For customers who accepted a previous version of this DPA, version 2.0 takes effect on 11 November 2026. Until then, the previous version continues to apply to them. Previous versions remain available at weflayr.com/dpa/archive.
This Data Processing Agreement (the "DPA") forms part of the Weflayr Terms of Service (the "Terms") between Weflayr SAS ("Weflayr", "we", "Processor") and the customer accepting them ("you", "Controller"). It applies where we process personal data on your behalf in providing the Service.
It applies in the version current at the time of your use, and does not require separate signature to be binding. Where you have signed a separate data processing agreement with us, that agreement applies in place of this one for as long as it remains in force. Where this DPA and the Terms conflict on a data protection matter, this DPA prevails.
Terms defined in the Terms have the same meaning here. "GDPR" means Regulation (EU) 2016/679. "Personal Data", "processing", "controller", "processor", "sub-processor", "data subject" and "personal data breach" have the meanings given in the GDPR.
1. Roles of the parties
You act as controller for the personal data contained in Customer Data. We act as processor, and process it only on your documented instructions.
Where you are yourself a processor acting for another controller, you confirm that you have the authority of that controller to appoint us as a sub-processor on these terms.
We act as controller for the personal data of your administrators, users and billing contacts that we process to operate our own business, for example to authenticate them, to take payment for Credits, to provide support and to send service communications. That processing is described in our Privacy Policy and is not governed by this DPA.
2. Instructions
We process Customer Data only:
- to provide, secure and maintain the Service in accordance with the Terms
- in accordance with your further documented instructions, where they are consistent with the Terms
- where required by European Union or Member State law, in which case we will inform you before processing unless that law prohibits it
Your acceptance of the Terms, and your configuration of the Service, constitute your documented instructions. This includes:
- your decision whether to keep capture of prompt and completion content enabled in the SDK, and whether to keep content logging enabled on each Gateway API key
- the list of models you approve, which determines the model providers to which the Gateway may forward your requests
- your routing strategy, which the routing engine applies to select a model within that list for each request
- the candidate models you allow us to test in benchmarks
- your decision to register Provider Credentials, which instructs us to call the providers concerned on your own account
- your decision to connect a billing provider
Each request your application sends through the Gateway is an instruction to transmit its content to the approved model selected by the routing engine and to return the response.
We will inform you if, in our opinion, an instruction infringes the GDPR.
3. Subject matter and details of processing
The subject matter, duration, nature and purpose of the processing, the categories of personal data and of data subjects, and the applicable retention periods, are set out in Annex A.
4. Duration
This DPA applies for as long as we process Customer Data on your behalf, and survives termination of the Terms until deletion is complete in accordance with clause 12.
5. Confidentiality
We ensure that every person authorised to process Customer Data is bound by an obligation of confidentiality, and that access is limited to those who need it to perform their role. Access to prompt and completion content is restricted to a named group, requires a recorded reason, and is logged.
6. Security
We implement the technical and organisational measures set out in Annex C, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risks to data subjects.
We may update those measures, provided the level of protection is not reduced. The current version is always the one published with this DPA.
7. Sub-processors
You grant us a general authorisation to engage the sub-processors listed in Annex B. Annex B distinguishes infrastructure sub-processors, which process Customer Data for every customer, from model providers, which process your Customer Data only when you approve one of their models for the Gateway or allow us to test one of their models in a benchmark.
We impose on each sub-processor, by written contract, data protection obligations equivalent to those in this DPA, and we remain fully liable to you for their performance.
Infrastructure sub-processors. We will give you at least thirty days notice before engaging a new infrastructure sub-processor listed in Part 1 of Annex B or replacing an existing one, by email or through the Service. If you object on reasonable data protection grounds within that period, we will either propose an alternative or you may terminate the affected part of the Service without penalty.
Model providers. The notice above does not apply to the model providers listed in the Model Catalogue referred to in Part 2 of Annex B, including any model provider or model added to it later . A model provider processes your Customer Data only once you have selected one of its models for your approved list or your benchmark list. New model providers and models are never added to those lists automatically. Your selection of a model constitutes your specific prior authorisation, within the meaning of Article 28(2) of the GDPR, for the provider of that model to process your Customer Data under the conditions published for it. The current catalogue, with each model's provider, hosting region and the provider's published position on retention and training, is published at weflayr.com/models and kept current. Where the hosting region of a model you have selected, or its provider's published position on retention or training, changes, we inform you without undue delay after becoming aware of it, and you may remove the model from your lists with effect for subsequent requests.
8. Model providers and Bring your own keys
Gateway requests paid from Credits. When the Gateway, on the decision of the routing engine, forwards a request to a model provider on our own account, that provider acts as our sub-processor under clause 7 and Annex B. We transmit the request content, receive the response, and return it to you. The provider processes the content under the written terms we have with it, and we publish its position on retention and training in the Model Catalogue. We confirm the hosting region of each model marked as EU-hosted with the provider before publishing it.
Gateway requests using your Provider Credentials. When you register your own API keys for a model provider and the Gateway calls that provider on your account, the provider processes your Customer Data as your own processor, under the agreement between you and the provider, and not as our sub-processor. Our role is limited to transmitting the request and response, applying your routing rules, recording call metadata and, where logging is on, content, and holding your Provider Credentials securely. You remain responsible for the data processing terms you have with the provider, for any transfer mechanism those terms rely on, and for the provider's handling of your data.
Provider Credentials. We store Provider Credentials encrypted in a managed secret store, use them solely to make the requests your application sends through the Gateway, and never use them for benchmarking, for other customers or for any purpose of our own. We delete them when you remove them or close your account.
Benchmarks. Candidate models tested in benchmarks are called on our own account. The providers concerned are our sub-processors under clause 7, and your benchmark settings determine which of them receive your samples.
What our controls do and do not cover. Content logging and the storage of Customer Data in the European Union govern our own processing. They do not change what a model provider does with the content it receives, which follows the model you approve. The control that restricts which providers your Customer Data reaches is your approved model list, and, for benchmarks, your candidate model list.
9. Assistance with data subject rights
Taking into account the nature of the processing, we assist you by appropriate technical and organisational measures, insofar as possible, in fulfilling your obligation to respond to requests from data subjects exercising their rights.
If we receive a request directly from one of your data subjects, we will not respond to it substantively. We will forward it to you without undue delay.
Where capture or logging of prompt and completion content is disabled in your configuration, we hold no such content for the keys concerned and are unable to search for, extract, rectify or delete it. You acknowledge that this is a consequence of the configuration you have selected. Content already forwarded to a model provider is subject to that provider's own retention, and we assist you in directing a request to the provider where it is our sub-processor.
10. Assistance with your other obligations
Taking into account the nature of the processing and the information available to us, we assist you in complying with your obligations under Articles 32 to 36 of the GDPR, including security of processing, personal data breach notification, data protection impact assessments and prior consultation. The information published at weflayr.com/models about each model, its hosting region and its provider's position on retention and training is provided to support your assessments.
11. Personal data breach
We notify you without undue delay, and in any event within forty-eight hours, after becoming aware of a personal data breach affecting Customer Data, including a compromise of Provider Credentials.
The notification is sent to the security contact you have nominated or, failing that, to your registered account email address. It describes the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed, to the extent then known, and is supplemented as the investigation progresses.
We cooperate with you and with the relevant supervisory authorities, and provide reasonable assistance with your own notification obligations.
12. Deletion and return
On termination of the Terms, we delete Customer Data within thirty days. Provider Credentials are deleted immediately. Encrypted backups roll off within a further thirty days.
If you ask us before that period expires, we will return Customer Data to you in a commonly used machine-readable format. We will confirm deletion in writing on request.
We retain Customer Data beyond these periods only where European Union or Member State law requires it, in particular the accounting records referred to in Annex A.
13. Audits and information
We make available to you the information necessary to demonstrate compliance with Article 28 of the GDPR.
We satisfy your audit rights by providing, under a non-disclosure agreement, our then-current independent audit report, our security documentation, and responses to reasonable written questions, no more than once in any twelve month period unless a personal data breach or a supervisory authority requires otherwise.
An on-site audit may be conducted only where required by law, where the information above is demonstrably insufficient, or where agreed in a master services agreement signed by us. It is conducted at your cost, during business hours, with at least thirty days notice, by an independent auditor bound by confidentiality who is not a competitor of Weflayr, and in a manner that does not disrupt our operations or the confidentiality of other customers' data.
14. International transfers
The Service, the Gateway and the analytical store are hosted in the European Union. All Customer Data stored by us is stored there.
Model inference takes place where the model is hosted. We publish a hosting region for every model in the Model Catalogue. Models published as EU-hosted are served from European Union regions of the cloud platforms or providers concerned. Models published as global may be served by the provider from any region in its own infrastructure. To keep inference within the European Union, approve only EU-hosted models and restrict benchmarks to them.
Where Customer Data is transferred to a country outside the European Economic Area that is not subject to an adequacy decision, the transfer is governed by the Standard Contractual Clauses adopted by the European Commission in Decision 2021/914, module three, processor to sub-processor, incorporated into our agreements with the sub-processors concerned, together with the supplementary measures described in Annex C. Where a sub-processor established in the United States is certified under the EU-US Data Privacy Framework, the transfer relies on the adequacy decision of 10 July 2023 for as long as it remains in force, with the Standard Contractual Clauses as fallback. A copy of the relevant clauses is available on request at privacy@weflayr.com.
Transfers made under your own Provider Credentials are made under your agreement with the provider and are your responsibility.
15. Liability
Our liability under this DPA is subject to the aggregate limitation of liability set out in the Terms. This DPA does not create a separate, additional or increased cap.
16. Governing law
This DPA is governed by French law. The competent courts of Paris have exclusive jurisdiction, without prejudice to the jurisdiction provisions of any applicable Standard Contractual Clauses.
Annex A. Details of processing
Subject matter. The provision of the Weflayr platform, being the measurement and attribution of the cost and margin of the AI calls made by your application, the benchmarking of candidate models on your traffic, and the routing of your production AI requests, by the routing engine, to the models you approve.
Duration. For as long as your account is open, plus the deletion periods set out below.
Nature and purpose. Collection, recording, storage, structuring, analysis, transmission to model providers for inference and for benchmarking, and erasure, for the purpose of providing the Service.
Categories of data subjects. Your administrators and users of the Service. Your own end customers and their users, where their data appears in Customer Data.
Categories of personal data.
| Category | Description |
|---|---|
| Call metadata | The customer or user identifier you choose to pass, the feature name or tag, the business context you pass for routing, the model requested and the model served, the routing rule applied, token counts, computed cost, latency, and a timestamp. Where you pass an opaque identifier, as we recommend, this category contains no direct identifier. |
| Prompt and completion content | The input messages, tool definitions and output messages of the AI calls your application makes, whether captured by the SDK or transmitted through the Gateway. Transmitted to the approved model in every Gateway request. Stored only where capture or logging is on. May contain personal data, depending on what your application sends. |
| Benchmark samples and results | Samples of the above transmitted to candidate model providers, the outputs returned, and the scores produced by the automated judges. |
| Revenue records | Amounts attributed to your end customers, uploaded by you or read from your connected billing provider. Where read from a billing provider, may include the names or email addresses of your end customers. |
| Provider Credentials | The API keys of third-party model providers that you register with us. Not personal data in themselves, but listed here because they give access to your data at the provider. |
| Account and configuration data | Names, email addresses and roles of your administrators and users, organisation and project configuration, approved models, routing rules, logging settings, API key identifiers. |
| Operational data | Application logs, metrics and error reports, and security and access logs. |
Special categories of data. The Service is not intended to process special category data within the meaning of Article 9, criminal conviction data within the meaning of Article 10, payment card data, government identifiers or children's data. You must not send such data, whether through the SDK or through the Gateway.
Retention. All Customer Data is stored in the European Union.
| Category | Retention |
|---|---|
| Call metadata, cost, routing decisions and revenue data | For as long as your account is open, then deleted within 30 days of its closure |
| Prompt and completion content, where capture or logging is on | For as long as your account is open, then deleted within 30 days of its closure |
| Benchmark samples, provider outputs and judge results | Same as prompt and completion content |
| Provider Credentials | Until you delete them or close your account; deleted immediately on closure |
| Account, configuration and user information | For as long as your account is open, then deleted within 30 days of its closure |
| Security and access logs | 12 months |
| Credit purchases, consumption records, invoices and accounting documents | 10 years, as required by article L123-22 of the French Commercial Code |
Encrypted backups are retained for 30 days and replicated within the European Union.
Annex B. Sub-processors
Part 1 lists our infrastructure sub-processors. Model providers are listed in the Model Catalogue referred to in Part 2.
Part 1. Infrastructure sub-processors
Engaged for every customer.
| Sub-processor | Location of processing | Purpose |
|---|---|---|
| Amazon Web Services EMEA SARL | eu-central-1, Germany | Hosting, compute, storage, key and secret management, logging, and model inference through Amazon Bedrock where you select a model accessed through it. |
| ClickHouse, Inc. | European Union | Analytical database |
| Auth0, part of Okta, Inc. | European Union | Authentication of users of the Service |
| Functional Software, Inc. (Sentry) | European Union | Application error monitoring |
| Stripe Payments Europe, Ltd. | European Union and United States | Processing of card payments for Credits, invoicing, fraud prevention; Stripe receives billing contact data, never prompt or completion content |
Part 2. Model providers
Model providers are listed in our model catalogue at weflayr.com/models (the "Model Catalogue"), which forms part of this Annex B. For each model, the Model Catalogue states its provider, the entity contracting with us, its hosting region, the provider's published position on retention and training, and a link to its Model Terms. The Model Catalogue shows the date of its last update, and previous versions are available on request at privacy@weflayr.com.
A model provider processes your Customer Data only once you have selected one of its models for your approved list or your benchmark list, and only for requests paid from your Credits. Changes to the Model Catalogue are governed by clause 7 and are not subject to the notice period.
Annex C. Technical and organisational measures
Organisation of information security. An information security management system aligned with ISO/IEC 27001 and SOC 2 Type II. Security policies approved annually by management and accepted by all personnel. Confidentiality obligations in every employment and contractor agreement. Security awareness training on hire and annually. Continuous automated control monitoring.
Access control. Federated identity with mandatory multi-factor authentication. Role-based, least-privilege permissions. Administrative access to production requires an individual VPN certificate. Access to prompt and completion content restricted to a named group, recorded against a reason, and logged. Access reviewed periodically and revoked within one business day of a departure.
Logical isolation. Each customer project has its own dedicated analytical database, so that no query can span two customers' data. Every API request is authenticated and scoped to the caller's organisation and project. Routing rules, approved model lists and Provider Credentials are scoped to the organisation that configured them.
Encryption and secrets. Data encrypted in transit using TLS 1.2 as a minimum. Data encrypted at rest, including the application database, the analytical store and object storage. Keys managed in a managed key service with rotation. Secrets, including Provider Credentials and connected integration keys, held in a managed secret store, decrypted only in memory at the time of the request, and never written to logs or committed to source code.
Network security. Compute and data resources deployed in private subnets. A single internet-facing load balancer. Firewall rules defined by explicit business justification. Outbound access restricted to allowlisted model provider endpoints.
Secure development. Mandatory peer review before merge, enforced by branch protection. Automated dependency scanning, static analysis and secret scanning on every change. Segregated development environment with its own database. Infrastructure declared as code.
Monitoring and incident response. Threat detection across compute, database, storage and network. Centralised logging with restricted access; request and response content is never written to application logs. Alerting to a monitored channel. A documented incident response plan, with notification to affected customers within forty-eight hours.
Resilience. Automated backups of the application database and the analytical store, replicated within the European Union. Restoration tested at least annually. Gateway failover operates only within the customer's approved model list.
Vendor management. Assessment of every provider before engagement, review of independent assurance reports, a written data processing agreement with each, and verification of each model provider's published retention, training and hosting region position before a model is listed.
Supplementary measures for transfers. Encryption in transit to every provider; transmission limited to the content of the request concerned; no persistent storage of Customer Data outside the European Union by us; publication of each provider's position so that you can confine your traffic to EU-hosted models.
Physical security. Weflayr operates no data centre. Physical and environmental security of hosting facilities is the responsibility of the infrastructure providers, verified through their independent assurance reports. Personnel access company resources from devices subject to full disk encryption, automatic screen lock and endpoint protection, monitored continuously.
Questions about this DPA: privacy@weflayr.com
Weflayr SAS, 12 place Henri Bergson, 75008 Paris, France. RCS Paris 103 332 649.