Data Processing Addendum for YATFA

1. Roles of the Parties

Where you submit personal data to YATFA as part of using the services, you act as the controller of that data and YATFA acts as a processor, processing it on your documented instructions — which are your use of the services and your configuration of them. For the personal data we collect about you and your users in order to run accounts, billing and the platform itself, YATFA acts as a controller, as described in the Privacy Policy.

2. Scope of Processing

The processing covers the information described in Section 1 of the Privacy Policy and the way source code is handled under Section 2 of the Privacy Policy:

• Account information: your name, email address and authentication data (including GitHub account details when authenticating through OAuth);
• GitHub integration data: source code, pull requests and associated comments, and Continuous Integration status, for the repositories you select, within the scope of isolated task execution sessions;
• Usage metrics and technical logs: the compute each agent consumes, and information about agent execution, errors, execution times and backlog queues.

The purpose is to provide the services to you: automated planning, code implementation and review, metering usage, and operating the platform. Source code is not stored on our permanent database servers; it is cloned temporarily into isolated Docker sandboxes for the duration of a specific task and deleted when the session ends. We do not use your source code, commit history or pull request comments to train our own or third-party machine learning models.

3. Our Commitments as Processor

• We process personal data only to provide the services and on your instructions, unless the law requires otherwise.
• We assist you, as far as reasonably possible, in responding to requests from individuals exercising their data protection rights, using the routes described in Section 9 of the Privacy Policy.

4. Security Measures

We apply the technical and organizational measures described in Section 4 of the Privacy Policy and on our Trust page, including:

• Sandboxed execution: agents run inside isolated Docker containers, without access to the host machine or other users' data;
• Encryption in transit: data transmitted between the CLI, YATFA agents and the platform is encrypted using TLS and Secure WebSockets (WSS);
• GitHub authentication: we use the official GitHub App protocol with short-lived, automatically rotated tokens, and do not store your GitHub passwords or permanent Personal Access Tokens.

The Trust page also states plainly which third-party attestations we do not hold today. This DPA does not claim any.

5. Subprocessors

To deliver the services we use categories of third-party processors — large language model providers, error tracking services, and, if you enable the integration, notification services — as described in Section 3 of the Privacy Policy. A current list of subprocessors is available on request: contact us. We select and may change subprocessors at our discretion.

6. International Transfers

For customer workloads we route to large language model providers operating in the United States or the European Union. If you are located outside those regions, this means your data is processed outside your country of residence, as the Privacy Policy discloses.

7. Return and Deletion

You may request deletion of your account and associated data at any time, as described in Section 9 of the Privacy Policy, and you may export your work record. On termination of your account we will, at your choice, return or delete the personal data we process on your behalf, except where the law requires us to keep it, for example billing and accounting records. Disconnecting the GitHub App at any time immediately stops YATFA from interacting with your repositories.

8. Personal Data Breach

If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to personal data we process on your behalf, we will notify you without undue delay and give you the information we have that is reasonably needed to meet your own obligations.

9. Changes to This DPA

We may update this DPA to reflect changes in our processing practices or legal requirements. In the event of material changes, we will notify you via email or through your YATFA dashboard before the changes take effect.

10. Contact

To request a signed copy, the current subprocessor list, or to ask a question about this DPA, contact us.