Privacy Policy

This Privacy Policy explains how Yanola, operated by [Ras Al Khaimah Entity Name - to confirm in S059] (commercial licence [Licence Number - to confirm in S059], registered at [Registered Office Address, Ras Al Khaimah, United Arab Emirates - to confirm in S059]), acts as the data controller or processor for information collected through our website, application, developer platform, and integrated communication services.

We are committed to processing your data transparently, securely, and in full compliance with applicable data protection laws. For privacy inquiries or requests, contact our legal team at legal@yanola.ai.

We collect information necessary to operate our automation and WhatsApp messaging platform:

• Account Information: Name, email address, password hash, and organization details provided during registration and authenticated via better-auth.

• Billing Information: Payment transaction identifiers, subscription status, and billing history handled securely through Stripe. Full card numbers are processed directly by Stripe and never touch our servers.

• Platform Configuration and Usage: Agent configurations, visual workflow definitions, API keys, webhook configurations, and operational logs.

• WhatsApp Business Messaging Data: Phone numbers, WhatsApp Business Account (WABA) IDs, message delivery statuses, template definitions, and incoming/outgoing message payloads exchanged via the Meta WhatsApp Cloud API.

We share data with vetted third-party service providers (subprocessors) solely to deliver our services:

• Meta Platforms (Meta Platforms, Inc. / Meta Platforms Ireland Ltd.): WhatsApp Cloud API, Embedded Signup, and Graph API messaging infrastructure.

• OpenAI (OpenAI, LLC) & Anthropic (Anthropic, PBC): Artificial intelligence model providers processing automated workflow prompts and agent completions.

• Stripe (Stripe, Inc. / Stripe Payments Europe, Ltd.): Payment processing, subscription billing, Yanola Balance credits, and tax compliance via Stripe Tax.

• Resend (Resend, Inc.): Transactional email delivery for account verification, password resets, security notifications, and operational alerts.

• Cloudinary (Cloudinary Ltd.): Secure media storage and transformation for WhatsApp inbound and outbound multimedia assets.

• Cloudflare (Cloudflare, Inc.): Global DNS, DDoS mitigation, web application firewall (WAF), and SSL proxy infrastructure.

• Sentry (Functional Software, Inc.): Application error monitoring, crash reporting, and diagnostic performance tracking without sensitive personal identifiers.

• Vercel (Vercel, Inc.): Edge and serverless web hosting for our user interface and authentication endpoints.

• Database & VPS Infrastructure Host: Production MariaDB and encrypted backup storage (hosting provider to confirm in S059).

We retain personal and operational data only for as long as necessary to fulfill service objectives and satisfy statutory obligations:

• Statutory Records: Invoices, credit transactions, Yanola Balance movements, and security audit logs are kept for 5 years anonymised after Account deletion to satisfy accounting, taxation, and statutory audit obligations.

• Account Deletion Grace Period: When an account deletion is requested, all operational data enters a 30-day grace period during which deletion can be canceled. Upon expiry of this 30-day grace period, all associated workflows, agent configurations, API keys, contacts, and credentials are permanently purged.

• Data Export Window: Any requested account data export is packaged and made downloadable for 7 days from the signed-in account via on-demand 15-minute cryptographically signed URLs.

• Developer Platform Logs: Operational request logs and delivery metadata are retained according to the active Plan tier (7 days in Test Mode/Starter, 30 days in Pro, and 90 days in Scale/Enterprise) before automated redaction and purge.

In compliance with Meta Platform policies, Yanola maintains an automated data deletion callback endpoint for users who remove our application authorization via Facebook or Meta settings.

When triggered, the Meta callback deletes only data obtained through Meta (including user access tokens, encrypted PINs, Facebook user IDs, and WABA/phone number bindings). Historical conversation logs and non-Meta configuration remain linked to the Yanola Account until self-serve account deletion or explicit user request.

Users receiving a Meta deletion confirmation code can track the progress of their deletion at any time on the Meta callback status page.

Depending on your jurisdiction, you have the right to access, rectify, port, or request erasure of your personal data. You can exercise these rights directly within your account settings or by contacting legal@yanola.ai.

Governing law: This policy is governed by the laws of Ras Al Khaimah and the applicable federal laws of the United Arab Emirates.