Legal / Data Processing Addendum
Data Processing Addendum
The processor terms that apply when you route personal data you are responsible for through the Service.
Version 1.3 · last updated 2 October 2026
This Addendum forms part of the Terms of Service and applies automatically where you use the Service to process personal data for which you are the data fiduciary under the Digital Personal Data Protection Act, 2023, or the controller under the GDPR or the UK GDPR. You do not need to sign anything for it to apply; if your compliance process needs a countersigned copy, write to support@topbilling.in and we will send one.
1. Roles
For the content of your requests and anything personal in it — your own users' data — you are the data fiduciary or controller and we are the data processor. For your own account, billing and usage data we are the data fiduciary in our own right, and the Privacy Policy governs it, not this Addendum.
2. Subject matter of the processing
| Item | Detail |
|---|---|
| Subject matter | Transmitting your request to an AI model provider, returning the response, and metering the tokens. |
| Duration | For the life of your account; and for request content, only the duration of the request itself. |
| Nature and purpose | Transient transmission and processing in memory, in order to provide the Service. |
| Types of personal data | Whatever you choose to include in a request. We neither require nor inspect any category, and we do not store it. |
| Categories of data subjects | Whoever you choose to send data about: your users, your staff, your customers. |
| Special or sensitive categories | You decide. If you send sensitive personal data you remain responsible for the lawful basis and for any additional safeguards your regulator requires. |
3. Our obligations
- Only on your instructions. We process request content only to provide the Service. Sending a request is your instruction. We will not use it for any other purpose, and never to train, fine-tune or evaluate a model.
- Confidentiality. Everyone with access is bound to confidentiality and has access only to what their role needs.
- Security. We keep the technical and organisational measures listed in section 7 of the Privacy Policy, appropriate to the risk of transient transmission.
- No storage by default. Request and response content is held in memory for the duration of the request and is not written to our database or our logs. This is the single most important safeguard in this Addendum.
- Assistance with rights. Because we do not store request content, we cannot search it for a data subject. We will help you with any request that concerns the account, billing or usage data we do hold.
- Breach notification. We will tell you about a personal data breach affecting your data without undue delay, and we aim to do so within 48 hours of becoming aware of it, with what we know and what we are doing about it.
- Deletion and return. On termination, the data we hold is deleted on the schedule in section 6 of the Privacy Policy. There is no request content to return or delete, because none is retained.
- Records and audit. On reasonable written notice, not more than once a year unless there has been an incident, we will answer a security questionnaire and give you the documentation we have. We do not offer on-site audits of our cloud providers; their own reports are available from them.
- Assistance with assessments. We will give you the information you reasonably need for a data protection impact assessment or a transfer assessment.
4. Your obligations
You confirm that you have a lawful basis for the data you send, that you have given your own users the notice their law requires, that your instructions to us are lawful, and that you will not send data whose sensitivity exceeds what this Service is appropriate for — in particular, do not send payment card data or government identifiers through a model request.
5. Sub-processors
You give general authorisation for the sub-processors listed at Sub-processors, where AI model providers are described by category rather than by name for commercial confidentiality; on written request we give you the identity of the model providers processing your data, under a confidentiality agreement. We impose data-protection obligations on each of them no less protective than these, and we remain responsible to you for their performance. Before a new named sub-processor starts processing your data we will list it there and email account holders at least 30 days beforehand. If you reasonably object on data-protection grounds within those 30 days, tell us; if we cannot offer a workable alternative you may terminate the affected part of the Service and take a refund of the unconsumed credits for it.
6. Transfers
Account and billing data stays in India. Request content goes to the model provider serving the model you chose, which may be outside India, and transactional email is processed in the United States. Where the GDPR or the UK GDPR applies to a transfer out of the EEA or the United Kingdom, the European Commission's standard contractual clauses of 4 June 2021 apply, with Module Two (controller to processor) where you are the controller, together with the UK International Data Transfer Addendum where UK data is involved. Those clauses are incorporated by reference; their annexes are filled in by sections 2 and 5 of this Addendum and section 7 of the Privacy Policy. Where they conflict with this Addendum, the clauses win.
7. Government and law-enforcement requests
If we receive a demand for data you control, we will not disclose it unless legally compelled. Where we are legally permitted to, we will redirect the requester to you, tell you before disclosing, and disclose only the minimum required.
8. Liability and term
The liability limits in clause 15 of the Terms of Service apply to this Addendum as a whole, except where a mandatory law — including the standard contractual clauses — does not permit them to. This Addendum starts when you first use the Service and ends when all processing of your data has ended.
Other documents
- Terms of Service — The agreement between you and VD Enterprises for using Top Billing.
- Acceptable Use Policy — What you may not do with the Service, and what happens if you do.
- Privacy Policy — What personal data we process, why, where it goes, how long we keep it, and your rights.
- Cookie Policy — The only cookies we set are the ones that keep you signed in.
- Sub-processors — Every third party that processes data on our behalf, what for, and where.
- Credits, Refunds and Cancellation Policy — How prepaid credits work, what is charged, and when money comes back.
- Service Delivery Policy — Nothing is shipped. What you buy is available within minutes, and usually at once.
- Referral Programme Terms — Invite someone, and when they top up you get credits. The exact rules.
- Service Level and Support Policy — What we aim for on availability and response, stated as targets rather than promises.
- Grievance Redressal Policy — How to complain, what we must do about it, and where to go if we fail you.
- Responsible Disclosure Policy — Report a vulnerability in good faith and we will not come after you.
- About and business details — The registered identity behind Top Billing, as the e-commerce disclosure rules expect.
- Contact — How to reach us, and what to include so the first reply is a useful one.