Data Processing Addendum
Last updated: November 9, 2026
This Data Processing Addendum ("DPA") forms part of the Terms of Service between you ("Customer") and eSolutions 88, LLC ("Processor"). It applies whenever the texts and files Customer submits to the Service ("Content") contain personal data, and is designed to meet Article 28 of the EU General Data Protection Regulation (GDPR), the UK GDPR and comparable laws. It takes effect when Customer accepts the Terms; no signature is needed. Customers who need a signed copy can ask at [email protected].
1. Roles
For personal data in Content, Customer is the controller (or a processor acting for its own controller) and eSolutions 88, LLC is the processor (or sub-processor). For account, usage and billing data, eSolutions 88, LLC is a controller, as described in its Privacy Policy.
2. Details of the processing
| Subject matter | Estimating whether Content was written by an AI model. |
| Nature and purpose | Automated analysis of Content and return of the result to Customer. No other purpose. |
| Duration | Each item of Content is processed in memory only for the duration of the API request, normally seconds, and then discarded. |
| Data subjects | Authors of the Content and people named in it, as determined by Customer, for example students, employees, applicants or contributors. |
| Categories of data | Whatever personal data the Content contains, such as names and the writing itself. Customer should not submit special categories of data unless it is necessary and lawful. |
3. Processor obligations
eSolutions 88, LLC will:
- process Content only on Customer's documented instructions, which are the Terms, this DPA and Customer's API requests, unless the law requires otherwise, in which case it will tell Customer first where allowed;
- not store Content, not write it to logs, and not use it to train or improve models or for any purpose of its own;
- make sure everyone authorised to process Content is bound by confidentiality;
- apply the security measures in section 6;
- help Customer, taking into account the nature of the processing, to respond to data subject requests and to meet its obligations on security, breach notification, impact assessments and consultations with authorities. Because Content is not kept, there is normally no Content to access, correct or delete after a request ends;
- notify Customer without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting Content, with the information Customer reasonably needs;
- make available the information needed to show compliance with this DPA, and allow audits by Customer or an auditor it appoints, on 30 days' written notice, no more than once a year unless a breach or an authority requires it, at Customer's cost and under confidentiality.
4. Sub-processors
Customer authorises the following sub-processors for Content:
| Sub-processor | Role | Location |
|---|---|---|
| Laravel Holdings Inc. (Laravel Cloud), on Amazon Web Services | Receives API requests and passes them to the analysis servers | United States |
| RunPod Inc. | GPU servers that run the analysis | United States and European Union |
| Cloudflare, Inc. | Network delivery and protection; traffic passes through encrypted | Global |
eSolutions 88, LLC will bind each sub-processor to data protection terms no less protective than this DPA and remains responsible for their performance. It will give at least 30 days' notice of a new sub-processor by email or on this page. Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, Customer may terminate the affected Service and will not be charged for it after termination.
5. International transfers
Where Content containing personal data from the European Economic Area, the United Kingdom or Switzerland is processed in a country without an adequacy decision, the parties agree to the European Commission's Standard Contractual Clauses (Decision 2021/914), Module Two (controller to processor) or Module Three (processor to processor) as applicable, with the UK International Data Transfer Addendum and Swiss amendments where needed. They are incorporated by reference, with the details in section 2 and section 6 serving as their annexes, the optional clause 7 omitted, option 2 of clause 9 (general authorisation, 30 days' notice) selected, and Ireland's law and courts chosen for clauses 17 and 18. If the Clauses conflict with this DPA, the Clauses prevail.
6. Security measures
- Encryption of all traffic with TLS (HTTPS).
- Content held in memory only, never written to disk, databases or logs.
- API keys stored only as a SHA-256 hash; passwords with a one-way hash; revocation takes effect immediately.
- Access to production systems limited to authorised personnel, with individual accounts.
- Rate limiting and network protection against abuse and denial-of-service attacks.
- Isolated, stateless analysis workers that keep no Content between requests.
7. Customer obligations
Customer is responsible for having a lawful basis to submit Content, for informing data subjects where the law requires, and for not relying on results as the sole basis for decisions with legal or similarly significant effects on individuals, as set out in the Terms. Where Content concerns minors or students, Customer is responsible for meeting the laws that apply to it, such as FERPA or COPPA in the United States.
8. End of the Service
As Content is not retained, there is no Content to return or delete when the Service ends. eSolutions 88, LLC will delete any other Customer personal data it holds as a processor within 30 days, unless the law requires it to keep it.
9. Liability and precedence
Each party's liability under this DPA is subject to the limits in the Terms, except where the law does not allow them to be limited. If this DPA conflicts with the Terms, this DPA prevails for the processing of personal data.
Contact
eSolutions 88, LLC
390 Northeast 191st Street, Miami, FL 33179, United States
[email protected]