Is ModelRiver GDPR-compliant, and can I get a DPA?
Yes. Our Data Processing Agreement (DPA) covers GDPR, UK GDPR, the Swiss FADP and CCPA. It applies automatically when you use ModelRiver, and you can ask for a countersigned copy.
Do I need to sign anything?#
No. By using ModelRiver under our terms, the DPA is in place. If your legal team needs a signed copy, email team@modelriver.com.
What role does ModelRiver play?#
Under GDPR, you're the controller and ModelRiver is your processor. Under CCPA, ModelRiver is a service provider. We process your data only to provide, secure and support the service, and we don't sell it or use it to train AI models.
My data is in the EU but ModelRiver is hosted in the US. Is that allowed?#
Yes, with the right safeguards. The DPA includes the EU Standard Contractual Clauses (Modules 2 and 3) and the UK Addendum for transfers to the United States.
What happens if there's a data breach?#
We'll notify you without undue delay and within 72 hours of becoming aware of it, so you can meet your own reporting duties.
How do I handle a data subject request?#
- Seeing what's stored about someone: read their sessions in the console or through the Sessions API, and their requests in Request Logs.
- Deleting someone's conversation data: delete sessions in the console or through the Sessions API, and email us to delete request logs (done within 7 business days).
- Your own account: email us to close it; personal data is removed within 30 days.
What about the AI providers?#
Providers you connect with your own keys aren't covered by our DPA. Your own agreement with each provider applies, so check its data terms too.