GDPR Notice

Y-API (https://y-api.bestvirtualgoods.com) is the controller of your personal data. Contact: support@bestvirtualgoods.com.

• Account information (email, display name, avatar): processed for the performance of a contract (GDPR Art. 6(1)(b)) — without it we cannot open or maintain your account.
• Call metadata (time, model, token counts, latency, credit deducted, key name): processed for the performance of a contract and legitimate interests (Art. 6(1)(b), 6(1)(f)) — metering, billing, reconciliation, and abuse prevention.
• Top-up records (amount, credit granted, time): processed for the performance of a contract and legal obligations (Art. 6(1)(b), 6(1)(c)) — reconciliation and tax retention.
• Analytics data (page views, aggregated traffic, and the sign-up / key-provisioning / credited-top-up conversion events together with the account identifier and top-up amount they carry): processed for legitimate interests (Art. 6(1)(f)) — understanding how the site is used and how each step converts, so we can improve it. This is handled by Google Analytics 4.
• Account email for product and campaign announcements (new models, feature news): processed for legitimate interests (Art. 6(1)(f)) — the soft opt-in of an existing customer for similar services. Every email footer links to a preferences page, and opting out takes effect immediately.

We do not process your request or response content — it is forwarded in memory to upstream model providers in real time and never persisted, so it does not constitute personal data we hold.

Under the GDPR you have the right to:

• Access (Art. 15): obtain a copy of the personal data we hold about you. The console already shows every record tied to your account, and you may also request it by email.
• Rectification (Art. 16): have inaccurate personal data corrected.
• Erasure (Art. 17): have your account and associated personal data deleted, except records the law requires us to retain for reconciliation.
• Restriction (Art. 18) and objection (Art. 21): in the statutory circumstances, require us to restrict or stop specific processing.
• Portability (Art. 20): receive the data you provided to us in a structured, commonly used format.
• Lodge a complaint: with the data protection authority of your member state — without prejudice to contacting us first to resolve the issue.

The service runs on Cloudflare's global network, and upstream model providers operate from multiple countries and regions, so your data may be processed outside the EEA. We rely on necessity for the performance of a contract (Art. 49(1)(b)) as the transfer basis, and we reduce risk by transferring the minimum necessary data — account information is neither stored by nor forwarded to upstream providers; only request content is forwarded. Analytics data is processed by Google and may be stored outside the EEA under Google's own transfer mechanisms.

Account information is retained until the account is deleted. Call metadata and top-up records are retained for the period required by reconciliation and legal obligations, then deleted or anonymized.

Email support@bestvirtualgoods.com, stating your account email and your request. We respond within 30 days; if a complex case requires an extension, we will tell you in advance. To verify your identity, send the request from the email address bound to your account.