This Data Processing Agreement (“DPA”) applies when you use Yours to host, share, or collaborate on content containing personal data, and we process that data on your behalf and in accordance with your instructions.

“You” means the account holder or the organization you are authorized to represent. “We,” “us,” or “Yours” means Shenzhen Lexmount Technology Co., Ltd. You determine the purposes and means of processing personal data, and we act as your processor. This DPA forms part of the Yours Terms of Service and takes effect when you expressly accept it.

We process personal data only to the extent necessary to provide the following services:

Hosting and display: Storing the content, files, and related versions you upload and making them available in accordance with your access settings.

Sharing and collaboration: Processing recipients’ email addresses, comments, and associated identity information.

Agent access: Carrying out instructions you submit through the website, CLI, MCP, or authorized agents.

Service operations: Processing necessary file metadata, access records, and activity logs to operate and secure the service.

The individuals whose data may be processed include you, your authorized users, people identified in your content, commenters, and visitors. Processing for which we independently determine the purposes, such as account administration and billing, is covered separately by our Privacy Policy.

You must ensure that you are entitled to upload and process the personal data, provide any required notices, obtain necessary authorizations, and set appropriate access permissions. You should promptly delete personal data when it is no longer needed.

Public sharing may allow others to obtain and retain copies of your content. You are also responsible for managing your authorized agents and their permissions. Once a third-party AI assistant you choose receives the data, its subsequent processing is governed by your agreement with that provider.

You should upload sensitive personal data or other data requiring special protection only after we have separately agreed with you on the conditions for processing it.

We undertake to:

• Process personal data only in accordance with your lawful instructions and this DPA, and promptly inform you if we believe an instruction may violate applicable law.
• Not sell that personal data or use your content for advertising, user profiling, or training general-purpose AI models.
• Restrict personnel access and ensure that authorized personnel are bound by confidentiality obligations.
• Make content available in accordance with your sharing settings, without making restricted content public without your instructions.
• Provide reasonable assistance with individual rights requests, necessary impact assessments, and regulatory requirements.

If the law requires us to carry out other processing or disclose data, we will verify the legal basis, limit the processing or disclosure to what is necessary, and notify you where legally permitted.

We implement security measures appropriate to the risks of processing, including access controls, data isolation, encryption in transit, credential protection, and security monitoring.

If we become aware of a security incident affecting personal data we process on your behalf, we will immediately take remedial action and notify you without undue delay. We will explain the known impact and our response, provide relevant contact details, and keep you informed as necessary.

Account information, work, files, comments and history are kept while needed to provide the requested service. Deleted work files have a 30-day recovery period before cleanup. Closing an account follows a verified request: credentials are revoked and affected work is restricted; data due for deletion is removed from active systems or irreversibly anonymized as soon as practicable and within 30 calendar days of closure taking effect. Shared work owned by other people is reviewed separately to protect their rights.

Backups rotate within 30 days after active-system cleanup, with a maximum of 60 days from effective account closure. Restricted backups are used only for recovery and security. Deletion records are reapplied before restored data is made available. A legally required retention or hold is limited to the necessary data and purpose; we explain applicable exceptions when handling your request.

Access and audit records are retained only while needed for security, troubleshooting, disputes and legal obligations. The current deployment has no automatic age-based deletion of these records; necessity is reviewed and rights requests remain available. Notifications normally expire after 90 days. Google Analytics user/event retention is separately set to 14 months without reset on new activity.

Tencent Cloud provides hosting, database, storage, backup and necessary infrastructure services. Hosting data is processed in the product deployment region: mainland China for the mainland deployment and Hong Kong, China for the Hong Kong deployment. The current site's hosting region is Mainland China (Tencent Cloud). The contracting Tencent Cloud entity is identified by the applicable service order or agreement. Region-specific and enterprise arrangements, including provider support or remote access, may differ and are available from yours.support@lexmount.com. Tencent Cloud privacy information: https://cloud.tencent.com/document/product/301/11470.

Google Analytics (Google LLC) provides optional website usage analytics only after consent. It receives the limited event and identifier categories described in the Privacy Policy, not uploaded work or comment text. It uses Google's global infrastructure and may process data outside your country or hosting region. User/event retention is 14 months without reset on new activity. Provider policy: https://policies.google.com/privacy. Analytics for our own website is separate from entrusted processing of personal data in your work.

Identity providers and AI assistants you choose operate under their own policies. When we add a provider to process your work on our behalf, we disclose the provider, purpose, data and processing location and obtain the required authorization before processing. We require appropriate contractual protection and do not authorize general-purpose model training.

Before adding or replacing a sub-processor, we will notify you in advance and obtain any required consent. You may object on reasonable data protection grounds. If we cannot resolve the objection, you may terminate the affected service and arrange for the return or deletion of the affected data.

Before any cross-border transfer or remote access from outside the country or region where the data is held, we will obtain the applicable authorizations and complete the required legal procedures. This DPA does not replace any legally required cross-border transfer documentation.

We will provide information reasonably necessary to demonstrate compliance with this DPA and cooperate with reasonable audits, while protecting the security of the service and other users’ information.

This DPA takes precedence over the Terms of Service on personal data protection matters. Liability, governing law, and dispute resolution are governed by the Terms of Service, without limiting statutory obligations or individual rights. We will notify you in advance of material changes and obtain any consent required by law or our agreement.

For questions about this DPA, personal data processing, or security incidents, please contact:

Shenzhen Lexmount Technology Co., Ltd.

yours.support@lexmount.com