Privacy Policy
Effective date: 27 July 2026
Last updated: 27 July 2026
This Privacy Policy explains how Yubano (“Yubano,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal data when you use and related applications and services (the “Service”).
1. Who we are
Yubano is the controller of personal data described in this Policy, except when we process personal data on behalf of a business customer under a Data Processing Addendum.
Privacy contact:
Data Protection Officer, if appointed: Not appointed; direct data-protection questions to
EU representative, if required: Not appointed
UK representative, if required: Not appointed
2. Scope
This Policy applies to the Service and our related support and business communications. It does not apply to third-party sites or services governed by their own privacy notices. A business customer may provide a separate notice for personal data it submits to the Service; in that setting, the customer is generally the controller and we are its processor.
3. Personal data we collect
Please do not submit government identifiers, financial-account credentials, health records, biometric templates, children’s data, or other sensitive personal data unless a feature expressly requests it and we have agreed to process it.
4. How we use personal data and our legal bases
Where we rely on legitimate interests, you may request information about our balancing assessment and may object as described below. Where we rely on consent, you can withdraw it at any time without affecting earlier processing.
5. AI processing and model training
We send prompts, selected account or project context, uploaded assets, and generated content to AI providers when needed to fulfill your requests. Providers differ in capability, location, retention, and contractual terms. Current providers are listed in our .
Training position:
- We do not use Customer Content to train our own general-purpose or foundation models.
- We do not permit third-party AI providers to use API-submitted Customer Content to train their general-purpose models.
- We do not use de-identified or aggregated service data to train general-purpose or foundation models.
Third-party model providers process your prompts and inputs to generate Outputs under their own terms—see the .
Even where training is disabled, providers may temporarily retain content for abuse monitoring, service delivery, or legal compliance, as described in our .
The Service does not make decisions producing legal or similarly significant effects about you solely through automated processing.
6. How we disclose personal data
We disclose personal data only as described below:
- AI generation and reasoning providers process prompts, uploads, and context to generate or evaluate content.
- Hosting, database, and media-storage providers operate the Service and store account, project, and media data.
- Observability and support providers process traces, which may include prompts and Outputs, to detect errors and improve reliability.
- PayPal processes payment and funding data and provides us transaction details needed to complete, reconcile, refund, secure, and support purchases. PayPal generally acts as an independent controller for this processing under its applicable , rather than as our subprocessor.
- Email and authentication providers support sign-in, verification, password reset, and communications.
- Search providers process queries and contextual snippets when a search feature is used.
- Professional advisers and authorities receive data when reasonably necessary for legal, security, audit, insurance, or compliance purposes.
- Corporate transaction recipients may receive data in diligence or as part of a merger, financing, acquisition, reorganization, or sale, subject to confidentiality and applicable law.
- At your direction we disclose data when you publish, export, share, or connect the Service to another tool.
The current vendor list is in our .
7. Sale, sharing, and targeted advertising
We do not sell your personal data, and we do not share it for cross-context behavioral advertising or process it for targeted advertising as those terms are defined by applicable U.S. state privacy laws. We will honor legally recognized opt-out preference signals, including Global Privacy Control, where required.
We do not knowingly sell or share the personal data of consumers under 16.
8. Cookies
We use cookies and similar technologies for authentication, security, preferences, and—only if enabled and legally permitted—analytics. Non-essential cookies are not set in the EEA/UK until consent. See the and your browser settings.
9. International data transfers
We and our providers may process personal data outside your country, including in the United States and the European Union. Those countries may have different data-protection laws.
For restricted transfers from the EEA, we use an adequacy decision or appropriate safeguards such as the European Commission’s Standard Contractual Clauses, together with supplementary measures where required. For UK transfers, we use an applicable adequacy regulation, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. You may request information about the relevant safeguard at .
10. Retention
We retain personal data only as long as reasonably necessary for the purposes described, including providing the Service, resolving disputes, enforcing agreements, and meeting legal, tax, accounting, security, and compliance obligations.
Deletion may be delayed for legal holds, abuse prevention, security investigations, or data that must be retained by law. We may retain aggregated or de-identified data that cannot reasonably identify you and will not attempt to re-identify it.
11. Security
We use administrative, technical, and organizational measures designed to protect personal data, including TLS 1.2 or higher, AES-256 (provider-managed), access controls, logging, backups, vulnerability management, and incident response. No system is completely secure. Keep credentials confidential and contact about suspected vulnerabilities or incidents.
12. Your rights and choices
Depending on location, you may have rights to:
- access and obtain a copy of personal data;
- correct inaccurate data;
- delete data;
- receive portable data;
- restrict or object to processing;
- withdraw consent;
- opt out of sale, sharing, targeted advertising, or certain profiling;
- limit use or disclosure of sensitive personal information;
- appeal our decision on a request; and
- complain to a data-protection authority.
Submit a request by emailing . We will verify the request proportionately and respond within the legally required period. An authorized agent may submit a request where law permits; we may require proof of authority and identity. We will not discriminate against you for exercising a privacy right.
You may unsubscribe from marketing through the message link, but we may still send transactional or security messages.
EEA and UK residents
You may complain to the supervisory authority where you live or work or where an alleged infringement occurred. You may also contact us first so we can try to resolve the issue.
California notice
The categories in Section 3 describe personal information collected in the preceding 12 months. Sections 4 and 6 state our business purposes and recipient categories. We retain each category under Section 10. California residents may exercise rights to know/access, delete, correct, opt out of sale or sharing, limit use/disclosure of sensitive personal information where applicable, and receive non-discriminatory treatment. Our sale/share position is in Section 7.
13. Children
The Service is for people 18 and older. We do not knowingly collect personal data from children. If you believe a child provided personal data, contact , and we will investigate and delete it as required.
14. Third-party personal data in Customer Content
If you upload personal data about someone else—including an employee, customer, model, actor, or creator—you are responsible for providing required notices and obtaining a valid legal basis, consent, release, or authorization. For business accounts where we act as processor, our applies if executed.
15. Changes to this Policy
We may update this Policy as the Service or law changes. We will post the new version and update the date above. We will provide additional notice of material changes when required. Prior versions are available on request.
16. Contact
Yubano