Legal
Privacy Policy
1. Who we are and what this covers
This policy explains what Zanja, LLC ("we," "us," "YAATZ") collects when you use YAATZ, why we collect it, who else receives it, and how long we keep it.
It covers the YAATZ application and the yaatz.ai website. It does not cover the third-party services described in section 5, which handle information under their own policies.
YAATZ is offered for business and professional use, as stated in our Terms of Service. This policy uses "you" to mean the person using the account.
2. What we collect
Account information. Your email address, and the sign-in records created when you log in. Sign-in is by emailed link; we do not store passwords because we do not use them.
Payment information. Our payment processor handles your card. We never see or store card numbers. What we hold is a customer reference, your subscription and plan state, the last four digits and card brand, billing dates, and the invoice and event records the processor returns to us — which include the name and address you gave at checkout.
Your content. The documents, notes, scripts, vaults, conversations, and other material you put into YAATZ, together with the output generated for you. This is the substance of the service and it is described in §8 of our Terms.
Usage records. Counts of what the service did on your behalf — which model answered, how many tokens, what it cost, when. These are numbers rather than text, with one exception: if you name a working session, that label is text you wrote and we store it alongside the counters.
Provider credentials. If your plan lets you supply your own AI provider API keys, we store them encrypted. They are write-only: once saved, no interface returns the key, and we display only the last four characters. They are not treated as content, and the analysis and development rights in §8 of the Terms do not apply to them.
Support correspondence. Anything you send to our support address, including whatever you choose to include in it.
Marketing information from our website. If you arrive from a link carrying campaign parameters, our site records them, along with advertising click identifiers, the address that referred you, and the page you landed on. These are stored in your own browser rather than sent to us, and reach us only if you submit a form. Section 4 describes this in full.
Technical infrastructure data. Our application tables do not store your IP address. Our hosting and authentication providers process IP addresses and related request information in their own security and server logs. We do not copy that information into our application tables, and we do not use it for analytics or advertising.
What we do not do. We do not track you across other websites. The YAATZ application loads no third-party scripts and runs no analytics of any kind.
3. Why we use it
- To operate the service, run your requests, and store your work
- To bill you, manage your subscription, and meet tax and accounting requirements
- To meter usage against your plan's allowance
- To notify you about your account — a failed payment, a cancellation, a change to these documents
- To keep the service secure, diagnose faults, and prevent misuse
- To understand how YAATZ is used and to develop and improve it, and to develop other products and services, as described in §8 of our Terms
That last purpose is broader than most software products claim, and we would rather state it plainly here than leave it to the contract. It expressly includes analysing your content and usage, building classifiers and retrieval systems, creating derived and aggregated datasets, fine-tuning models, and training models on customer content. It applies on every plan. There is no opt-out, and supplying your own provider credentials does not exempt you from it.
What we will not do with it is set out in §8 and §9 of the Terms and repeated in section 6 below.
4. Our website
The yaatz.ai marketing website is separate from the application and behaves differently.
Analytics. The website uses an aggregate analytics service provided by our hosting platform. It reports page views and traffic patterns. It does not use cookies to follow you between sites and does not build a profile of you.
Campaign attribution. If you arrive from an advertisement, a newsletter, or a shared link carrying campaign parameters, our site reads those parameters, any advertising click identifier in the address, the site that referred you, and the page you landed on. It keeps the first set indefinitely in your browser's local storage and the most recent set for your current session, and it adds them to links leading into the application, so that a sign-up can be attributed to the campaign that produced it.
This information stays in your browser, with two exceptions. If you submit a mailing-list form, it accompanies your submission to our email marketing provider. And if you open the Work With YAATZ page, the campaign source, medium and name, together with the address of that page, are passed to our form provider as the inquiry form loads — before you type anything, and whether or not you go on to submit it. Clearing your browser's storage removes what your browser holds. It does not recall what a provider has already received.
Fonts and external content. Fonts are stored on our own servers, and loading a page on our website makes no request to any font provider or content network, with one exception. The Work With YAATZ page embeds its inquiry form from a third-party form provider, so opening that page loads the form, and the provider's own script, from the provider's servers. Like any server a page loads something from, the provider receives your IP address and the details your browser sends with every request.
Inquiry form. If you submit the inquiry form on the Work With YAATZ page, what you enter goes to our form provider, along with the campaign information described above, and from there to us.
Mailing list. If you give us your email address on the website, it goes to our email marketing provider. You can unsubscribe from any message we send.
5. Who else receives your information
Running YAATZ requires other companies. Each receives only what its function requires.
AI providers. Your content is transmitted to third-party AI model providers to generate output. This is what the product does.
On managed plans, that processing is governed by our own agreement and configuration with the provider. Where you supply your own credentials, it is governed by your agreement with them. In either case we do not control the provider's infrastructure; its handling and retention of information are governed by the applicable provider terms and configuration, not by this Privacy Policy.
We do not name providers in this document so that we can replace one without amending a published policy; the current list is available on request.
Hosting and database. Our application and database are operated by infrastructure providers who necessarily hold your content and account records in order to store and serve them.
Payment processing. Our payment processor holds your card details, billing address, and payment history, and sends its own receipts and invoices to you directly.
Email. Notices about your account are sent through a transactional email provider. Sign-in links are sent through a separate service operated by our authentication provider. Receipts come from our payment processor. Three different companies therefore handle your email address for three different purposes.
Marketing email. If you join our mailing list, an email marketing provider holds your address and any campaign information submitted with it.
Forms. When you open or submit the inquiry form on our website, a form provider receives the information described in section 4.
Professional advisers and contractors. We may disclose information to employees, contractors, and service providers who need it to operate the service or to carry out the uses permitted by §8 of our Terms, and who are bound by confidentiality obligations at least as protective as ours.
Legal. We may disclose information where required by law or valid legal process, or to protect the rights and safety of others.
We do not sell your information, and we do not share it with advertising networks or data brokers.
6. Confidentiality
Non-public information you submit to or through YAATZ that a reasonable business would treat as confidential is Confidential Information, as defined in §9 of our Terms, and it remains so after your account closes.
We will not disclose it other than as §9 permits. We will not identify you as the source of anything we learn from it. Anything we deliberately publish based on what we learn is aggregated or de-identified so that it does not identify you or expose your Confidential Information.
Models trained on content can, in principle, reproduce fragments of it. We take reasonable measures to avoid that and we will not deliberately publish or distribute your proprietary material, but we do not promise it can never happen — that promise and the training right in §8 of the Terms cannot both be true, and we would rather say so than imply otherwise.
7. How long we keep it
While your account is open, we keep your content and records for as long as you have an account.
After your account closes, we keep your content for twelve months. If you sign back in to the same account within that window and start a new subscription, your work will be there. The period is the same whether you cancelled or your subscription ended for non-payment.
Billing and tax records are kept for as long as tax and accounting rules require, which is longer than twelve months.
Records of what happened — logs, timestamps, usage counts, and cryptographic hashes of content as we stored it — are kept so that we can establish what occurred in an account if it is later disputed. They do not include the content of documents.
8. Deleting your information
You may ask us to delete your account content at any time, by writing to our support address. We will do so within a reasonable period.
What deletion reaches: the documents and files stored in your account.
What it does not reach, and this is worth reading:
- Records of your use of the service — logs, timestamps, usage counts, and content hashes. These are what let us establish what occurred if it is later disputed.
- Models, classifiers, datasets, and other artifacts already created under §8 of the Terms. Material that has entered a trained model cannot be removed from it. We can stop using your content; we cannot untrain a model.
- Payment and billing records, which we are required to keep.
- Anything we must retain by law or legal process, or that relates to an actual or anticipated claim.
- Backups, which are overwritten on their normal cycle rather than edited.
- Copies you sent to another user. If you sent a document or folder to someone else through YAATZ, they received their own copy, which belongs to their account and is not removed when your account or your original copy is deleted. That copy carries your email address as the sender.
- Anything held by the AI providers your content was transmitted to. They retain and delete on their own schedules. Deleting content from YAATZ does not delete it from them.
We would rather set this out at length than let "we delete your data on request" carry an implication it cannot support.
9. Security
We maintain reasonable administrative, technical, and organisational safeguards appropriate to the nature of the service, as stated in §17 of our Terms.
Provider credentials you supply are encrypted. They are not retrievable through any interface once saved. Decryption is restricted to authorized production systems that need it for validation and provider authentication, and is unavailable on developer machines.
No system is completely secure, and we do not guarantee that unauthorised access will never occur.
10. Your choices
- Access and export. You can export your documents while your account is active. We recommend doing so before your access ends.
- Deletion. You may request deletion as described in section 8.
- Correction. You may correct your account email through the service or by writing to us.
- Marketing email. Every marketing message carries an unsubscribe link. Notices about your account are not marketing and cannot be unsubscribed from while your account is open.
- Campaign attribution. Clearing your browser's storage removes the information described in section 4 from your browser. It does not remove what a form or email provider has already received.
Depending on where you live, you may have additional rights under applicable privacy law, including rights to access, correct, delete, or obtain a copy of your information. Write to us and we will respond as the applicable law requires.
11. Children
YAATZ is for business use by adults. It is not directed to children, and people under 18 may not create an account.
Customer content may contain information about other people, including minors. Customers are responsible under our Terms for holding the rights and permissions required to submit that information.
If you believe a child has provided us with information directly, write to us and we will delete it.
12. Changes to this policy
We may update this policy. We will post the updated version with a new date and, where the change is material, notify you by email to the address on your account.
13. Contact
Zanja, LLC
1396 W 200 S STE 1G
Lindon, UT 84042
support@mail.yaatz.ai