Privacy Policy

Last updated: October 31, 2026

This Privacy Policy explains how Yori ("we", "us") processes personal data when you use our websites and product. It is written for GDPR and similar privacy-by-design expectations. It is not legal advice; if you need counsel for your organization, please consult an attorney.

Who we are

Yori is a client accountability panel for agencies: it helps teams request work only a client can provide, send reminders, host portals, store homework evidence, and keep a clear record when timelines slip. The controller for website inquiries is the Yori operating entity. When an agency workspace uses the product with their clients, that agency is typically the controller of client homework content, and Yori acts as a processor under the agency's instructions.

Data we process

Account and staff data: name, email, organization name, role, seat membership, and authentication metadata (including Google SSO where enabled).
Client contacts: names and emails you enter so we can send magic links, portal access, and transactional reminders you configure.
Product content: Asks, messages, comments, kits, audit/history events, and files you or your clients upload.
Technical and security data: IP address (for rate limiting and abuse prevention), user agent, approximate timestamps, and CAPTCHA verification results (Google reCAPTCHA v3 when enabled: necessary security score/action checks, not marketing analytics).
Billing data when you subscribe (processed by Stripe; we store limited customer and subscription identifiers, not full card numbers).
Integration metadata when you connect webhooks or apps (endpoint URLs, delivery status, and related secrets stored securely).
Optional analytics cookies and events only after you consent (see our Cookie Policy).
Public Community Kit submissions you choose to publish (title, description, version, and ask templates you mark public).

Why we process it (purposes & legal bases)

Contract / service delivery: create accounts, enforce plan limits, run portals, send transactional reminders and magic links you initiate, store homework evidence, operate webhooks you configure, and provide support.
Legitimate interests: secure the service, prevent spam and abuse (CAPTCHA, rate limits, fair use), measure reliability, and improve product quality without unnecessary profiling.
Consent: optional analytics and marketing cookies and tags, never loaded before you accept them in the cookie banner.
Legal obligation: retain records where required (for example billing, tax, or security incidents).

Sharing & subprocessors

We use service providers (subprocessors) to run the product. Categories typically include: cloud hosting and compute; managed database; object storage for uploads; transactional email delivery; payment processing (Stripe); bot protection (Google reCAPTCHA); and, only after consent, analytics tags. We do not sell personal data. We do not share optional analytics identifiers until you grant analytics consent.

Enterprise customers may request a current subprocessor list under NDA. Provider names can change as we scale; material changes that affect processing of customer personal data will be handled consistently with our contracts and applicable law.

International transfers

If data is processed outside your country, we rely on appropriate safeguards (for example Standard Contractual Clauses or an adequacy decision) with our processors where required.

Retention

Account and workspace data are retained while the account is active and for a limited period afterward for backups, disputes, and legal compliance, then deleted or anonymized subject to lawful exceptions. Audit trails may be shorter on Free plans (for example a 14-day lookback in product) while underlying operational logs needed for security may differ. Contact-form messages are retained as needed to respond. Uploaded files follow workspace retention unless you delete them earlier or your plan storage forces cleanup after upgrade downgrades.

You may request deletion subject to verification and exceptions (legal holds, billing records, anonymized analytics aggregates).

Your rights

Depending on your location, you may request access, correction, deletion, restriction, portability, or objection to certain processing, and you may withdraw cookie consent at any time via Cookie preferences. Agency customers who control client homework content should route client rights requests through their own processes; we will assist as processor where appropriate. Contact us via the Contact page. You may also lodge a complaint with your local supervisory authority.

Children

Yori is built for professional agency workflows and is not directed at children under 16. We do not knowingly collect children's data.

Changes

We may update this policy as the product evolves. Material changes will be reflected by updating the "Last updated" date and, where appropriate, additional notice in-product.

Contact

Privacy questions: /contact. Also see our Terms of Service (including plan limits, fair use, and billing) and Cookie Policy.