Privacy Policy

Effective: 2026-06-02 · Last updated: 2026-06-02

1. Who we are

yandee.ai ("we," "us," "our") provides Google Reviews growth automation for service businesses. We operate from Malaysia. For questions: [email protected].

2. What we collect

• Account data: name, email, business name, billing address, payment information processed by Stripe.
• Connected platform data: when you grant us access to Google Business Profile or Meta Business Suite via OAuth, we receive read/write access to reviews, posts, and page metadata strictly within the scope you authorise.
• Usage data: standard server logs (IP, user agent, request timestamps), product analytics events.
• Cookies and tracking: Meta Pixel and Google Analytics for marketing attribution. You can opt out via your browser settings.

3. How we use it

We use your data to (a) deliver the Service you subscribed to, (b) draft AI replies to reviews on your behalf for your approval, (c) bill you, (d) communicate service updates, (e) improve our product through aggregated analytics. We do NOT sell your data.

4. Third-party services we use

• Google APIs (Business Profile, OAuth) — bound by Google API Services User Data Policy including Limited Use requirements.
• Meta Platform APIs (Facebook, Instagram) — read/write to your pages, bound by Meta Platform Terms.
• Stripe — payment processing (PCI-DSS Level 1).
• Cloudflare — hosting and CDN.
• OpenAI / Anthropic — LLM inference for draft replies; we send review text and your brand voice instructions but no PII.
• SendGrid / Postmark — transactional email.

5. OAuth permissions explained

When you connect Meta or Google, we request only the permissions necessary to operate the Service: read reviews, draft replies, publish replies you have approved, read page insights for reporting. We never publish without your explicit approval setting (auto-approve must be turned ON by you). Tokens are encrypted at rest (AES-256).

6. Data retention

We retain account data for the duration of your subscription plus 90 days post-cancellation for billing/legal purposes. Connected platform tokens are deleted immediately on cancellation or disconnect. Aggregated analytics may be retained indefinitely in non-identifiable form.

7. Your rights

You may request access, correction, export, or deletion of your data at any time by emailing [email protected]. We respond within 30 days. You may also use our self-serve deletion flow at yandee.ai/data-deletion.

8. Security

We use TLS in transit, AES-256 at rest, role-based access control for staff, and quarterly access reviews. We will notify affected users within 72 hours of any confirmed data breach.

9. International transfers

yandee.ai operates primarily in Malaysia. Some sub-processors (Stripe, Cloudflare, OpenAI) are headquartered in the US. By using the Service you consent to transfer of your data to these jurisdictions under Standard Contractual Clauses where applicable.

10. Children

The Service is not intended for users under 18. We do not knowingly collect data from minors.

11. Changes

We will notify users of material changes via email and update the "Last updated" date above. Continued use after notice constitutes acceptance.

12. Contact

yandee.ai · [Registered business address] · Malaysia
Privacy questions: [email protected]