GDPR Compliance Notice

1. Our Commitment to GDPR Compliance

AgentMink is committed to protecting the privacy, security, and fundamental data protection rights of individuals in the European Union (EU), the European Economic Area (EEA), and the United Kingdom (UK) in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679) and the UK GDPR.

This GDPR Compliance Notice outlines our roles, lawful processing bases, international transfer safeguards, and mechanisms for exercising data subject rights when utilizing the AgentMink edge proxy gateway (gateway.agentmink.com) and developer platform (app.agentmink.com).

2. Data Controller vs. Data Processor Roles

Under GDPR definitions, AgentMink operates in two distinct legal capacities depending on the context of data processing:

2.1 AgentMink as a Data Controller

We act as a Data Controller for personal data that we collect directly from registered account holders to manage business relationships, subscriptions, and security:

• Account credentials (email address, full name, organization, bcrypt password hashes).
• Billing records, payment receipts, and Stripe transaction identifiers.
• Direct customer service, technical support inquiries, and incident communications.

2.2 AgentMink as a Data Processor

We act as a Data Processor on behalf of our business customers for all inference data and prompt traffic routed through our proxy gateway:

• In-flight prompt payloads, text embeddings, images, JSON structures, and completions.
• High-level numerical telemetry metadata (token counts, latency in milliseconds, model IDs, HTTP response codes).
• Encrypted third-party BYOK API keys stored in your workspace settings.

In this processor role, we process data strictly in accordance with Customer instructions and our published Privacy Policy and Terms of Service.

3. Stateless In-Memory Edge Architecture

AgentMink implements privacy-by-design through a stateless technical architecture:

• No Payload Persistence: Prompt inputs and AI model outputs are handled in volatile RAM within ephemeral edge isolates. They are never written to persistent disk storage, log files, or databases.
• Zero Model Training: Neither AgentMink nor our sub-processors utilize customer prompt content or completions to train or fine-tune artificial intelligence models.
• Transient Stream Passthrough: Real-time Server-Sent Events (SSE) stream directly between your application and the upstream model provider over encrypted TLS 1.3 sessions without buffer retention.

4. Lawful Bases for Processing

We process personal data only when an authorized lawful basis exists under Article 6 of the GDPR:

• Contractual Necessity (Article 6(1)(b)): Processing necessary to fulfill our obligations under our Terms of Service, including executing inference routing, managing account sessions, and issuing invoices.
• Legitimate Interests (Article 6(1)(f)): Processing necessary for our legitimate interests in securing our edge network against fraud, enforcing daily spending caps, monitoring gateway uptime, and optimizing latency.
• Legal Obligation (Article 6(1)(c)): Processing necessary to comply with applicable statutory tax, accounting, and financial reporting requirements.

5. Data Subject Rights & How to Exercise Them

If you are located in the EU, EEA, or UK, you possess specific statutory rights regarding your personal data under Articles 15 through 22 of the GDPR:

6. International Data Transfers & Standard Contractual Clauses (SCCs)

Because AgentMink operates a globally distributed edge network across 300+ edge data centers, personal data originating in the EU/EEA may transit through or be processed in edge nodes outside the European Economic Area, including the United States.

To ensure adequate protection for cross-border transfers in compliance with Chapter V of the GDPR, AgentMink relies on:

• Standard Contractual Clauses (SCCs): We incorporate the European Commission’s Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) into our commercial agreements and Data Processing Addenda with enterprise customers and infrastructure sub-processors.
• Supplementary Technical Measures: End-to-end TLS 1.3 transport encryption, AES-256-GCM authenticated credential vaulting, and ephemeral in-memory edge processing prevent unauthorized interception or foreign surveillance access during transit.

7. Sub-Processor Oversight & Standards

AgentMink engages third-party sub-processors to assist in delivering infrastructure and payment capabilities. All sub-processors undergo rigorous security evaluations and enter into binding Data Processing Addenda requiring equivalent GDPR protections:

• Cloudflare, Inc. (Global Edge Network, Workers Isolates & Encrypted Edge KV) \u2014 United States / Global.
• Stripe Payments Europe, Ltd. (Payment Processing, Tax Compliance & Customer Portal) \u2014 Ireland / EU.
• PocketBase Edge Infrastructure (Authentication & Workspace Configuration Store) \u2014 Germany / EU.
• Authorized AI Model Providers (OpenAI, Anthropic, Google, Groq, DeepSeek, Mistral) \u2014 United States / Global (per Customer routing selection).

8. Data Breach Notification Protocol

In accordance with Articles 33 and 34 of the GDPR, AgentMink maintains an established Incident Response Plan. In the unlikely event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals:

• We will notify the competent Lead Supervisory Authority within 72 hours of becoming aware of the breach.
• We will notify affected Customers without undue delay, providing a description of the nature of the breach, the categories of data affected, and recommended mitigation steps.

9. Data Protection Officer (DPO) & Regulatory Inquiries

We have appointed a dedicated Data Protection Officer to oversee our ongoing GDPR governance and handle inquiries from data subjects and European supervisory authorities:

• DPO Email: dpo@agentmink.com
• Privacy Team: privacy@agentmink.com
• Supervisory Escalation: You also retain the statutory right to lodge a formal complaint with your local National Data Protection Authority in your EU Member State.