Data Processing Agreement
Version 1.1 — October 15, 2026
1. Parties and Roles
This Data Processing Agreement ("DPA") forms part of the agreement between the customer accepting the Velydian Terms of Service (the "Customer", acting as data controller) and MindtheGap Sarl (CHE-398.557.351), operating under the Velydian brand, incorporated in Geneva, Switzerland ("Velydian", acting as data processor), and applies whenever Velydian processes personal data on the Customer's behalf in the course of providing the Velydian verification services (the "Service").
2. Subject Matter, Duration, Nature and Purpose
Velydian processes personal data contained in documents, text, and URLs the Customer submits, solely to provide claim and citation verification and the related deliverables described in the Terms of Service. Processing lasts for the duration of the Customer's use of the Service and ends in accordance with Section 9. Velydian processes such data only on the Customer's documented instructions — submitting content for verification constitutes the instruction — unless processing is required by law, in which case Velydian will inform the Customer before processing unless the law prohibits it.
3. Categories of Data and Data Subjects
- Data categories: any personal data contained in Customer-submitted documents, text, or source URLs (which the Customer controls); account and contact data (name, email); billing metadata; technical usage data.
- Data subjects: the Customer's users, and any individuals referenced in the content the Customer submits.
Document handling. When the Customer runs a check, the document's text is sent over an encrypted connection to Velydian's servers and AI services in Switzerland and the EU. To find evidence, short search queries built from the claims are sent to web and scholarly search services. Document content and results are deleted automatically about 24 hours after the check; source links and summary data are kept.
4. Processing Locations
- Storage: all Customer data stored by Velydian is stored exclusively in Switzerland (AWS, Zurich region, eu-central-2).
- AI processing: AI inference runs in Switzerland and the EU via AWS Bedrock; embedding computation uses Microsoft Azure.
- Switzerland holds an EU adequacy decision; transfers between Switzerland and the EU/EEA proceed on that basis. Where a subprocessor processes personal data outside Switzerland or the EEA, Velydian ensures appropriate safeguards (adequacy decision or standard contractual clauses).
5. Security
Velydian implements appropriate technical and organizational measures under Art. 32 GDPR and Art. 8 Swiss FADP, including: encryption in transit (TLS 1.2+); encryption at rest on Swiss infrastructure; role-based access controls and least-privilege credentials; isolated per-account data; and no use of Customer data for AI model training.
6. Confidentiality
Velydian ensures that persons authorized to process personal data are bound by confidentiality obligations, contractual or statutory.
7. Subprocessors
The Customer grants general authorization for the following subprocessors. Velydian will give at least 30 days' notice of intended additions or replacements (via this page and, for account holders, by email), during which the Customer may object on reasonable data-protection grounds; if no resolution is found, the Customer may terminate the affected Service. Velydian remains fully liable for its subprocessors' performance.
| Subprocessor | Purpose | Location |
|---|---|---|
| Amazon Web Services (AWS) | Infrastructure and storage; AI inference via AWS Bedrock | Switzerland (storage); Switzerland and EU (inference) |
| Microsoft Azure | Embedding computation | European endpoints |
| Cloudflare | Fetching publicly accessible source URLs during verification | Global edge (public URLs and request metadata only — never Customer documents) |
| Bright Data | Fallback proxy for fetching publicly accessible sources | Global (public URLs and request headers only) |
| Resend | Transactional email | EU/US (account email only) |
| Sentry | Error monitoring | EU/US (diagnostic data; no document content) |
Payment processing is performed by Stripe as an independent controller and is governed by Stripe's own terms and privacy policy.
8. Assistance and Breach Notification
- Velydian will assist the Customer, insofar as possible and taking into account the nature of the processing, in responding to data-subject requests (access, rectification, erasure, portability, restriction, objection) and in meeting the Customer's obligations under Art. 32–36 GDPR.
- Velydian will notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data, providing the information reasonably required for the Customer's own notification obligations.
9. Retention, Deletion and Return
- Document content and verification results are deleted automatically about 24 hours after the check; source links and summary data are kept.
- Upon termination of the Service or on the Customer's written request, Velydian will delete or return all personal data processed on the Customer's behalf, unless retention is required by law (e.g., billing records under Swiss commercial law).
10. Audit and Information
On written request, no more than once per year, Velydian will make available the information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits conducted by the Customer or an agreed independent auditor, at the Customer's expense, with reasonable notice, and without access to other customers' data or Velydian's proprietary technology.
11. General
- In case of conflict between this DPA and the Terms of Service regarding the processing of personal data, this DPA prevails.
- Liability under this DPA is subject to the limitations in the Terms of Service to the extent permitted by applicable data-protection law.
- This DPA is governed by Swiss law; place of jurisdiction is Geneva, Switzerland.
- Velydian may update this DPA; material changes will be notified to account holders and reflected in the version and date above.
12. Contact
MindtheGap Sarl (operating as Velydian)
Geneva, Switzerland
CHE-398.557.351
contact@velydian.ai