APIPurse — Data Processing Agreement

Last updated: October 17, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Yem Consult BV (VAT/company number BE1001.251.321), Zwarte Leeuwstraat 50, 2820 Bonheiden, Belgium ("APIPurse", "Processor") and the business or other organisation that uses the APIPurse Service ("Customer", "Controller"). It applies automatically from the moment the Customer accepts the Terms of Service, without signature, to the extent APIPurse processes Customer Personal Data on the Customer's behalf. Where a countersigned copy is needed, contact privacy@apipurse.com.

1. Definitions

Terms such as "controller", "processor", "personal data", "processing", "data subject" and "personal data breach" have the meaning given in Regulation (EU) 2016/679 ("GDPR"). "Data Protection Law" means the GDPR, the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data, and any other data protection law applicable to the processing under this DPA, including the UK GDPR where applicable. "Customer Personal Data" means personal data processed by APIPurse on behalf of the Customer in providing the Service, as described in Annex A. "Service" has the meaning given in the Terms of Service.

2. Roles and scope

For Customer Personal Data, the Customer is the controller (or a processor acting for its own controller) and APIPurse is the processor (or sub-processor). This DPA does not apply to personal data for which APIPurse determines the purposes and means itself and is therefore an independent controller, such as the Customer's own account and login data, billing and tax records held by Stripe/Link as merchant of record, and security and abuse-prevention logs. Those are described in the Privacy Policy.

The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex A.

3. Customer instructions

APIPurse processes Customer Personal Data only on the Customer's documented instructions, which consist of this DPA, the Terms of Service, and the Customer's use and configuration of the Service, unless EU or Member State law requires otherwise; in that case APIPurse informs the Customer before processing, unless that law prohibits it. APIPurse will inform the Customer without undue delay if, in its opinion, an instruction infringes Data Protection Law.

The Customer is responsible for the lawfulness of its instructions and of the personal data it submits, including having a valid legal basis, providing the required notices to data subjects, and not submitting special categories of personal data (Article 9 GDPR) or data relating to criminal convictions (Article 10 GDPR) to the Service. The Service is not designed to process such data.

4. Confidentiality and personnel

APIPurse ensures that persons authorised to process Customer Personal Data are bound by confidentiality obligations and process the data only as needed to provide and support the Service. Access is limited to what is necessary for each role.

5. Security

APIPurse implements appropriate technical and organisational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as required by Article 32 GDPR. The measures in place on the date above are described in Annex B. APIPurse may update these measures from time to time, provided the overall level of protection is not materially reduced.

6. Sub-processors

The Customer gives APIPurse general written authorisation to engage sub-processors. The sub-processors engaged on the date above are listed in Annex C and in Section 4 of the Privacy Policy.

APIPurse enters into a written contract with each sub-processor that imposes data protection obligations no less protective than those in this DPA, and remains responsible to the Customer for the performance of its sub-processors.

APIPurse will give the Customer at least 30 days' prior notice of any intended addition or replacement of a sub-processor, by email to the account owner or by updating Annex C and the Privacy Policy and notifying account owners. The Customer may object on reasonable data protection grounds within 30 days of the notice by writing to privacy@apipurse.com. The parties will then discuss in good faith how to resolve the objection. If no reasonable solution is found within 30 days, the Customer may terminate the affected part of the Service in accordance with the Terms of Service and receive a pro-rata refund of prepaid fees for the period after termination, which is the Customer's sole remedy for such objection.

7. International transfers

APIPurse stores Customer Personal Data in the European Economic Area (see Annex C). Where a sub-processor processes personal data in a country outside the EEA that is not covered by an adequacy decision, the transfer is made under the EU-U.S. Data Privacy Framework (where the recipient is certified), or the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), or another transfer mechanism permitted by Data Protection Law. For transfers of UK personal data, the UK International Data Transfer Addendum or the UK adequacy regulations apply as appropriate. A copy of the relevant safeguards is available on request at privacy@apipurse.com.

8. Assistance to the Customer

Taking into account the nature of the processing, APIPurse will provide reasonable assistance, by appropriate technical and organisational measures, in responding to data subject requests (access, rectification, erasure, restriction, portability, objection). If a data subject contacts APIPurse directly about Customer Personal Data, APIPurse will, where the Customer can be identified, refer the data subject to the Customer and not respond on the substance unless legally required to. Many of these actions can be performed by the Customer directly in the Service (for example deleting a provider connection, a team member, or usage data, and deleting the account).

APIPurse will also provide reasonable assistance with the Customer's obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the information available to APIPurse. Assistance that goes beyond the Service's ordinary functionality and requires significant effort may be charged at reasonable rates agreed in advance.

9. Personal data breach

APIPurse will notify the Customer without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notification will be sent to the account owner's email address and will, to the extent known, describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it. APIPurse will provide further information as it becomes available and take reasonable steps to contain and remediate the breach. A notification is not an acknowledgement of fault or liability.

10. Deletion and return of data

On termination or expiry of the Service, or on the Customer's earlier request, APIPurse will delete Customer Personal Data in line with the retention periods in Section 5 of the Privacy Policy (account data 30 days after deletion; usage and cost records until the account is deleted; backups overwritten in the ordinary backup cycle within approximately 30 days), unless Union or Member State law requires storage. Before deletion, the Customer may export its data using the export functions of the Service, and may request assistance in accordance with the data retrieval and switching provisions of the Terms of Service. On written request, APIPurse will confirm deletion.

11. Audits and information

APIPurse will make available to the Customer the information reasonably necessary to demonstrate compliance with Article 28 GDPR, including this DPA, the Privacy Policy, and, on request, a summary of the security measures and the relevant sub-processor documentation (such as sub-processors' public security reports and certifications). If the Customer, acting reasonably, still cannot verify compliance from that information, or where required by a supervisory authority, the Customer may carry out an audit, no more than once per twelve months (except after a personal data breach or where required by a supervisory authority), subject to: at least 30 days' written notice; a written scope and confidentiality undertaking agreed in advance; performance during normal business hours without disrupting operations or compromising the data of other customers; and the Customer bearing all costs of the audit, including APIPurse's reasonable time. An independent auditor bound by confidentiality may be used, but not a competitor of APIPurse.

12. Liability

Each party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability in the Terms of Service, which apply in aggregate to the Terms of Service and this DPA together, to the maximum extent permitted by law. Nothing in this DPA limits liability that cannot be limited under applicable law, or a data subject's rights under Article 82 GDPR. Where a party has paid compensation to a data subject for damage for which the other party is partly responsible, it may claim back that part from the other party in accordance with Article 82(5) GDPR.

13. Duration, precedence and governing law

This DPA takes effect on the date the Customer accepts the Terms of Service and remains in force for as long as APIPurse processes Customer Personal Data, including any period after termination in which the data is held before deletion under Section 10. If there is a conflict between this DPA and the Terms of Service regarding the processing of Customer Personal Data, this DPA prevails; the Standard Contractual Clauses, where they apply, prevail over both. APIPurse may update this DPA to reflect changes in law or in the Service, with at least 30 days' notice for material changes; if a change materially and adversely affects the Customer, the Customer may terminate as set out in the Terms of Service. This DPA is governed by the laws of Belgium, and the courts stated in the Terms of Service have jurisdiction, without prejudice to the Standard Contractual Clauses where they apply.

14. Contact

Data protection requests and questions about this DPA: privacy@apipurse.com Yem Consult BV, Zwarte Leeuwstraat 50, 2820 Bonheiden, Belgium (VAT BE1001.251.321).

Annex A — Details of processing

Annex B — Technical and organisational measures

• Encryption in transit: all traffic to the Service uses HTTPS/TLS, with HSTS enabled.
• Encryption at rest: connected-provider API keys and webhook secrets are encrypted before being written to the database and are not displayed again after entry; the database provider encrypts stored data at rest.
• Access control: row-level security in the database ensures each account can only read its own data (or, for Team accounts, data shared within that team); administrative access to production systems is limited to authorised personnel and protected by authentication controls.
• Application security: security response headers (including HSTS, a restrictive Content-Security-Policy and clickjacking protection); rate limiting of token-authenticated and public endpoints; input validation; ingest tokens that can be regenerated.
• Monitoring: error monitoring and availability monitoring with alerting, so that incidents are detected and handled.
• Secrets management: production secrets are held in the hosting provider's environment configuration, are not stored in the source repository, and are rotated when exposure is suspected.
• Backups and resilience: daily database backups by the database provider; deleted data is overwritten in the ordinary backup cycle within approximately 30 days.
• Email security: transactional email is sent from the APIPurse domain with SPF, DKIM and DMARC.
• Data minimisation: the Service does not collect the content of API calls (such as prompts or completions), only cost, token-count and amount figures and optional labels chosen by the Customer.
• Incident response: documented internal procedure to assess, contain, and notify personal data breaches as described in Section 9.
• Vendor management: sub-processors are engaged under written data processing terms and their security posture is reviewed before engagement.

Annex C — Authorised sub-processors

Stripe, including Link, acts as merchant of record and as an independent controller for billing and payment data and is therefore not a sub-processor under this DPA.