Data Processing Addendum

You are the data controller for any personal information contained in requests you send to AI Foundry Inference. AI Foundry NZ Limited is the data processor for the purpose of executing those requests on your behalf.

All inference is performed on AI Foundry-owned hardware hosted in Datacom Datacentres in Auckland, New Zealand. Personal information you submit through the API is not transferred outside New Zealand by AI Foundry.

We use the following sub-processors to operate the service: Stripe (subscription billing — processes only billing identifiers, not API content); Vercel (marketing site hosting — does not handle API request content); 2Degrees (network transit to the Auckland datacenter). Inference itself runs on hardware we own and operate.

We do not retain the content of API requests or responses beyond the lifetime of the request needed to serve it. Operational metrics (timestamps, status codes, token counts, key identifiers) are retained for billing and abuse-prevention purposes for a maximum of 13 months.

The service is protected by NZ-controlled networking, OPNsense firewalls, isolated containers per inference worker, and TLS for all client connections. Customers are responsible for protecting their own API keys.

Because AI Foundry does not retain API content, we are typically unable to identify individual data subjects within prompt or completion data. If you receive a data subject request from an end user, you remain responsible for fulfilling it as the data controller.

We will notify customers at the billing email address at least 30 days before adding a material new sub-processor.

Data protection enquiries: contact@aifoundry.co.nz.