This DPA applies whenever Customer utilizes the YossGate API aggregation platform to process Personal Data on behalf of an organisation, enterprise, or commercial application.

1. Definitions

• “Personal Data” means any information relating to an identified or identifiable natural person (“Data Subject”) as defined by Applicable Data Protection Law.
• “Processing” means any operation or set of operations performed upon Personal Data, including collection, transmission, routing, storage, adaptation, retrieval, erasure, or destruction.
• “Controller” means the entity that determines the purposes and means of the Processing of Personal Data (the Customer).
• “Processor” means the entity that processes Personal Data on behalf of the Controller (YossGate).
• “Sub-processor” means any third-party infrastructure vendor or upstream foundation model provider engaged by YossGate to perform processing activities.
• “Applicable Data Protection Law” means all binding laws and regulations applicable to the processing of personal data, including the EU General Data Protection Regulation (GDPR), the Singapore Personal Data Protection Act 2012 (PDPA), and the California Consumer Privacy Act (CCPA).

2. Roles of the Parties

• Customer as Controller: Customer maintains complete control over the prompts, data, and payloads transmitted to the YossGate API. Customer is responsible for ensuring a valid legal basis for processing and obtaining all necessary consents from end users.
• YossGate as Processor: YossGate acts strictly on Customer’s documented instructions to provide high-concurrency API proxy routing, protocol conversion, authentication, and token billing services. YossGate does not process Personal Data for its own independent training or commercial profiling purposes.

3. Scope, Categories, and Zero Data Retention

4. Obligations of the Processor (YossGate)

YossGate agrees to:

1. Documented Instructions: Process Personal Data solely in accordance with Customer’s documented instructions, including the transmission of requests to chosen model endpoints;
2. Confidentiality: Ensure that all staff, contractors, and systems with access to data are bound by stringent statutory or contractual confidentiality agreements;
3. Security Standards: Implement and maintain robust Technical and Organisational Measures (TOMs) appropriate to the risk;
4. Data Subject Rights Support: Reasonably assist Customer in fulfilling its obligations to respond to Data Subject requests (e.g., access, deletion, rectification) under applicable regulations;
5. Data Return and Erasure: Upon termination of services, purge or return all residual customer data within thirty (30) days, subject to legal compliance obligations.

5. Technical and Organisational Measures (TOMs)

YossGate maintains high industry security benchmarks, including:

• Encryption in Transit: Mandatory TLS 1.3 / TLS 1.2 encryption for all incoming client API calls and outbound upstream provider connections.
• Ephemeral Memory Processing: Payloads are streamed through memory buffers; persistent prompt caching is disabled by default.
• Container and Multi-Tenant Isolation: Architectural separation prevents cross-tenant data leakage.
• Access Control: Principle of least privilege, multi-factor authentication (MFA), and audit logging for all production infrastructure.
• Continuous Monitoring: Real-time intrusion detection, DDoS mitigation via Cloudflare edge infrastructure, and regular automated vulnerability assessments.

6. Upstream Sub-processors

Customer acknowledges and expressly authorizes YossGate to engage upstream AI model providers and cloud infrastructure vendors as Sub-processors (including, among others, OpenAI, Anthropic, Google Cloud, Meta, Cloudflare, and AWS).

YossGate enforces rigorous vendor due diligence, selecting partners that comply with SOC 2 Type II, ISO 27001, or comparable data protection certifications.

7. Security Incident and Breach Notification

In the event of a confirmed Personal Data Breach affecting Customer’s unencrypted data within YossGate’s infrastructure, YossGate will notify Customer without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of the incident, providing available details and remediation measures.

8. Cross-Border Data Transfers

To deliver global, low-latency AI routing, data may be processed across secure edge nodes and upstream data centers globally. Where cross-border data transfers occur from the European Economic Area (EEA), the UK, or Switzerland to countries without an adequacy decision, the parties agree that standard contractual safeguards (such as the European Commission’s Standard Contractual Clauses - SCCs) shall apply.

9. Governing Law and Arbitration

This Agreement shall be governed by and construed in accordance with the laws of the Republic of Singapore. Any dispute arising under or in connection with this DPA shall be submitted to the exclusive jurisdiction of the Singapore courts or resolved through arbitration administered by the Singapore International Arbitration Centre (SIAC).

10. Contact Information

For DPA inquiries or Data Protection Officer correspondence:

• Email: support@yossgate.com

Please review this Privacy Policy alongside our Terms of Service . By accessing or using the Website or Service, you acknowledge and agree to the data collection and processing practices described herein.

1. Information We Collect

We collect information strictly necessary to provide low-latency API proxying, authenticate users, manage prepaid billing balances, and protect infrastructure security.

1.1 Personal Information You Provide

• Account Credentials: When you register, we collect identifiers such as your email address, username, and password hashes;
• Billing and Transaction Records: Records of prepaid Credits purchases, payment transaction identifiers, invoice records, and top-up timestamps (credit card numbers and sensitive payment instruments are handled directly by certified third-party payment processors such as Stripe);
• Customer Support Correspondence: Inquiries, bug reports, and communications sent to our support desk.

1.2 Information Collected Automatically

• Network and Technical Telemetry: IP address, browser user-agent, operating system version, referring URL, request timestamps, and approximate geolocation inferred from IP;
• API Telemetry: HTTP response status codes, latency metrics, token consumption counts, and model endpoint identifiers.

1.3 Zero Data Retention for Prompts and Model Training

YossGate enforces a strict Zero Data Retention Policy regarding AI model training:

• No Training: We do NOT use, sell, or disclose your Prompts (Inputs) or completions (Outputs) to train, train-tune, or calibrate any machine learning or foundation models.
• Ephemeral In-Memory Processing: Incoming API requests are parsed in-memory, authenticated, metered, and streamed directly to upstream foundation model providers (e.g., OpenAI, Anthropic, Google, DeepSeek). Prompts and responses are not written to persistent storage databases.

2. How We Use Your Information

We process personal data strictly for legitimate operational, security, and contractual purposes:

• To provide, operate, and maintain the high-availability API gateway;
• To authenticate API keys, enforce concurrency controls, and accurately deduct prepaid Credits;
• To detect, prevent, and mitigate DDoS attacks, prompt injection exploits, fraudulent charges, and abusive traffic;
• To communicate system updates, security advisories, billing invoices, and policy changes;
• To comply with applicable legal, tax, accounting, and regulatory obligations.

3. Sharing and Disclosure of Information

We do not sell, rent, or trade your personal data. We disclose data solely under the following limited circumstances:

• Third-Party Service Providers: Trusted cloud infrastructure, payment processors (e.g., Stripe), CDN/DDoS mitigation networks (e.g., Cloudflare), and transactional email delivery vendors who operate under strict confidentiality agreements.
• Upstream AI Model Providers: Forwarding encrypted API payloads to the specific upstream providers chosen by you (e.g., OpenAI, Anthropic, Google) to fulfill your API calls.
• Corporate Restructuring: In the event of a merger, acquisition, corporate reorganization, or sale of assets, subject to continued privacy protections.
• Legal Requirements: When required by subpoena, court order, or binding regulation, or when necessary to protect the rights, property, or safety of YossGate, our customers, or the public.

4. Cookies and Web Analytics

We use essential first-party cookies to keep you authenticated in the developer console and maintain session security. We do not deploy intrusive third-party cross-site behavioral tracking cookies. You may disable cookies in your browser settings, though doing so may disable console login and dashboard functionality.

5. Data Security Measures

We implement multi-layered technical and organizational security controls:

• Mandatory TLS 1.3 / TLS 1.2 encryption for all data in transit;
• Industry-standard AES-256 encryption at rest for sensitive configurations;
• Continuous automated security monitoring, firewall rules, and intrusion prevention;
• Principle of least privilege (PoLP) and strict multi-factor authentication (MFA) for administrative operations.

6. Your Rights and Choices

Depending on your geographic jurisdiction (such as under the GDPR, UK GDPR, or Singapore PDPA), you may possess legal rights concerning your personal data:

• Access and Portability: Request a copy of the personal data we maintain about you;
• Rectification: Request correction of inaccurate or incomplete account records;
• Erasure (“Right to be Forgotten”): Request deletion of your account and associated personal data (subject to legal and financial recordkeeping requirements);
• Restriction and Objection: Object to or restrict specific processing activities.

To exercise these rights, please contact our privacy desk at support@yossgate.com .

7. Data Retention and Account Deletion

We retain account identifiers and financial transaction records for as long as your account is active, or as required by applicable commercial, tax, and anti-fraud regulations. When an account is terminated, associated API keys and profile records are permanently purged from active systems within thirty (30) days.

8. International Data Transfers

The Service is managed from Singapore, Republic of Singapore, and utilizes distributed global edge infrastructure. If you access the Service from outside Singapore, your data may be transferred across borders. We ensure that international data transfers comply with recognized legal frameworks, including Standard Contractual Clauses (SCCs) where applicable.

9. Governing Law

This Privacy Policy and any disputes arising hereunder shall be governed by and construed in accordance with the laws of the Republic of Singapore, without regard to conflict-of-laws principles.

10. Contact Information and Data Protection Officer (DPO)

For inquiries, privacy concerns, or to contact our Data Protection Officer, please reach out to:

• Entity: YossGate Team
• Registered Location: Singapore, Republic of Singapore
• Official Domain: https://yossgate.com
• Privacy & DPO Email: support@yossgate.com