1. Overview and Scope

GateYourWay ("we", "us", or "our") is dedicated to protecting your privacy and handling your personal data responsibly. This Privacy Policy details the types of personal data we collect, why we collect it, how it is secured, with whom it is shared, and your rights under applicable data protection laws, including the European Union General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and related global standards.

2. Our Zero-Storage AI Proxy Architecture

GateYourWay is engineered as an ephemeral privacy-preserving AI inference gateway:

• Ephemeral In-Memory Processing: When you send text prompts, document extracts, or image payloads through our API, they are streamed in-flight through memory buffers directly to and from upstream foundational model compute providers.
• No Server Disk Persistence: We do not write user prompt binaries, image uploads, or generated image files to permanent server storage.
• Client-Side Local Storage: For web dashboard features like the Playground, conversation history, and image thumbnails are indexed and stored locally inside your browser (IndexedDB) under your direct control.
• No Model Training: Neither GateYourWay nor our commercial foundational model partners use your API input payloads, generated outputs, or proprietary code to train, improve, or fine-tune public artificial intelligence models.

3. Personal Data We Collect

We collect only the minimum personal data necessary to provide and operate the Services:

• Account Registration Data: Your email address, cryptographically hashed passwords (using industry-standard one-way salt and hash algorithms), and your Telegram ID / username if you link your Telegram account.
• Financial & Payment Transaction Data: Transaction records, invoice IDs, payment status, payment amounts, and currency. Credit card payments and checkout sessions are processed exclusively by PCI-DSS Level 1 certified Merchant of Record partners (e.g. Waffo, Crypto Pay). We never store or have access to raw credit card numbers, CVVs, or bank account credentials.
• Technical & API Telemetry: When you access our endpoints, our web servers log technical metadata for security, diagnostic, and rate-limiting purposes, including: client IP address, request timestamps, HTTP method, URL path, User-Agent header, API key identifier (stored as an irreversible cryptographic hash), and token metering metrics (input, output, and cache tokens). Sensitive credentials, authorization tokens, and raw request bodies are redacted prior to logging.

4. Legal Bases and Purposes of Data Processing

We process personal data based on the following lawful grounds:

• Performance of Contract: To provision your account, authenticate API calls via gyw-sk-... keys, route inference requests, calculate token usage, deduct balances, and provide developer services.
• Legitimate Interests: To monitor system uptime, prevent denial-of-service (DoS) attacks, detect account takeover or payment fraud, and enforce our Acceptable Use Policy.
• Legal Compliance: To maintain required financial, accounting, and tax records, and to respond to binding lawful orders from competent regulatory or legal authorities.

5. Third-Party Data Sharing

We share personal data only with trusted third parties necessary to deliver the Services:

• Upstream Model Providers: Prompt payloads and model parameters are transmitted to foundational model providers (e.g. OpenAI, Anthropic, xAI) strictly to generate the requested inference. These providers process data under enterprise terms guaranteeing confidentiality and no model training on API traffic.
• Payment Processors & Merchants of Record: Necessary billing identification is shared with payment partners (including Waffo Pancake) to process card transactions, settle payouts, and prevent payment fraud.
• Cloud Infrastructure: We utilize certified server hosting facilities under strict data processing addenda.
• No Commercial Sale of Data: We do not sell, rent, monetize, or disclose your personal data to advertisers, data brokers, or marketing networks under any circumstances.

6. Data Security and Safeguards

We employ rigorous technical and organizational security measures to protect personal data against unauthorized access, loss, or alteration:

• Encryption: All network traffic to and from GateYourWay is encrypted using Transport Layer Security (TLS 1.3 / TLS 1.2).
• Credential Hashing: API keys and user passwords are stored strictly as salted, one-way cryptographic hashes.
• Network Isolation: Production databases and internal services are isolated on private internal Docker networks with no direct public internet exposure.
• Sanitized Logging: Caddy edge reverse proxies actively strip Authorization headers, Cookies, and secret tokens from persistent access logs.

7. Data Retention and Account Deletion

Account Data: Retained for as long as your account remains active. If you delete your account, your authentication credentials and active API keys are permanently invalidated immediately.

Financial Records: Transaction IDs and billing ledger entries are retained for up to five (5) years to comply with statutory accounting, tax, and anti-money laundering requirements.

Ephemeral Inference Data: Discarded immediately from RAM upon completion of the streaming HTTP response.

8. Your Privacy Rights

Depending on your location, you may exercise the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal information.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your account and associated personal data.
• Right to Data Portability: Obtain an export of your account and usage records in a machine-readable format.
• Right to Restriction or Objection: Object to or restrict certain types of processing.

To exercise any of these rights, email us at privacy@gateyourway.com or support@gateyourway.com. We will process and respond to your request within thirty (30) days without charge.

9. Contact and Data Protection Inquiries

If you have questions, feedback, or concerns regarding this Privacy Policy or our data practices, reach out to our team:

• Privacy & Compliance Team: privacy@gateyourway.com
• Customer Support: support@gateyourway.com
• Official Telegram Support: @GateYourWay_support

1. Общие положения

GateYourWay («мы», «нас») уважает неприкосновенность вашей частной жизни. Настоящая Политика конфиденциальности разъясняет, какие персональные данные мы собираем, как обеспечиваем их защиту, кому они могут передаваться и как вы можете реализовать свои законные права.

2. Архитектура нулевого хранения (Zero-Storage)

GateYourWay спроектирован как приватный высокоскоростной шлюз:

• Обработка в оперативной памяти: Текстовые промпты, документы и изображения передаются потоково через буферы памяти напрямую к поставщикам базовых моделей и обратно.
• Отсутствие хранения на сервере: Мы не записываем пользовательские файлы и промпты на диски серверов.
• Локальное хранилище браузера: История чатов и кэш изображений в интерфейсе Playground сохраняются исключительно на вашем устройстве в IndexedDB браузера.
• Запрет на обучение моделей: Ваши данные не используются для обучения публичных нейросетей.

3. Собираемые персональные данные

Мы обрабатываем только минимально необходимый объем информации:

• Данные учетной записи: Адрес электронной почты, криптографически хэшированный пароль и Telegram ID (при привязке).
• Платежные транзакции: Номера заказов, суммы пополнений и статус счетов. Данные банковских карт обрабатываются сертифицированными провайдерами (Merchant of Record / Waffo); мы не храним номера карт или CVV.
• Техническая телеметрия: IP-адрес клиента, время запроса, User-Agent, идентификатор ключа API (в виде хэша) и объемы потребленных токенов. Конфиденциальные токены авторизации удаляются из журналов доступа.

4. Передача данных третьим лицам

Данные передаются только тем контрагентам, без которых невозможно оказание услуг:

• Поставщики моделей: Текст запроса передается поставщикам моделей (OpenAI, Anthropic и др.) исключительно для выполнения вычислений по коммерческим соглашениям, запрещающим обучение.
• Платежные системы: Необходимая информация передается платежным шлюзам для проведения транзакций.

5. Безопасность данных

Мы используем шифрование трафика TLS 1.3 / 1.2, одностороннее хэширование паролей и ключей, изоляцию баз данных во внутренних сетях и санирование логов веб-сервера.

6. Права пользователя

Вы имеете право на доступ, исправление, экспорт и полное удаление вашей учетной записи. Для реализации этих прав направьте письмо на privacy@gateyourway.com или support@gateyourway.com. Запросы обрабатываются в течение 30 дней.

7. Контакты

• Отдел приватности: privacy@gateyourway.com
• Служба поддержки: support@gateyourway.com
• Telegram поддержки: @GateYourWay_support