1. About this addendum
1.1 This addendum applies to the processing of Personal Data in the Taxxa Developer API (the "API"). It adds to the Data Processing Agreement (the "DPA") and is part of the Developer API Terms.
1.2 The DPA applies to the API. If this addendum and the DPA do not agree about the API, this addendum applies. Words with capital letters that this addendum does not define have the meaning that the DPA gives them.
2. Roles
2.1 For Personal Data in API requests, the Subscriber is the Controller, or a Processor for its own customers. Taxxa AI is the Processor, or the sub-processor.
2.2 Taxxa AI processes API requests only to give the answer or the search result. Taxxa AI does not use API requests for its own purposes or to train AI models.
2.3 Usage records do not contain the content of requests. Taxxa AI processes them for billing, security, support and accounting, as the Privacy Policy describes.
3. The processing
3.1 The Subscriber decides which Personal Data it puts in queries and messages. The Subscriber sends Personal Data only when it needs to.
3.2 Taxxa AI processes a request only for the time that it takes to respond. The API does not store queries, messages, search results or answers after it responds.
3.3 Taxxa AI keeps usage records, for example the API key, the endpoint, the time and the amounts, for as long as accounting law requires.
4. Location and sub-processors
4.1 Taxxa AI processes API data in the EU or the EEA, or under section 5 of the DPA.
4.2 Taxxa AI uses the sub-processors in Annex 2 of the DPA for the API, including providers of hosting and AI models. Section 4 of the DPA applies to changes to the sub-processors.
5. Security
5.1 Annex 3 of the DPA applies to the API. API requests can read only the public knowledge base, not workspace documents or other customer data.
6. End of the API Terms
6.1 The API does not keep request content, so there is nothing to return or delete when the API Terms end. Section 9.2 of the DPA applies to all other Personal Data.