Version 2026-11. It forms part of the AIR-Core Terms and Conditions of Use and is accepted with them. Customers who need a signed version can request it at info@air-institute.com (opens your email app).
Parties
- Controller (“Customer”): the natural or legal person who owns the Organization in AIR-Core, identified in its account.
- Processor (“AIR Institute”): INSTITUTO INTERNACIONAL DE INVESTIGACIÓN EN INTELIGENCIA ARTIFICIAL Y CIENCIAS DE LA COMPUTACIÓN, tax ID G37571627, Av. Santiago Madrigal, 39, 37003 Salamanca. DPO: contacto@delegado-lopd.es (opens your email app).
1. Purpose
AIR Institute processes on behalf of the Customer the personal data that the Customer or its Users put into AIR-Core (“Customer Personal Data”), for the sole purpose of providing the service described in the Terms. Annex I describes the processing.
2. Duration
This agreement lasts as long as the contract and, afterwards, until the data is deleted or returned under clause 12.
3. Instructions
3.1. AIR Institute processes the data only on documented instructions from the Customer. The following are instructions:
- the Terms and this agreement;
- the settings and actions the Customer and its Users carry out in AIR-Core: uploading or connecting data, training models, sharing dashboards, setting up alerts and webhooks, invoking AI Features, setting up BYOK, authorizing external MCP Applications;
- any other written instruction accepted by both parties.
3.2. If AIR Institute considers that an instruction infringes the GDPR or another rule, it will inform the Customer immediately and may suspend carrying it out.
3.3. If EU or Member State law requires AIR Institute to carry out different processing, it will inform the Customer beforehand, unless the law prohibits this.
4. Confidentiality and staff access
4.1. The persons authorized by AIR Institute to process the data are bound by a duty of confidentiality, by contract or by law, and receive training in data protection and security.
4.2. Staff do not access the content of Customer Personal Data except in these cases:
- (a) when access is necessary for the automated operation of the service;
- (b) to handle a support ticket with the Customer's express authorization, limited in scope and time;
- (c) for security reasons;
- (d) by legal obligation.
Access in cases (b) to (d) is logged.
5. Security
AIR Institute applies the measures in Annex II, appropriate to the risk (art. 32 GDPR), and may update them provided it does not lower the level of protection. The Customer is responsible for what depends on it:
- setting its Users' permissions;
- enabling source encryption where appropriate;
- protecting its credentials and tokens;
- deciding what it publishes in dashboards and public links.
6. Assistance to the Customer
Taking into account the nature of the processing, AIR Institute will help the Customer comply with:
- (a) the rights of data subjects. AIR-Core lets you view, rectify, export and delete data. If a data subject contacts AIR Institute, the request will be forwarded to the Customer within 5 working days at most and will not be answered directly unless instructed;
- (b) security, breach notification, impact assessments (DPIAs) and prior consultations, providing the information available to it.
Assistance that goes beyond what is reasonable, or that is due to causes attributable to the Customer, may be invoiced subject to a prior quote.
7. Sub-processors
7.1. The Customer grants a general authorization for AIR Institute to use the sub-processors in Annex III.
7.2. AIR Institute will inform the administrators by email, at least 30 days in advance, of the addition or replacement of sub-processors. The current list will be at [URL]. The Customer may object on reasonable grounds related to data protection within that period. If there is no viable alternative, the Customer may terminate the contract without penalty and with a refund of the unused part.
7.3. AIR Institute imposes on each sub-processor, by contract, data protection obligations equivalent to those of this agreement and is liable to the Customer for their compliance.
8. Services chosen by the Customer (not sub-processors)
The following recipients are not sub-processors of AIR Institute. Data is sent to them on the express instructions of the Customer or its Users:
- (a) Third-party AI providers in BYOK mode (OpenAI, Anthropic, Groq, Google Gemini or other compatible endpoints).
- (b) External MCP applications authorized by a User (for example Claude or ChatGPT).
- (c) Webhook destinations, external sources and connections, and recipients of email alerts set up by the Customer.
- (d) Analytics tools that the Customer sets up on public dashboards.
It is the Customer who decides to use those recipients. It is therefore the Customer's responsibility to:
- have the necessary legal relationship with them (for example, its own processing agreement);
- assess whether sending the data is lawful;
- if they are outside the EEA, have a safeguard for the transfer (art. 44 et seq. GDPR).
AIR Institute sends only what is necessary for each request and is not liable for the processing carried out by those third parties.
9. International transfers
9.1. Customer Personal Data is hosted and processed in the European Union:
- AWS eu-central-1 (Frankfurt);
- Amazon Bedrock with an EU inference profile, which uses only EU regions.
9.2. AIR Institute will not transfer the data outside the EEA except with one of these safeguards:
- (a) an adequacy decision, including the EU-US Data Privacy Framework for certified entities;
- (b) the Commission's standard contractual clauses (Decision (EU) 2021/914), with any appropriate supplementary measures.
This also applies to any remote support access by the sub-processor. Transfers under clause 8 are governed by what is set out there.
9.3. If an authority of a third country requests data, AIR Institute will act in accordance with clause 5 of the Privacy Policy and will inform the Customer unless legally prohibited.
10. Security breaches
10.1. AIR Institute will notify the Customer of any security breach affecting Customer Personal Data without undue delay, and in any case within 48 hours at most of becoming aware of it. The notification will be sent to the email of the administrators and of the owner of the Organization and will include, as far as they are known:
- the nature of the breach;
- the categories and approximate number of data subjects and records affected;
- the DPO's contact details;
- the likely consequences;
- the measures taken or proposed.
If not all the information is available, it will be provided in stages.
10.2. It is for the Customer, as controller, to notify the supervisory authority and the data subjects where appropriate (arts. 33 and 34 GDPR). AIR Institute will not do so on the Customer's behalf unless expressly instructed.
11. Information and audits
11.1. AIR Institute will make available to the Customer the information necessary to demonstrate compliance with this agreement: description of measures, sub-processor certifications (for example, AWS's ISO 27001 or SOC 2) and answers to reasonable questionnaires.
11.2. If that information is not enough, the Customer may carry out an audit, itself or through an independent auditor bound by confidentiality, under these conditions:
- 30 days' prior notice;
- at most once a year, except after a breach or at the request of an authority;
- during working hours and without affecting the security of other customers;
- at its own expense, unless a significant breach is found.
11.3. Sub-processors' facilities are audited through their reports and certifications.
12. End of processing: return and deletion
12.1. When the contract ends, clause 18 of the Terms (Data Act) applies:
- a transition period of up to 30 days;
- at least 30 days to retrieve the data in open formats;
- afterwards, deletion of all Customer Personal Data and certification of the deletion at the Customer's request.
12.2. Backups are deleted in their ordinary rotation cycle, within [35] days at most. Until then they remain encrypted and isolated and are not used.
12.3. Only the data that Union or Member State law requires to be kept will be retained, blocked, for the legal period.
12.4. For inactive free accounts, clause 16 of the Terms applies.
13. Other obligations of the processor
AIR Institute:
- (a) keeps a record of processing activities as a processor (art. 30.2 GDPR);
- (b) has appointed a DPO;
- (c) does not use Customer Personal Data for its own purposes, including training AI models. It only produces aggregate, anonymous statistics on use of the service, without the content of the data;
- (d) does not sell or transfer the data.
14. Obligations of the Customer
The Customer:
- (a) guarantees that the processing is lawful and that it has informed the data subjects and, where applicable, obtained their consent;
- (b) does not put in special categories of data or criminal data without a legal basis and without enabling appropriate measures (source encryption, restrictive permissions, no public dashboards);
- (c) carries out the DPIA where appropriate;
- (d) supervises the processing, and is responsible for its instructions and for the services in clause 8.
15. Liability
Each party is liable for its own breaches under art. 82 GDPR. Between the parties, the regime of clause 21 of the Terms applies.
16. Precedence
In matters of data protection, this agreement takes precedence over any other provision of the Terms.
Annex I. Description of the processing
| Element | Description |
|---|---|
| Nature | Hosting, storage, structuring, transformation, querying, statistical analysis, training and application of machine learning models, model explanation, visualization, disclosure to recipients set up by the Customer (alerts, webhooks, public dashboards), sending the necessary context to language models when AI Features are invoked, backup and deletion |
| Purpose | Providing AIR-Core to the Customer under the Terms |
| Categories of data subjects | Those determined by the Customer: for example, its customers, employees, patients, users, citizens, suppliers and contact persons. Also the Customer's Users as regards the content they create |
| Categories of data | Those determined by the Customer: identification, contact, financial, usage or sensor, location and other data. Special categories only if the Customer has a legal basis (clause 14.b) |
| Frequency | Continuous, for the duration of the contract |
| Location | EU (AWS eu-central-1, Frankfurt; Amazon Bedrock with an EU inference profile) |
| Retention | As decided by the Customer. On termination, clause 12 |
Annex II. Technical and organizational measures
| Area | Measure |
|---|---|
| Location and infrastructure | AWS eu-central-1 (Frankfurt). Data centres certified (ISO 27001, SOC 2) by AWS. Servers on a private network; only the load balancers are exposed (HTTPS) |
| Encryption in transit | TLS 1.2 or higher on the website, the API and the MCP server. HSTS. Outgoing webhooks signed with HMAC-SHA256 and protected against replay. |
| Encryption at rest | Credentials for external connections, source encryption keys and webhook secrets sealed with AES-256-GCM using a master key kept outside the database. Optional per-source encryption with your own key. BYOK keys encrypted. S3 with server-side encryption. |
| Model integrity | Signed models (HMAC). Exports signed with RSA-PSS-SHA256; tampering is rejected on loading or import |
| Customer access control | Organizations, workspaces and roles with granular permissions. Two-step verification. OAuth 2.1 tokens with PKCE, bound to resource and organization, with rotation and reuse detection. Tokens and codes stored as hashes |
| Internal access control | Least privilege. S3 access through an instance role limited to the platform's buckets. Secrets in restricted directories. Restricted administrative access |
| User credentials | Hashed and salted passwords. |
| Application security | Strict content security policy (CSP), CSRF protection, HttpOnly and Secure cookies, rate limits, reCAPTCHA at sign-up and login, blocking of private-network and metadata destinations in external sources, MCP server without delete tools and with human confirmation of changes proposed by the assistant |
| AI | Bedrock with an EU inference profile, with no retention or training by the provider. Per-user and global spending caps. AI activity log with credentials hidden |
| Availability and backups | Managed databases with automatic backups and snapshots before each change. S3 versioning on the data and model buckets. Documented change and rollback procedure |
| Logging and monitoring | Rotated application logs. User and AI activity logs. Health checks |
| Organizational | Appointed DPO. Staff training. Contractual confidentiality. Breach management procedure (detection, assessment, notice to the Customer within 48 h). Annual review of measures and sub-processors |
| Deletion | Immediate logical deletion on delete. Backup rotation within [35] days at most |
Annex III. Authorized sub-processors
| Sub-processor | Service | Data | Location | Safeguard |
|---|---|---|---|---|
| Amazon Web Services EMEA SARL (Luxembourg) | Hosting (EC2, Aurora, DocumentDB, ElastiCache, S3, load balancers, Global Accelerator), backups and Amazon Bedrock (Anthropic's Claude models, EU inference profile) | All Customer Personal Data | EU (Frankfurt; Bedrock inference in EU regions) | Data in the EU. AWS data processing agreement with SCCs. Amazon.com, Inc. certified under the DPF |
| Amazon Web Services EMEA SARL (Luxemburgo), servicio Amazon SES | Envío de los emails del servicio y de las alertas por email que configura el Cliente (pueden contener valores de sus datos) | Contenido de los emails y direcciones de los destinatarios | UE (Fráncfort, eu-central-1) | Data in the EU. AWS data processing agreement with SCCs. Amazon.com, Inc. certified under the DPF |
| [VERIFY: Cloudflare, Inc., only if it acts as a proxy] | Proxy, CDN and DDoS protection | Traffic in transit | Global | DPF and SCCs |
| [VERIFY: AIR Institute, own GPU infrastructure] | Own language models, if used | AI requests | [EU location] | Not a sub-processor (it is the processor itself); listed for transparency |
Not sub-processors for Customer Data:
- Stripe: processes only the Customer's billing data, as controller or as AIR Institute's processor for that purpose.
- Google reCAPTCHA and Google or GitHub as a login method: they process account data, not content.
- Mapbox: receives map tile requests from the browser, not the Customer's data.
- The services in clause 8.