Privacy Policy

1. Who controls your data

the operator of Yapito is the controller of personal data processed through Yapito. You can make an access, correction, portability, deletion, restriction, or objection request through our Privacy Controls.

2. The data we collect

• Google account data: your Google account identifier, verified email address, name, and profile picture when you choose Google sign-in.
• Content: topics, drafts, directions, prompts, and generated outputs that you submit through creator tools.
• Service records: feature used, AI model, token counts, estimated processing cost, timestamps, projects, and generation history.
• Security and delivery data: limited request, device, network, and diagnostic data processed by our hosting and infrastructure providers to operate, protect, and troubleshoot the service.

We do not intentionally collect payment-card details, government identifiers, precise location, health data, biometric data, or other sensitive personal data. Please do not place sensitive or confidential information in a prompt.

3. Why we use it and our legal bases

• Provide the service and your account: authenticate you, generate and save content, apply usage limits, and provide support. For users in the EEA, UK, and Switzerland, this is necessary to perform our contract with you or to take steps you request before entering it.
• Keep Yapito secure and reliable: prevent abuse, diagnose failures, enforce our Terms, and protect users. We rely on our legitimate interests in operating a safe service, balanced against your rights.
• Meet legal duties: respond to lawful requests, preserve evidence, and comply with accounting, sanctions, and other applicable laws.
• Optional uses: if we introduce a use that requires consent, such as non-essential analytics or marketing cookies, we will ask first and allow withdrawal as easily as consent was given.

Yapito does not use your content for targeted advertising, does not sell personal information, and does not share it for cross-context behavioral advertising. Because those activities do not occur, a Global Privacy Control signal is honored by default.

4. AI processing

When you click generate, your submitted text is sent to DeepSeek to produce the requested output. AI processing may involve short-lived provider-side caching. Yapito also stores the submitted input and resulting output in Supabase so that it is associated with your account. AI output is probabilistic and may be inaccurate; do not rely on it for legal, medical, financial, employment, credit, housing, or other high-impact decisions.

Yapito does not use automated processing to make decisions that produce legal or similarly significant effects about you.

5. Who receives data

We share data with trusted providers that help us run Yapito, including Google, Vercel, Supabase, and DeepSeek when you use an AI tool. We may also disclose data when required by law or to protect users and the service. We do not sell your personal information.

6. International transfers

These providers may process data in countries outside your own. Where required, we will use a recognized transfer safeguard, such as an adequacy decision, Standard Contractual Clauses, the UK Addendum, or another lawful transfer mechanism, and assess supplementary safeguards appropriate to the transfer. You may request information about the applicable safeguard through Privacy Controls.

7. Retention

Account details, generations, projects, and usage records are kept while your account is active because they support the service and its security. You can delete account data at any time. We may retain narrowly limited records after a request only when required by law, necessary to resolve disputes or prevent fraud, or present in provider backups until they rotate out of the provider’s normal backup lifecycle. Such copies are isolated from ordinary use.

A draft typed before sign-in stays only in your browser session storage so it can survive the sign-in redirect. It is removed after a successful generation and is otherwise cleared when the browser clears that session storage.

8. Security

We use data minimization, HTTPS in transit, restricted server-side database credentials, signed HTTP-only session cookies, OAuth PKCE, least-privilege architecture, and browser security headers. No system is perfectly secure. If a breach creates a legally notifiable risk, we will notify affected people and regulators as required.

9. Your rights worldwide

Subject to applicable law and limited exceptions, you may ask us to confirm processing; access, correct, or delete personal data; receive a portable copy; restrict or object to processing; withdraw consent; and appeal a refused request. You may also complain to your local data-protection or consumer-privacy authority. We will not discriminate against you for exercising a privacy right.

EEA, UK, and Switzerland

You have the rights described above, including the right to object to processing based on legitimate interests. You may complain to the supervisory authority where you live or work. Where EU or UK representative or data-protection-officer details become legally required, they will be published here before the relevant processing begins.

United States

Residents of California and other states with comprehensive privacy laws may have rights to know, access, correct, delete, and obtain a portable copy, and to opt out of sale, targeted advertising, or certain profiling. Yapito does not perform those opt-out activities. Authorized agents may submit requests, subject to verification of authority and identity. California users may also request the categories and specific pieces of information collected, sources, purposes, and recipient categories. We do not offer financial incentives for personal data.

Other regions

We extend the access, correction, portability, and deletion controls in this notice to all users, even where local law does not require every right. Additional rights under laws such as Brazil’s LGPD, Canada’s privacy laws, Australia’s Privacy Act, India’s Digital Personal Data Protection Act, and similar laws may apply according to their scope and effective provisions.

10. Exercising a right

Use Privacy Controls to download or delete account data. Google account details can be corrected in Google and refreshed at your next sign-in. For another correction, restriction, objection, authorized agent, or appeal request, use the privacy contact listed above. We may need enough information to verify that the request concerns you. We respond within the period required by applicable law and will explain any extension or refusal.

11. Children

Yapito is not directed to children. You must be at least 18 to create an account. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided data, contact us so it can be investigated and deleted.

12. Changes

We will update the date at the top when this notice changes. If a change materially reduces your rights or introduces a materially different use, we will provide prominent notice and seek consent where law requires it.