Data Processing Agreement
Last updated: January 1, 2026
This Data Processing Agreement ("DPA") forms part of the Langtrain Terms of Service and applies to all customers who process personal data using our platform.
GDPR Compliant
Full compliance with EU General Data Protection Regulation
Data Security
Industry-standard encryption and access controls
Data Transfers
Standard Contractual Clauses for cross-border transfers
Sub-processors
Full transparency on third-party data processors
1. Definitions
"Controller" means the entity that determines the purposes and means of processing personal data (the Customer).
"Processor" means QUADTREE AI TECHNOLOGIES PRIVATE LIMITED (operating Langtrain), which processes personal data on behalf of the Controller.
"Personal Data" means any information relating to an identified or identifiable natural person as defined under applicable data protection laws including GDPR.
"Processing" means any operation performed on personal data, including collection, storage, use, or deletion.
"Sub-processor" means any third party engaged by Langtrain to process personal data on behalf of the Customer.
2. Scope and Purpose
This DPA applies where and to the extent that Langtrain processes personal data on behalf of the Customer in connection with the provision of the Langtrain platform, including:
- LLM fine-tuning and training job management
- Dataset storage and processing
- Model inference and API services
- RLHF annotation and feedback collection
- AI agent execution and workflow automation
- Analytics and monitoring (LangVision)
3. Customer Obligations (Controller)
The Customer, as Controller, agrees and warrants that:
- It has a lawful basis for processing personal data uploaded to Langtrain.
- It will not upload special category data (health, biometric, political opinions) without explicit consent and prior written notice to Langtrain.
- It will ensure data subjects have been informed about the processing.
- It is responsible for ensuring any instructions given to Langtrain comply with applicable law.
- It will notify Langtrain immediately of any data subject requests related to data processed on the platform.
4. Langtrain Obligations (Processor)
Langtrain agrees to:
- Process personal data only on documented instructions from the Customer.
- Ensure that personnel authorized to process personal data are bound by confidentiality.
- Implement appropriate technical and organizational security measures (encryption at rest and in transit, access controls, audit logs).
- Assist the Customer in responding to data subject requests within legally required timeframes.
- Notify the Customer without undue delay (and within 72 hours where feasible) upon becoming aware of a personal data breach.
- Delete or return all personal data upon termination of the service agreement, at the Customer's choice.
- Make available all information necessary to demonstrate compliance with this DPA.
5. Sub-processors
The Customer grants Langtrain general authorization to engage the following sub-processors. Langtrain will notify Customers of any changes to this list with at least 30 days' notice.
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure and storage | USA / Global |
| Supabase | Authentication and database | USA |
| Railway | Application hosting | USA |
| Razorpay | Payment processing (India) | India |
| Stripe | Payment processing (International) | USA |
| Upstash / Redis | Caching and session management | USA / Global |
| Resend | Transactional email delivery | USA |
| PostHog | Product analytics (self-hosted option) | EU / USA |
6. International Data Transfers
Langtrain is headquartered in India and may process data in the United States and other regions via sub-processors. For transfers of personal data from the European Economic Area (EEA) or the UK, Langtrain relies on:
- Standard Contractual Clauses (SCCs) as approved by the European Commission.
- Adequacy decisions where applicable.
- UK International Data Transfer Agreements (IDTAs) for UK transfers.
7. Contact & DPA Execution
Enterprise customers requiring a signed, countersigned DPA for compliance purposes (e.g., GDPR, CCPA, HIPAA) should contact us at:
privacy@langtrain.xyzQUADTREE AI TECHNOLOGIES PRIVATE LIMITED
Hyderabad, Telangana, India