Data Processing Agreement
Last Updated: October 7, 2026
Between the Business Customer, hereinafter referred to as the Controller, and Solid Technologies AG, acting as Mono, hereinafter referred to as the Processor.
1. Subject of the Agreement The Processor provides artificial intelligence services to the Controller via the Mono platform. The Processor processes personal data on behalf of and upon the instructions of the Controller.
2. Categories of Data Subjects and Types of Data The processing includes text data, documents, and inputs that the Controller transfers into the Mono platform. It may also include account, configuration, service-usage, and activity-log data necessary to provide, support, and secure the Service. This may include limited account or profile data such as a user ID, name, email address, language, and subscription plan. This affects employees, customers, and business partners of the Controller. Except for the limited case described below, special categories of personal data are explicitly excluded from processing. In particular, health or medical data concerning third parties must not be entered into Mono unless they have first been irreversibly anonymized. A user's own health data remains sensitive or special-category personal data and requires special treatment. It may be entered only if the Controller has established a valid legal basis and satisfied all additional requirements applicable to such data, including obtaining explicit consent where required.
Where users request support, processing also includes support messages, files submitted in the support chat, and technical connection and chat-session data.
3. Use for Training Purposes Inputs and generated outputs of the Controller are not used for training, improving, or fine tuning the deployed AI models, except where an authorized user explicitly agrees to possible training use as described in Section 4. Where training use can be excluded, the Processor ensures this through contractual API agreements or provider settings.
4. Location of Data Processing Core customer data is stored and hosted on servers in Frankfurt, Germany. For the generation of responses, data is transmitted temporarily to external AI interfaces. Some model providers may retain request and response data and related metadata in security and abuse-monitoring logs for up to 30 days before deletion. If a selected provider may use submitted data for training, including where training use cannot be excluded contractually, the Mono interface clearly identifies this before transmission. The authorized user must explicitly agree to continue; without this agreement, the data is not sent to that provider.
5. Subprocessors The Controller grants general authorization for the Processor to use subprocessors to provide and operate the Service. The current relevant subprocessors and purposes include:
- Google: Hosting, infrastructure, and model services.
- OpenAI: Model services.
- Anthropic: Model services.
- OpenRouter: Model routing and model services.
- Crisp IM SAS (France): Customer support and live chat, when users open the support chat. Relevant data includes name, email address, interface language, support messages and submitted files, and technical connection and chat-session data. Crisp reports primary hosting in the Netherlands and Germany and encrypted backups in Ireland. Other processing and international transfers are subject to Section 6. See Crisp’s subprocessor list.
The Processor shall inform the Controller in a timely manner of any intended changes concerning the addition or replacement of subprocessors and provide a reasonable opportunity to object on legitimate data-protection grounds. The Processor remains responsible for imposing data-protection obligations on subprocessors as required by applicable law.
6. International Data Transfers If personal data is transferred outside Switzerland or the EEA, the Processor uses an applicable lawful transfer mechanism. Depending on the recipient, this may include an adequacy decision, the Swiss-U.S. or EU-U.S. Data Privacy Framework for certified recipients, or the European Commission's Standard Contractual Clauses with any required Swiss adaptations and supplementary measures. This also applies to restricted support or subprocessor access to data otherwise hosted in Frankfurt.
7. Technical and Organizational Measures The Processor implements technical and organizational measures appropriate to the risk, including encryption in transit and at rest, restrictive access controls, authentication, logging, backup controls, and procedures for handling security incidents. Access to production data is limited to authorized personnel and subprocessors who require it to provide, secure, support, or maintain the Service and who are subject to confidentiality and data-protection obligations.
8. Deletion of Data Deleted chat histories or account data are removed from the active systems once their purpose has been fulfilled or on a valid instruction from the Controller, subject to legal retention requirements. Mono-controlled backup copies are overwritten or permanently deleted within a maximum of 30 days. Copies held by subprocessors are deleted in accordance with the applicable subprocessor agreement and documented retention schedule.