Privacy policy

Last updated: September 17, 2025

yaya is a business suite. You describe your business, and yaya generates your website and keeps working on it. This page says what data we keep, who handles it for us, and how to reach us. Short version: we keep what the service needs to run, we do not sell personal information, and you can email us any time about your data.

What we keep

• Account. Your email address, your name, and your profile image when you sign in with Google. We also keep sign-in session records, which include an IP address and a browser identifier.
• Business record. What you tell us about the business: name, description, contact details, services, prices, hours, and links.
• Site content. The pages, drafts, images, and published versions of your site, plus files you upload.
• Workspace data. Members and invitations, domains you connect or buy, API keys you create, and billing records such as your plan, invoices, and payment status. Your card number stays with Stripe; we never see it.
• Customer and lead data. Details about your own customers that you choose to store in your workspace. Contact links on a generated site point at the email and phone you publish, so visitor enquiries reach you directly.
• Communications. What you send us when you contact us, including the address you write from and what you say.
• Usage and technical data. Product events, request logs, and device and browser details, which we use to keep the service secure and to improve it.

How we use it

• To run the service: sign you in, generate and host your site, and keep your workspace.
• To send the emails the service exists to send: sign-in links, workspace invitations, invoices, and replies you ask us to send to your customers.
• To process domain purchases and paid plans you ask for.
• To keep the service secure: bot checks on sign-in, rate limits, and server logs.
• To improve the product through product events and usage logs.

Where the law asks for a legal basis, we rely on the contract with you to run the service, on our legitimate interests in security and product improvement, and on consent where we ask for it.

Who processes it

• Cloudflare runs the service: hosting, the database, file storage, the sign-in bot check, and email delivery.
• Google handles sign-in. When you continue with Google, we receive your name, email address, and profile image, and we store the tokens that keep you signed in.
• Stripe processes payments. When you buy a domain or a plan, Stripe handles the payment. We do not see or store your card number.
• Cerebras is the model provider that drafts site text. It receives your business name, description, and category. It does not receive your email or sign-in data.

Checking whether a domain is free queries public registry records and a registrar pricing feed. Picking stock photos sends image search terms to the photo libraries. Neither carries your sign-in details. We contract with our processors to handle your information only for the service.

We do not sell personal information, and we do not share it with advertisers.

When we share

We share personal information only in these cases:

• when you ask us to or give permission;
• with the processors above, to provide the service;
• when the law requires it, and we tell you when the law allows us to;
• to prevent harm to you, to other users, or to the public; and
• if the business is reorganized, acquired, or sold, in which case your data can transfer to the successor under the commitments on this page.

Your customer data

For the data you collect about your own customers and site visitors, you are the controller and we are the processor. We handle it only to run the service for you. You are responsible for telling your customers how you use their data and for answering their requests.

How long we keep it

We keep your data while your account or workspace exists. We have not set fixed retention windows yet. Deleting a workspace removes its site content, files, and records from our database and storage. We may keep limited records afterward where the law requires it, for example for bookkeeping, or to prevent fraud and abuse.

Security and location

Your data is stored and processed on the Cloudflare network, which may be in a different country than yours. Traffic is encrypted in transit. We hold no security certifications and do not claim them. No method of transmission or storage is completely secure; if we learn of a breach that affects your data, we will tell you.

Cookies

We set a session cookie to keep you signed in, and the sign-in bot check may set one of its own. On yaya.page we also use Google Analytics and Microsoft Clarity to measure how people use yaya. They set cookies that count visits and record page views, clicks and, for Clarity, masked session replays. We do not run them on the sites you build with yaya. We do not use advertising cookies.

Your rights and choices

You can update your business details in the workspace, export your workspace data, or delete a workspace. To get a copy of your data, or to delete a workspace or your account, email us at hello@yaya.page.

Depending on where you live, the law gives you rights such as knowing what personal data we hold, accessing it, correcting it, deleting it, objecting to or limiting how it is used, taking a copy elsewhere, and not being discriminated against for exercising a right. This includes the rights in the GDPR for people in the EU and in the CCPA, as amended by the CPRA, for California residents. We do not sell personal information, so there is no sale to opt out of. To exercise a right, email hello@yaya.page. You can also complain to your local data-protection authority.

For data-protection requests, including access, objection to outreach, and erasure, email dpo@yaya.page.

Children

yaya is for people aged 18 and over.

Changes

When the product changes, we update this page. The date at the top moves.

Contact

Email hello@yaya.page. The terms of service are on their own page.