This Privacy Policy describes how Yipy, Inc. ("Yipy," "we," "us," or "our") collects, uses, and shares personal information when you use our websites, applications, and related services (collectively, the "Services").
1. Scope and Our Role
This policy covers personal information that Yipy handles for its own purposes, including information about visitors to our websites, prospective clients, and business contacts. For this information, Yipy is the controller.
Our clients use the Yipy platform to manage their own teams. When we process information about a client's personnel (for example, the name, business email address, and job title of a user the client invites), we do so on the client's behalf and according to its instructions. In that case the client is the controller and Yipy is the processor, and the processing is governed by our agreement with the client, including any data processing agreement. If you use Yipy through your employer, your employer's privacy notice also applies, and requests about your information may be referred to them (see Your Rights).
2. Information We Collect
We collect the following categories of information when you use Yipy:
- Account information: Name, business email address, job title, organization and property or business unit, and login credentials. Login credentials are managed by our authentication provider.
- Usage information: Activity within the app, pages viewed, features used, audit and workflow activity, authentication events, and time-based logs.
- Device and technical information: IP address, browser type, operating system, device identifiers, and log files generated by our servers and infrastructure.
- Content you or your organization provide: Standards, inspection and audit records, comments, and file attachments (such as photos) added to the platform. Attachments may incidentally contain personal information.
- Support communications: Any information you provide when you contact us for assistance.
- Business contact information: Name, business email address, company, and job title when you request a demo, apply to a program, or otherwise contact us.
- Cookies and similar technologies: As described in our Cookie Policy, we use essential cookies for authentication and service functionality. Non-essential cookies (such as analytics) are only used with your consent where required by law.
We do not intentionally collect sensitive personal information or information about individuals under 18. The Yipy platform does not collect, store, or process hotel guest records, payment card data, bank or financial account data, health data, government identifiers, or any special category personal data.
3. How We Use Your Information
We use personal information to operate and improve the Yipy platform, including:
- Creating and managing user accounts
- Providing and maintaining the functionality of the Services
- Improving product performance, reliability, and security
- Responding to support requests and communicating with you
- Responding to demo requests and other business inquiries
- Detecting, preventing, and addressing technical issues or misuse
- Complying with legal obligations
We do not use personal data for automated decision-making that produces legal or similarly significant effects.
4. Optional AI Features
Yipy offers optional features that use AI models to analyze a client's own content, for example to summarize reports or to answer questions through an in-platform assistant. These features are only used where the client has enabled them. When they are used, the content involved (such as inspection and audit records, standards and catalog text, file attachments, and the messages a user types) is sent to AI models provided by our cloud service provider.
This processing takes place in the United States, and your content is not used to train AI models.
5. Legal Bases for Processing
Where data protection laws such as the GDPR apply, we rely on the following legal bases when Yipy is the controller:
- Performance of a contract: to provide the Services and manage our relationship with you or your organization.
- Legitimate interests: to operate, secure, and improve the Services and to respond to business inquiries, where these interests are not overridden by your rights.
- Legal obligation: where we must process information to comply with the law.
- Consent: for non-essential cookies and where otherwise required. You can withdraw consent at any time.
Where Yipy processes information on a client's behalf, the client is responsible for establishing its own legal basis.
6. How We Share Information
We do not sell personal information. We may share information only in the following situations:
- Service providers: Trusted vendors who support hosting, infrastructure, file storage, authentication, email delivery, AI analysis, content delivery and network security, logging, and monitoring. These providers may process personal data on our behalf under contractual confidentiality, security, and data protection obligations, and only according to our instructions.
- Legal reasons: If required to comply with a law, regulation, or valid legal request.
- Business transfers: If Yipy undergoes a merger, acquisition, or other corporate transaction.
We do not share personal information with advertisers or social media companies.
7. Cookies and Tracking Technologies
We use essential cookies necessary for login, security, and core functionality. Non-essential cookies, such as analytics or behavioral monitoring tools, are only used with your consent where required by law. On our marketing website, we use Google Analytics only if you accept non-essential cookies.
Details are available in our Cookie Policy.
8. Data Retention
We retain personal information for as long as necessary to provide the Services, comply with legal obligations, resolve disputes, and maintain reliable internal records. When data is no longer needed, we delete it or anonymize it.
Client platform data is retained for the duration of the client relationship and is deleted or returned at the end of it, in accordance with our agreement with the client. When a record is deleted, it is removed from our active systems, and residual copies in encrypted backups are removed as those backups expire. Application logs are retained for up to 365 days.
9. Security
We use technical and organizational measures designed to protect personal information, including encryption, access controls, and secure infrastructure. Data is encrypted in transit using TLS 1.2 or higher and encrypted at rest, and access to personal data is restricted to authorized personnel on a least-privilege basis. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
10. Where Your Data Is Processed
Yipy and its service providers process personal information in the United States. Where a client transfers personal data to Yipy from the European Economic Area or the United Kingdom, that transfer is governed by the Standard Contractual Clauses included in our data processing agreement with the client.
11. Your Rights
Depending on your location, you may have certain rights over your personal information, including the right to:
- Access the information we hold about you
- Request correction or deletion
- Object to or restrict certain processing
- Receive a copy of your information in a portable format
- Withdraw consent, including for non-essential cookies
To exercise any of these rights, contact us. If your information is held on behalf of your employer or another Yipy client, we may refer your request to them as the controller and will assist them in responding.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Updates will be posted on this page with a revised "Last updated" date. Your continued use of the Services after changes become effective means you accept the updated policy.
13. Contact Us
If you have any questions about this Privacy Policy or would like to exercise your rights, please contact us at [email protected].
Yipy, Inc.
99 W South Temple #1305
Salt Lake City, Utah 84101
United States