Data processing addendum BETA

This addendum applies when you, as controller, send personal data to the NutrientGraph API and ZAPPIT AI S.à r.l. processes it for you, as required by Article 28 of the GDPR. It forms part of the terms of service.

1. When it applies

Most calls contain no personal data (product codes, dates, foods). If a request does contain personal data, for example names inside free-text fields or entry references that identify a person, we process it only to answer the request.

2. Subject matter, nature and duration

Processing of request data to compute and return API responses, for the duration of the agreement. We do not store request bodies; usage records contain no request content.

3. Our obligations

• Process personal data only on your documented instructions, which are the API requests you send and these terms.
• Ensure that people authorised to process it are bound by confidentiality.
• Apply appropriate technical and organisational measures (below).
• Assist you with data subject requests and with your obligations under Articles 32 to 36 GDPR, as far as the processing allows.
• Notify you without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting your data.
• Delete or return personal data at the end of the service, unless law requires us to keep it.
• Make available the information needed to demonstrate compliance and allow audits by you or an auditor you appoint, on reasonable notice and at most once a year, except after a breach.

4. Sub-processors

You authorise these sub-processors: Cloudflare, Inc. (hosting, API, storage, bot protection), Resend (transactional email, account data only) and Stripe (payments, account data only). We will announce new sub-processors at least 30 days in advance; you may object, and if we cannot address the objection you may terminate.

5. Security measures

• Encryption in transit (TLS) for every request.
• API keys and abuse identifiers stored only as salted or peppered hashes.
• No storage of request bodies; access to production restricted to named operators.
• Dependencies and datasets versioned; changes reviewed before release.

6. International transfers

Where sub-processors process data outside the EEA, transfers rely on the EU-U.S. Data Privacy Framework or on the European Commission's standard contractual clauses.

7. Liability and precedence

Liability follows the terms of service. If this addendum conflicts with the terms on personal data, this addendum prevails.

Version for the NutrientGraph beta. NutrientGraph is a trade name of ZAPPIT AI S.à r.l.