel who use the services.
Categories of personal data: any personal data Customer chooses to include in prompts, messages, inputs and structured outputs; AI responses; request metadata (timestamps, IP addresses of API callers, identifiers Customer passes, such as session or customer IDs); webhook and callback payloads.
Special categories of data: none intended. Customer decides whether to send any; see Section 3.3.
Frequency of transfer: continuous, as Customer uses the services.
Nature and purpose of processing: receiving API requests, routing them to the AI providers Customer configures, applying Customer's workflow settings (including caching, guardrails, session memory and structured outputs), delivering results by API, WebSocket, webhooks and callbacks, logging requests for Customer's observability and billing, and providing support and security.
Duration: for the term of the Agreement. Request logs are kept for the retention period of Customer's plan; other data as set out in Section 7.
Subprocessors: as listed at modelriver.com/subprocessors, with the subject matter, nature and duration set out there.
Annex II: Technical and organizational measures
- Encryption in transit: HTTPS for all traffic; TLS with certificate and hostname verification between the application and the database.
- Encryption at rest: customer AI provider credentials encrypted with AES-256-GCM; ModelRiver API keys stored only as hashes; passwords hashed with bcrypt; two-factor secrets encrypted.
- Access control: role-based access (owner, admin, editor, viewer); two-factor authentication available to all users; every request checked against the caller's organization and project; production access limited to the personnel who need it.
- Network and application security: traffic filtered through Cloudflare; per-project and per-IP rate limiting; CSRF protection; outbound requests to customer-configured URLs blocked from private networks; signed webhooks.
- Data minimization: per-project option to stop saving request and response text; plan-based log retention; error reports scrubbed of request content before leaving our systems.
- Availability and resilience: daily database backups, checked after each backup and tested by restore drills; scripted deployments with automatic rollback; public status page.
- Monitoring and incident response: error monitoring and alerting; incidents handled and notified as described in Section 6.
- Vendor management: Subprocessors bound by data protection terms (Section 5).
More detail is on our security page.
Last updated: October 24, 2026