This policy explains how WPZOOM BV ("Yamidoo", "we") handles personal data. It covers two groups of people: customers — the businesses and team members who use the Yamidoo dashboard — and visitors — people who chat with the Yamidoo widget on a customer's website. We are established in the Netherlands and the GDPR applies to everything we do.
1. Our role: controller or processor
- For customer account data (your login, workspace, billing) and forthis website, we are the data controller.
- For visitor data collected through a customer's widget (chat messages, contact details, browsing context), the customer is the controller and we are theirprocessor: we process it only on their instructions and under a data processing agreement. If you chatted with a widget on someone's website and have a question about your data, contact that website first — we'll help them respond.
2. Data we collect — customers
| Data | Why | Legal basis |
|---|---|---|
| Name, email, password (hashed) or Google sign-in identity | Create and secure your account | Contract |
| Workspace and project settings, connected content (pages, documents, written answers) | Provide the Service — the AI answers from this content | Contract |
| Billing details, VAT ID, invoices (payment card data is held by Stripe, never by us) | Charge for paid plans, comply with tax and accounting law | Contract; legal obligation |
| Usage data (conversations counted, features used, logs) | Enforce plan limits, keep the Service reliable and secure | Contract; legitimate interest |
| Emails you send us and support conversations | Support you | Legitimate interest |
| Waitlist / newsletter email | Tell you about launch and product updates | Consent — unsubscribe any time |
3. Data we process — visitors (on behalf of customers)
When you use a Yamidoo widget on a customer's site, the widget processes:
- Chat content — the messages you send and the answers you receive, any files you attach, and ratings you give.
- Contact details — your name and email address, only if you enter them (for example to be notified of a reply or to receive a transcript).
- Context — the page you're on and pages you visited on that site, referrer, browser and device type, approximate country, and your IP address (used for security, rate limiting, abuse prevention and to derive country).
- A random session identifier stored in your browser so your conversation continues across pages. It is not linked to any advertising profile.
Chat messages are sent to our AI provider to generate an answer, together with relevant excerpts of the customer's content. Neither we nor our AI providers use your messages to train AI models. The customer's team can read conversations in their dashboard and may reply to you by email if you gave an address.
4. Where data is stored
Our database and application servers are hosted in the United States(Supabase on AWS us-east-1 and Fly.io in Ashburn, Virginia). Transfers of personal data from the EU/EEA rely on the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework. We choose providers with strong security programmes and encrypt data in transit and at rest.
5. Sub-processors
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | United States (AWS us-east-1) |
| Fly.io | Application hosting | United States (Ashburn, VA) |
| Anthropic | AI language model that generates answers | United States |
| OpenAI | Text embeddings used to search your content | United States |
| Stripe | Payments, invoices and tax | United States / Ireland |
| Resend | Transactional and account email | United States / EU (Ireland) |
| Cloudflare | Website hosting, DNS, bot protection (Turnstile) | Global edge; EU/US |
| Fathom Analytics | Privacy-friendly, cookieless analytics on yamidoo.ai | EU (isolated) |
| Google Workspace | Our support mailbox (hello@) | EU / US |
We'll update this list when we add or change a sub-processor; customers on paid plans can ask to be notified of changes by email.
6. How long we keep data
- Account and workspace data: for as long as your account is active. After you cancel, we keep it for up to one year so you can reactivate, then delete it. You can delete your workspace immediately from Settings, or your whole account — including every workspace you own and every file you uploaded — from Account.
- Visitor conversations: for as long as the customer keeps them; customers can delete conversations and visitor records from their dashboard.
- Visitor IP addresses: retained for security purposes (rate limiting, abuse prevention, approximate country) and deleted automatically once a visitor has been inactive for 90 days.
- Invoices and payment records: 7 years, as required by Dutch tax law.
- Security and access logs: up to 90 days.
7. Your rights
Under the GDPR you can ask to access, correct, delete, or export your personal data, restrict or object to certain processing, and withdraw consent where processing is based on consent. Emailhello@yamidoo.ai and we'll respond within one month. If you're a visitor to a customer's website, we'll route your request to that customer. You also have the right to lodge a complaint with your supervisory authority — in the Netherlands, theAutoriteit Persoonsgegevens.
8. Security
Every customer's data is isolated at the database level (row-level security), all traffic is encrypted with TLS, passwords are hashed, file uploads are stored privately and served through short-lived signed links, and access to production systems is restricted to the people who need it. No system is perfectly secure; if we learn of a breach affecting your data we'll notify you and the authorities as the law requires.
9. Cookies and browser storage
See our Cookie & Storage Notice. In short: this website uses no tracking cookies; the app uses strictly necessary sign-in cookies; the widget stores a session identifier in your browser's local storage.
10. Children
The Service is intended for businesses and is not directed at children under 16. We don't knowingly collect their data; if you believe we have, contact us and we'll delete it.
11. Changes
We'll post any changes here and update the date at the top. For material changes affecting customers we'll also email you.
12. Contact
WPZOOM BV, Herengracht 420, 1017 BZ Amsterdam, The Netherlands — KvK 70938105. Email: hello@yamidoo.ai. Product: https://app.yamidoo.ai.