Laster katalogen …
Laster katalogen …
Dette dokumentet er kun publisert på engelsk.
Last updated 12 October 2026 · Effective 15 October 2026
1.1 This Data Processing Agreement ("DPA") is between Stav.ai AS, org. no. 937 371 853, Bekkelagsterrassen 9D, 1177 Oslo, Norway ("Stav"), and the Customer that has accepted Stav's Terms of Service ("Terms"). It forms part of the Terms and applies to every workspace from the moment the Terms are accepted. Stav also signs it on request.
1.2 This DPA applies when Stav processes personal data contained in Customer Content (prompts, files, inputs and outputs) on behalf of the Customer ("Customer Personal Data"). For that data the Customer is the controller and Stav is the processor. Where the Customer is itself a processor for another controller, Stav is a sub-processor and the Customer is responsible for passing on the relevant obligations.
1.3 This DPA does not cover personal data that Stav processes as controller, such as account, billing and support data, request metadata used for billing and security, and website data. That processing is described in Stav's Privacy Policy.
1.4 Terms used here have the meaning given in Regulation (EU) 2016/679 ("GDPR"), as incorporated in Norwegian law. If this DPA and the Terms conflict on data protection, this DPA applies.
2.1 Stav processes Customer Personal Data only on the Customer's documented instructions. These are the Terms, this DPA, and the choices the Customer makes in the Service, including its workspace, API key and router policies, prompt capture settings and retention periods. If EEA or Norwegian law requires Stav to process Customer Personal Data in any other way, including a transfer, Stav informs the Customer before processing, unless that law prohibits it on important grounds of public interest.
2.2 Stav will tell the Customer if, in its opinion, an instruction infringes data protection law, unless the law prohibits this.
2.3 Stav does not use Customer Personal Data to train or fine-tune models, does not sell it, and does not use it for its own purposes.
Stav ensures that everyone it authorises to process Customer Personal Data is bound by confidentiality. Access to captured prompt content follows the access rules in the Service. Stav staff read captured content only when the Customer has granted support access for a specific case.
Stav implements the technical and organisational measures in Annex 2, which it may improve over time without reducing the overall level of protection.
5.1 The Customer gives Stav general written authorisation to engage the sub-processors listed at stav.ai/compliance#sub-processors. They are the Inference Providers that serve requests and the platform vendors that run the Service.
5.2 Inference Providers, Provider Endpoints and models change continuously, and handling that is part of the Service. Stav may add or remove sub-processors at any time.
5.3 The list shows each sub-processor, what it does, where it processes and the date it was listed. When Stav adds and activates a new Inference Provider, it lists it and notifies the workspace owner by email no later than when the Inference Provider starts serving requests. A new Inference Provider serves the Customer's requests automatically when it meets the requirements in the Customer's workspace policy. The Customer can exclude any Inference Provider or its country in its policy at any time, with immediate effect, and this is how the Customer objects to an Inference Provider. For a new platform vendor, Stav notifies the workspace owner by email at least 30 days before it processes Customer Personal Data. Removals take effect when Stav updates the list.
5.4 Stav binds each sub-processor by a written agreement that imposes data protection obligations meeting the requirements of Article 28(3) GDPR. Stav remains responsible to the Customer for its sub-processors' performance of those obligations.
5.5 If the Customer objects to a sub-processor on reasonable data protection grounds, it can block that Inference Provider or its country in its policy, which stops routing to it with immediate effect, or close its workspace. On closure, unused purchased credits are refunded.
6.1 The Customer's policy decides where its requests are processed. With a compute country or region set, requests are served only from Provider Endpoints that compute there according to the facts Stav holds. Those facts are based on the Inference Providers' own information.
6.2 Where a sub-processor processes Customer Personal Data outside the EEA, or is subject to the law of a country outside the EEA, the transfer is based on an EU adequacy decision (including the EU-U.S. Data Privacy Framework where the recipient is certified) or on the Standard Contractual Clauses in the sub-processor's data processing agreement. The sub-processor list states the basis for each.
The Customer shall not send special categories of personal data (Article 9 GDPR) or personal data relating to criminal convictions and offences (Article 10) through the Service, unless Stav has agreed to it in writing for a specific use. Several Inference Providers do not permit such data under their own terms, and Stav agrees only where the Inference Providers that can serve the Customer's requests permit it. Sending such data without that agreement is a breach of this DPA and the Terms.
8.1 Taking into account the nature of the processing, Stav assists the Customer with requests from data subjects, data protection impact assessments and prior consultations. Stav does not store prompt content unless the Customer has switched on prompt capture. The Customer can find, export and delete captured content and request metadata itself in the Service.
8.2 Stav passes on to the Customer, without undue delay, any request it receives directly from a data subject about Customer Personal Data, and does not answer it itself unless the Customer instructs it to.
9.1 Stav notifies the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and gives the information it has about the nature of the breach, the data and data subjects concerned, the likely consequences and the measures taken. Stav provides further information as it becomes available.
9.2 Notices go to the email address of the workspace owner. Stav's contact for breaches and data protection questions is support@stav.ai.
10.1 Captured prompt content is deleted when the retention period set by the Customer ends, and immediately when a member is removed from the workspace. Request and routing logs are kept for 90 days and the audit log for 24 months.
10.2 When the Customer closes its workspace, Stav deletes Customer Personal Data within 30 days, except where the law requires Stav to keep it. Before closure, the Customer can export its request log and audit log.
11.1 Stav makes available the information necessary to demonstrate compliance with Article 28 GDPR, including this DPA, Annex 2, the sub-processor list and, where available, sub-processors' own certifications. Sub-processors' own data processing agreements are often confidential, and Stav does not share them, but describes their main terms on request.
11.2 If that information is not sufficient, the Customer may audit Stav once a year, and after a personal data breach affecting Customer Personal Data, on 30 days' written notice, at its own cost and under confidentiality. A supervisory authority may audit at any time.
Where the Customer routes requests to machines it operates through Stav Tunnel, Stav processes Customer Personal Data only in transit through its relay and stores none of it beyond request metadata. The Customer's own systems remain the Customer's responsibility. The Stav Tunnel software is provided under the Terms.
This DPA applies for as long as Stav processes Customer Personal Data on the Customer's behalf. Liability under this DPA is governed by the Terms, except where data protection law provides otherwise.
The current list is at stav.ai/compliance#sub-processors and forms part of this DPA.