約 Notice
Four agreements, one page.
Terms of Service, Acceptable Use, Privacy and the Data Processing Addendum, and the Service Level Agreement — numbered, linkable clause by clause, and kept on one page so that nothing hides behind a second click.
It is not legal advice, and it is not in force. The clauses below are written to show what this company’s agreements would cover and how they would read — the shape, the numbering, the tables and the commitments. Before any of it binds anyone it must be settled by a qualified lawyer in England and Wales.
Yunagi — front-end specification · drafted 2026.08.26 · not executed
序 How To Read This
One agreement, set in four parts
The four parts are one agreement. Where they conflict, the SLA governs availability, the DPA governs personal data, and the Terms govern everything else. Every clause has a permanent number and a permanent anchor: clause 3.11 lives at #c-3-11, and the number itself is the link — click it and the URL is on your clipboard. Numbers are never reused. A withdrawn clause stays where it is, struck through, with the date it stopped applying, so a link sent two years ago still lands somewhere honest.
YG-LEGAL — four parts, numbered 1 to 5Every clause is linkable: 3.5 is #c-3-5
第一 Terms of Service
Terms of Service
The agreement
These terms are between you and Higan Holdings Limited, registered in England and Wales under number 16914818, trading as Yunagi. They apply to every service listed at yunagi.cloud and to any account opened there.
Where a service page and this page disagree about a commitment, this page governs.
Your account
One account, one legal entity. You are responsible for what happens under your credentials, including anything a machine token does. A second factor is required before a payment method can be added and cannot be removed while one is on file.
Charges
Compute is billed by the hour to a monthly cap. Registrations and certificates are billed for the term at the price shown at the moment of purchase, which is the price printed beside it. Metered inference is billed on the count of successful renders; a render refused by the safety classifier is not billed.
Prices are in US dollars, excluding VAT. UK VAT is added where it applies.
Notice of price changes
A price increase takes effect no sooner than sixty days after it is published on the notice board, and never during a term already paid for. A decrease takes effect immediately.
Suspension
We may suspend a service without notice only where continuing would break the law, endanger the network, or where an invoice is more than fourteen days overdue after a written reminder. In every other case you get seven days and a named contact.
Ending it
You may close an account at any time from the console. Instances stop, volumes are cryptographically erased within seven days, and any unused prepaid balance is refunded pro rata. Domain names are yours: we will not hold a transfer, and there is no transfer-out fee.
Liability
Neither party excludes liability for death or personal injury caused by negligence, or for fraud. Otherwise our aggregate liability in any twelve-month period is limited to the charges you paid us in that period, and neither party is liable for loss of profit or of data that the other could have avoided by keeping a backup.
Law
English law governs. The courts of England and Wales have exclusive jurisdiction. Nothing here removes a right you have as a consumer under the law of your own country of residence.
第二 Acceptable Use
Acceptable Use
What is not allowed
Sending unsolicited bulk email. Port scanning, brute-forcing or denial of service against anything you do not own. Hosting malware, phishing pages or credential-stealing infrastructure. Child sexual abuse material — reported immediately, with no notice to you. Anything unlawful in the jurisdiction of the harbour it runs in.
What is allowed and often assumed not to be
Tor relays and exit nodes, VPN endpoints, mail servers, adult content that is legal where it is hosted, cryptocurrency nodes, and security research against systems you own or are authorised to test.
Outbound SMTP
Port 25 is closed on new accounts and opened on request after thirty days of account history and a sentence about what you intend to send. It is the only port we touch, and we touch it because an open relay is how a /22 gets listed.
Resource use
A shared-thread instance may use its thread fully; that is what it is for. What is not allowed is deliberately degrading a host — fork bombs, IOPS storms designed to starve neighbours, or running a workload sized for a dedicated core on a shared one after we have asked you to move.
Reports
[email protected] is read by a person within 24 hours, every day. A report gets a reference; a report that names a specific resource and a time gets an answer.
What we do, and in what order
Escalation is published so that neither side has to guess. The table below is the whole ladder.
Appeals
Any action under this policy can be appealed to [email protected] and is reviewed by someone who did not take it. Content removed under a legal order stays removed; everything else can be argued about.
← the table scrolls sideways →
| conduct | first action | time | escalation |
|---|---|---|---|
| Outbound bulk email or relay | Port 25 rate-limited | immediate | Suspend after 24 h unfixed |
| Host joined to a botnet | Isolate at the switch, open ticket | immediate | Restore on clean rebuild |
| Outbound flood or port scan | Null-route the source IP | within 5 min | Terminate on repeat |
| Phishing page reported | Suspend that single IP | within 1 h | Terminate on second report |
| Copyright complaint received | Forwarded to you in full | 48 h to reply | Content disabled if no reply |
| Mining on a shared VPS | Throttle to fair-use CPU | immediate | Move to dedicated, or close |
| Confirmed illegal content | Takedown, no warning | immediate | Terminate; report to authority |
Every action on this ladder creates a ticket with the evidence attached, including the reporter's message where we are permitted to pass it on. We do not act on an anonymous report alone except for the last row.
第三 Privacy & DPA
Privacy and Data Processing
Who is responsible
For your account, billing and support records, Higan Holdings Limited is the controller. For anything you run on the platform, you are the controller and we are the processor: what we do with it is governed by the data processing terms in this part, which form the DPA.
Lawful bases
Contract, for running the service and billing it. Legitimate interests, for security, abuse prevention and keeping the network up — balanced against your rights and recorded. Legal obligation, for tax and for lawful requests. Consent, only for marketing email, which is off unless you switch it on.
What we hold
The categories, the clock and the reason are in the retention table below. Nothing is kept because it might be useful later.
Where it goes
Account and billing data sits in the United Kingdom. Instance data sits in the harbour you chose and does not leave it unless you move it. Support tickets sit in the United Kingdom. Transfers to processors outside the UK rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
Subprocessors
The current list is below and is part of this notice. Thirty days' notice is given on the notice board before a new subprocessor is engaged, and you may object; if we cannot resolve the objection you may terminate the affected service without penalty.
What we never do
We do not train models on customer prompts, images, volumes or traffic. We do not sell or share personal data. We do not read the contents of your volumes; the hypervisor cannot be asked to and the access path is audited.
Breach
A personal data breach affecting you is notified without undue delay and inside 72 hours of us becoming aware, to the account's security contact, with what we know at the time and what we do not yet know.
Your rights
Exercise any of them at [email protected] from the account address. The table below is the full set and the clock on each. You may also complain to the Information Commissioner's Office.
Cookies
The console sets one session cookie and one preference cookie. This website sets none, runs no analytics, and embeds nothing from a third party. There is no consent banner because there is nothing to consent to.
← the table scrolls sideways →
| processor | purpose | location | transfer basis |
|---|---|---|---|
| Higan Holdings Limited | Billing, accounting, group admin | London, UK | Domestic — no transfer |
| Northgate Payments | Card capture, 3-D Secure, fraud | Dublin, IE | UK adequacy regulations |
| Kestrel Mail Relay | Ticket, alert and receipt email | Frankfurt, DE | UK adequacy regulations |
| Registry back-end, per TLD | Domain registration and WHOIS | EU and US, by TLD | IDTA + TRA where US |
| Meridian Edge | Authoritative DNS, DDoS scrubbing | US, SG, JP | IDTA + TRA |
| Kanmon Facilities KK | Remote hands, HND-1 | Tokyo, JP | UK adequacy regulations |
| Hanryeo Datacentre Services | Remote hands, SEL-1 | Seoul, KR | UK adequacy regulations |
| Victoria Peak Technical | Remote hands, HKG-1 | Hong Kong | IDTA + TRA |
| Bayfront Colocation Inc. | Remote hands, JFK-1 and LAX-1 | New York and Los Angeles, US | IDTA + TRA |
| Sentry ID Checks Ltd | Sanctions and identity screening | London, UK | Domestic — no transfer |
Company names in this table are placeholders in a design specification and do not name real suppliers. IDTA is the UK International Data Transfer Agreement; TRA is the transfer risk assessment that accompanies it, reviewed annually. Remote-hands contractors touch hardware, never guest storage, which is encrypted at rest with keys held in the metro.
← the table scrolls sideways →
| data category | retained | basis |
|---|---|---|
| Account and billing records | 7 years after closure | Companies Act, HMRC |
| Invoices and payment references | 7 years | Statutory tax record |
| Support tickets and attachments | 3 years after last reply | Legitimate interests |
| Console and API access logs | 12 months | Security, legitimate interests |
| Hypervisor and flow logs | 30 days | Abuse handling |
| Abuse reports and evidence | 24 months | Establishing legal claims |
| Lotus Diffusion prompts and outputs | Not retained; 24 h queue buffer | Contract performance |
| GPU tenancy disk contents | Wiped within 2 h of release | Contract performance |
| VPS and VDS snapshots | 7 days rolling, 30 on request | Contract performance |
| Domain registration data | Term plus 5 years | Registry and ICANN rules |
| Marketing consent records | 3 years after withdrawal | Proof of consent |
| CCTV, LHR-1 office | 31 days | Site security |
Where two bases overlap the longer period wins, and only for the category named. Deleting your account does not delete the billing record: we are required to keep it, and clause 3.9 does not override clause 1.1.
← the table scrolls sideways →
| right | how to exercise | response time |
|---|---|---|
| Access | Console → Account → Data → Export | 30 days |
| Rectification | Edit in console, or email us | 30 days |
| Erasure | Close the account, then email us | 30 days |
| Restriction of processing | [email protected] | 30 days |
| Data portability | Console → Data → Export (JSON) | immediate |
| Object to processing | [email protected] | 30 days |
| Withdraw consent | Console → Account → Email | immediate |
| Not be subject to automated decisions | We take none; write to confirm | 30 days |
| Complain to a supervisory authority | ico.org.uk/make-a-complaint | ICO's own timescale |
Thirty days runs from the moment we verify who you are, not from the moment you write. A request may be extended to 90 days if it is complex, and we tell you inside the first 30 that we are extending and why. There is no fee unless a request is repetitive.
第四 Service Level
Service Level Agreement
The commitment
99.9% monthly availability per instance, per metro, measured at the harbour edge by probes outside our own network. In a thirty-day month that permits forty-three minutes and twelve seconds.
What counts as downtime
A minute in which the instance is unreachable at the harbour edge on both IPv4 and IPv6, for a reason inside our control. Partial degradation is not downtime; it is an incident, and it is published on the notice board either way.
What does not count
Scheduled maintenance announced at least seven days ahead, which we cap at four hours per quarter per harbour. Your own configuration, including a firewall rule that drops our probe. Anything upstream of AS207214 — transit providers, registry operators, and any other supplier we buy from rather than run. A volumetric attack against your own addresses, and any null-route we notify you of while one is in progress. Power or cooling failure at a facility we do not own. Force majeure and acts of government. The control plane and the website, which carry no SLA and are excluded deliberately rather than by omission.
Credits
The schedule is below. Credits are credits, not cash, and are capped at that instance's charge for that harbour for that month.
Claiming
Open a ticket within thirty days of the month closing, quote the instance ID and the window. We check it against the same probe data we publish, and the credit lands on the next invoice. There is no form.
What this clause is not
It covers one service in one metro. It is not a promise about an architecture that runs in one place, and it says nothing about support: we publish no response time, and none is implied anywhere on this site. Credits are the sole and exclusive remedy for missed availability.
| monthly uptime | downtime in a 30-day month | credit | claim window |
|---|---|---|---|
| 99.90% and above | up to 43 m 12 s | none — this is the commitment | no |
| 99.50% – 99.89% | 43 m 12 s to 3 h 36 m | 10% | 30 days |
| 99.00% – 99.49% | 3 h 36 m to 7 h 12 m | 25% | 30 days |
| 95.00% – 98.99% | 7 h 12 m to 36 h 00 m | 50% | 30 days |
| below 95.00% | over 36 h 00 m | 100% | 30 days |
Credit is a percentage of that month's fee for the affected service only, not the whole account. A VPS at $4.20 in a month of 99.2% uptime credits $1.05. Credits apply to the next invoice, are not paid in cash, and are the sole and exclusive remedy for missed availability. Bands are read against the metro the service runs in, not the account average, and the exclusions in 4.4 to 4.8 are taken out before the figure is calculated.
第五 General
Where to send things.
法5.1
Legal notices
Higan Holdings Limited, England & Wales, No. 16914818. [email protected]. Service by email is accepted.
私5.2
Privacy
[email protected], answered inside one month. You may also complain to the Information Commissioner’s Office.
濫5.3
Abuse and security
[email protected] for abuse; [email protected] for a vulnerability or a compromise. Both are monitored continuously; we publish no response time.