Data Processing Agreement
Zuletzt aktualisiert: 8. November 2026
Diese Dokumente liegen auf Englisch und Italienisch vor; angezeigt wird die englische Fassung.
This agreement applies when you (the "customer") send personal data to the VigiMod API, usually messages written by the members of your community. For that data you are the controller and VigiMod is your processor. It forms part of the Terms of Service and applies for as long as you use the API.
1. What is processed
| Subject and purpose | Scoring messages for content moderation and returning the scores to you. |
|---|---|
| Nature | Automated analysis of the content you send in each request; nothing else. |
| Data | Text of the message, previous messages sent as context, your rules, and an optional user identifier for spam detection. The content may incidentally contain any kind of personal data, including special categories, depending on what people write. |
| Data subjects | The people whose messages you send (typically members of your community) and people mentioned in them. |
| Duration | Only the time needed to answer the request. If a user identifier is sent, a normalized copy of the text stays in memory for up to 60 seconds to detect repeated messages, then it is deleted. Nothing is written to disk or logs. |
2. Our commitments as processor
- We process the data only to answer your requests, which are your documented instructions, and for nothing else. We never use it to train models, for analytics or for advertising. If we believe an instruction breaks data protection law, we will tell you.
- Everyone who can access the systems is bound by confidentiality.
- We apply appropriate technical and organizational security measures (art. 32 GDPR): encryption in transit, no storage of the content, hashed keys, access limited and protected with two-factor authentication.
- We help you, as far as we reasonably can, to answer requests from data subjects and to meet your obligations on security, breach notification and impact assessments. Since we keep no content, there is normally nothing for us to retrieve or delete.
- We notify you without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting your data.
- At the end of the service nothing remains to be deleted or returned, as the content is never stored.
- We make available the information needed to show compliance with this agreement and allow reasonable audits, on request to privacy@vigimod.com, with reasonable notice and confidentiality.
3. Sub-processors
You authorize us to use these sub-processors: Hugging Face, Inc. (USA), which hosts the API. We impose on them data protection obligations equivalent to these. We will announce any new sub-processor at least 30 days in advance (by email or in the dashboard); if you object on reasonable grounds and we cannot find a solution, you can stop using the API and delete your account.
4. Transfers outside the EU
Where processing involves a transfer to a country without an adequacy decision, it relies on the EU-US Data Privacy Framework when the recipient is certified, or on the Standard Contractual Clauses approved by the European Commission (Decision 2021/914).
5. Your commitments as controller
You make sure you have a lawful basis to send the data, that the people concerned are informed that their messages are checked by an automated moderation service, and that you only send what is needed for moderation.