Yori Privacy Policy
Introduction
This Privacy Policy explains how Yori AI Limited (“Yori”, “we”, “us” and “our”) collects, uses, shares, stores, transfers and protects personal data when people visit our websites, create accounts, use the Yori generative AI platform and related services, participate in workspaces, contact us, or otherwise interact with us (the “Services”).
Yori is designed for business use. In many cases, a company, organisation, Enterprise host, partner, employer, client or workspace administrator decides how Yori is used and what information is submitted to the Services. In those cases, that organisation is usually the controller of workspace content and Yori acts as its processor under the Data Processing Addendum (“DPA”).
This Privacy Policy should be read together with the Yori Terms and Conditions (the “Terms”), the DPA, the Acceptable Use Policy, the Cookie Policy and any applicable ordering documentation or in-product notices. Capitalised terms not defined in this Privacy Policy have the meanings given in the Terms.
Scope and roles
Who we are. Yori AI Limited is a company incorporated and registered in England and Wales with company number 16594533 and registered office at Pure Offices, Wilton Drive, Warwick, Warwickshire, United Kingdom, CV34 6RG. For privacy questions or requests, contact legal@askyori.ai. Yori has not appointed a data protection officer. If Yori appoints a data protection officer or a representative in the European Union for a relevant processing activity, Yori will make those details available in this Privacy Policy.
When Yori is controller and when Yori is processor. Yori acts as controller for account administration, billing, authentication, security, website, marketing, support, product analytics, service-improvement and business operations data that Yori determines how and why to process. Yori acts as processor for Customer Content, workspace content, connected-service content and other personal data submitted to the Services by or on behalf of a Customer, except where the Terms, the DPA, this Privacy Policy or applicable law permit Yori to process that data as controller for security, legal, misuse-prevention, service-integrity, billing or other independent purposes described in this Privacy Policy.
If you use Yori through an organisation. If your account is provided or managed by an organisation, that organisation may control workspace settings, memberships, access permissions, billing information, usage records, prompts, files, Outputs and other workspace content. Workspace owners and administrators may be able to access, delete, restrict or manage your workspace data. For requests about Customer Content or workspace data controlled by your organisation, you should usually contact that organisation first.
Personal data we collect
Depending on how you use the Services, we may collect the following categories of personal data. We do not require users to submit special category data, criminal-offence data, children’s data or other highly sensitive data to the Services. If you or your organisation choose to submit that data, you are responsible for ensuring that you have the rights, notices, lawful bases, permissions and safeguards required by applicable law.
| Category | Examples | Typical sources |
|---|---|---|
| Account, identity and access data | Name, email address, profile image, user identifiers, authentication identifiers, organisation membership, role, permissions, invitation status and account settings. | You, your organisation, workspace administrators and our authentication provider, Clerk. If you sign in with Google or Microsoft, we receive your name, email address and profile image from that provider. |
| Workspace and customer administration data | Workspace name, workspace slug, organisation details, website URL, Enterprise or partner metadata, user assignments, account configuration and customer-support context. | You, your organisation, Enterprise hosts, partners and workspace administrators. |
| Customer Content and AI interaction data | Prompts, messages, Inputs, Outputs, uploaded files, imported documents, attachments, images, canvases, project materials, notes, comments, chat history, connected-service data and other content made available to the Services. | You, your organisation, authorised users, connected services and public sources that you ask the Services to access. |
| Assistant memory | Facts and preferences that Yori’s assistant saves about you to personalise future conversations, such as how you like to write, the people you work with and details about your business. | Your conversations with Yori’s assistant. |
| Voice dictation | Audio you record when you dictate a message. Yori sends the audio for transcription and does not store it. | You. |
| AI, model, tool and usage metadata | Model, provider, routing, request, token, credit, cost, cached-token, reasoning-token, tool-call, workflow, feature-usage, success/failure, error and timestamp metadata. | Generated automatically when the Services operate. |
| Billing, payment and tax data | Billing contact details, billing email, company name, billing address, tax identification number, payment method metadata, subscription, invoice, usage, tax, purchase-order and Stripe identifiers. | You, your organisation and Stripe. |
| Technical, device, security and log data | IP address, device and browser information, user agent, session data, cookies, local storage entries, authentication events, audit logs, rate-limit events, bot-detection signals, abuse indicators, security logs and diagnostic records. | Collected automatically from your device, browser, network and use of the Services. |
| Email updates and marketing data | Email address, name where we have it, where you signed up, whether you are subscribed, and whether you opened a marketing email or clicked a link in it. | You, your Yori account and our email provider, Loops. |
| Support, feedback and communications data | Emails, support requests, demo requests, feedback, bug reports and attached screenshots, call notes, customer-success records and related communications. | You, your organisation and Yori personnel. |
| Public, third-party and connected-source data | Public website content, search results, brand and profile research, and CRM, advertising, support, project, finance, calendar, email, document or other data from third-party applications that you or your organisation connect, including the email address or display name of each connected account. | Public sources, connected services, authorised integrations and customer-directed tools. |
Information you must provide
You must give us your name and email address to create an account, and billing details to buy a paid plan. We need this information to provide the Services under our contract with you or your organisation. If you do not provide it, we cannot provide the Services. Other information is optional, although some features will not work without the content they are designed to process.
How we collect personal data
We collect personal data directly from you when you create an account, configure a workspace, upload files, submit prompts, dictate messages, connect third-party applications, submit feedback, request support, sign up for email updates, subscribe, pay invoices or communicate with us.
We collect personal data from your organisation, Enterprise host, partner, workspace owner or administrator when they invite, provision, assign, manage or support users.
We collect personal data from third-party providers that support authentication, billing, infrastructure, AI routing, model access, web research, document conversion, connected-application integrations and other service functions.
We collect personal data from connected services and public sources when you or your organisation instruct the Services to retrieve, process, analyse or generate content using those sources.
We collect personal data automatically through logs, cookies, local storage, metadata, usage records, billing records, security events and, where you consent, privacy-preserving website analytics.
How we use personal data and our lawful bases
Where the UK GDPR or EU GDPR applies and Yori acts as controller, Yori relies on the lawful bases set out below. Where Yori acts as processor, the Customer is the controller and decides the lawful basis for the processing, and Yori processes personal data under the Terms and the DPA.
| Purpose | What we do | Lawful basis (Article 6(1) UK GDPR) and our legitimate interests |
|---|---|---|
| Provide and administer the Services | Create accounts, authenticate users, manage workspaces, process prompts, generate Outputs, store project context, save assistant memory, operate connected applications, provide chat history and deliver support. | Contract (Article 6(1)(b)) where you are our customer. Otherwise legitimate interests (Article 6(1)(f)) in providing the Services that your organisation has asked us to provide to you. |
| Billing and commercial operations | Process payments, subscriptions, invoices, taxes, credits, usage records, failed payments, refunds and billing support. | Contract (Article 6(1)(b)), legal obligation (Article 6(1)(c)) for tax and accounting records, and legitimate interests (Article 6(1)(f)) in managing our business and collecting amounts owed. |
| Security, abuse prevention and service integrity | Authenticate users, check sign-ups for bots, detect suspicious activity, enforce rate limits, investigate misuse, monitor errors, protect systems and enforce the Terms and AUP. | Legitimate interests (Article 6(1)(f)) in keeping the Services and our users secure and preventing fraud and misuse, and legal obligation (Article 6(1)(c)) where the law requires it. |
| AI routing, generation and third-party model access | Send prompts, Inputs, Outputs, uploaded images, audio and request metadata (including user, workspace and conversation identifiers) to AI routing, model, embedding, transcription and evaluation providers as needed to deliver the feature you use. | Contract (Article 6(1)(b)) and legitimate interests (Article 6(1)(f)) in providing the AI features of the Services. |
| Diagnosing failed AI responses | When an AI response fails, automatically send the affected part of the conversation, with secrets removed, to an AI model to identify the cause, and review the results. | Legitimate interests (Article 6(1)(f)) in keeping the Services reliable and fixing faults. |
| Product analytics, debugging and improvement | Analyse Usage Data, performance, reliability, feature use, token and cost data, errors, operational metadata and de-identified or aggregated trends. We do not use Customer Content to train, fine-tune or improve large language models. | Legitimate interests (Article 6(1)(f)) in understanding and improving the Services. Consent (Article 6(1)(a)) for optional website analytics (see the Cookie Policy). |
| Feedback and support | Handle feedback and bug reports, including screenshots you attach, in our issue-tracking tools, and respond to support requests. | Legitimate interests (Article 6(1)(f)) in supporting users and fixing problems. |
| Communications and marketing | Provide service messages, send administrative notices, manage sales communications, send product news and marketing by email where permitted by law, and measure whether those emails are opened and which links are clicked. | Contract (Article 6(1)(b)) for service messages. Legitimate interests (Article 6(1)(f)) in promoting our business. Consent (Article 6(1)(a)) where the Privacy and Electronic Communications Regulations 2003 require it. |
| Legal compliance and claims | Keep required business records, respond to lawful requests, comply with tax, accounting, regulatory and court obligations, and establish, exercise or defend legal claims. | Legal obligation (Article 6(1)(c)) and legitimate interests (Article 6(1)(f)) in protecting our legal position. |
Where we disclose personal data to prevent or detect crime, to safeguard vulnerable individuals, to respond to an emergency or for national security, we may rely on a recognised legitimate interest under Article 6(1)(ea) of the UK GDPR.
AI features, model providers and human review
AI processing. The Services use third-party AI infrastructure, including AI routing providers, model providers, inference providers, embedding providers, transcription providers and evaluation providers. Yori sends AI requests through Vercel AI Gateway, which passes each request to a provider that serves the model Yori has selected for the feature. Yori also uses OpenRouter as a fallback routing provider for document search embeddings. The providers that currently serve Yori’s models are listed in Annex 2 of the DPA. Provider data handling practices may vary by provider, model and configuration.
No model training by Yori. Yori does not use Customer Content to train, fine-tune or otherwise improve AI models. Yori selects Third-Party Models whose underlying providers are identified by Yori’s AI routing provider as not using prompts, completions or other request data for model training, with the exception of certain image generation models from Recraft and Black Forest Labs, whose providers have not been identified in that way.
Provider retention. “No model training” and “zero data retention” are different controls. Yori requests zero data retention for its writing quality check and for the scoring step of its brand review. For other features, Third-Party AI Providers may retain Customer Content, Inputs, Outputs, metadata or logs for limited operational purposes, including abuse monitoring, safety, security, service provision, debugging, compliance or legal obligations, in accordance with their own terms and policies.
Document conversion. When you upload documents such as PDF, Word, Excel or PowerPoint files, Yori sends them to its document conversion provider, Firecrawl, to extract their text. Firecrawl may retain the files for a limited period under its own terms.
Assistant memory. Yori’s assistant may save facts and preferences you share in conversations, such as your writing preferences, colleagues and business details, so that it can personalise future conversations in the same workspace. You can view saved memories in the Services under Knowledge, then Memory, and ask the assistant in any chat to change or remove them. You can also turn memory off for yourself in a workspace on the same page. While memory is off, the assistant does not read or save memories, and the memories already saved are kept in case you turn it back on.
Operational review. Yori may access, review and process Customer Content, including Inputs, Outputs, conversations, messages, files and related interaction records, where reasonably necessary to provide, maintain, secure, support, debug, monitor, improve and enforce the Services, investigate misuse or security incidents, comply with law, or fulfil the Terms and the DPA. When an AI response fails, Yori automatically sends up to the most recent 20 messages of the affected conversation, with secrets removed, to a Third-Party Model through its AI routing provider to diagnose the failure. Yori keeps the resulting diagnostic report for service reliability purposes.
Automated decisions. Yori does not take significant decisions about individuals based solely on automated processing, within the meaning of Articles 22A to 22D of the UK GDPR. Customers must not use the Services to take significant decisions about individuals based solely on automated processing except in compliance with the Terms, the AUP and all applicable laws, including any requirements for meaningful human involvement, transparency, the ability to contest the decision and other safeguards.
AI transparency. Where applicable law requires disclosure that a person is interacting with AI, or that content has been generated or materially altered by AI, the Customer is responsible for providing that disclosure to its own end users unless Yori is the party directly making the AI interaction or content available to those individuals.
Cookies, local storage and similar technologies
Yori uses cookies, local storage and similar technologies for authentication, security, bot detection, account sessions, protection against cross-site request forgery, preferences, interface state and product functionality. Yori uses optional analytics on its public website and page speed measurement in the app, only after you agree to it. For the full list, see the Yori Cookie Policy.
How we share personal data
Yori shares personal data with service providers and sub-processors that help us provide, host, secure, support, bill, route, generate or research the Services. The sub-processors that process Customer personal data are identified in Annex 2 of the DPA.
Yori shares personal data with AI routing providers, AI model providers, inference providers, embedding providers, transcription providers, evaluation providers, web-research and document conversion providers when needed to provide features requested by you or your organisation.
Where you or your organisation connect a third-party application, Yori shares the instructions, content and files needed to carry out the requested action with its connector platform provider, Composio, and with that third-party application. Composio stores the credentials for those connections on Yori’s behalf. The third-party application’s own terms and privacy policy apply to the data it receives.
When you submit feedback or a bug report, Yori shares your name, email address, workspace details, your message and any screenshot you attach with the issue-tracking tools Yori uses to manage support, Linear and GitHub.
Yori uses Loops (Astrodon Corporation) to send product news and marketing emails and to manage its mailing list. Yori shares with Loops the email address you enter in a sign-up form and, where you have a Yori account, your name, email address and user identifier. Loops records whether each email was delivered, opened or clicked, and whether you have unsubscribed. Yori does not share Customer Content with Loops.
Some pages load resources directly from third parties. When a chat or brand profile shows a source website, your browser loads that website’s icon from Google, and workspaces that use a Google font load it from Google Fonts. Our sign-up form uses Cloudflare Turnstile, through our authentication provider, to check for bots. Our public homepage loads an image from a third-party content delivery network. The email sign-up form in our website footer sends the email address you enter directly to Loops. In each case, the third party receives your IP address and browser information.
Yori shares personal data within your workspace or organisation, including with owners, administrators, authorised users, Enterprise hosts, partners and support personnel, according to workspace settings and permissions.
Yori shares personal data with payment processors, banks, professional advisers, auditors, insurers, lawyers, accountants and other business operations providers.
Yori shares personal data with courts, regulators, law enforcement, public authorities or other third parties where required by law, to protect rights or safety, to enforce the Terms or AUP, or to investigate misuse, fraud, security incidents or illegal activity.
Yori may share personal data in connection with a merger, acquisition, financing, reorganisation, sale of assets, insolvency or similar business transaction, subject to appropriate safeguards where required.
Yori does not sell personal data and does not disclose it to third parties for their own marketing or advertising purposes.
International transfers
Yori is based in the United Kingdom. Yori’s primary database and main application servers are located in the United Kingdom (London). Some services are provided from the United States, including agent processing for audience and brand profile features, code-execution sandboxes, storage of assistant memory, authentication, payment processing, web research, document conversion, connected-application integrations, issue tracking, email delivery and AI model providers. The specific countries involved may depend on the feature, provider, model and connected service.
Where the UK GDPR applies, Yori relies on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework for certified US recipients) or, where none apply, on the International Data Transfer Agreement or the International Data Transfer Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment. Where the EU GDPR applies, Yori relies on European Commission adequacy decisions or the EU Standard Contractual Clauses. You can ask for a copy of the relevant safeguards by emailing legal@askyori.ai.
Retention
Yori keeps personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, the Terms, the DPA, applicable ordering documentation, customer instructions, legal requirements and legitimate business needs. Retention periods vary by data type, feature and workspace configuration.
Accounts and workspaces. Account, identity, membership and workspace-administration data are kept while the account or workspace is active. You can delete your own account in the Services under Settings, then Account, and a workspace administrator can delete a workspace from the workspace settings. You can also ask Yori to do either by contacting legal@askyori.ai. When a user account is deleted, Yori deletes that user’s chats, projects, workflows, usage records and audit logs, and removes the link between the user and shared workspace items such as canvases, comments and files, which remain available to the workspace. When a workspace is deleted, Yori deletes the workspace and the content stored with it in Yori’s database. Saved assistant memories are kept until you ask the assistant to remove them or ask Yori to delete them.
Customer Content. Customer Content is kept until it is deleted in the Services, the account or workspace is deleted, or the relevant retention period in the Terms, the DPA or customer instructions expires. You can delete chats, projects, files, canvases, audiences, brand profiles, automations, connected applications and generated images in the Services, and ask the assistant to remove saved memories. The DPA provides for deletion or return of Customer personal data within thirty days after the Services end, unless the law requires retention.
Email updates. Yori keeps your details on its mailing list until you unsubscribe or ask Yori to remove them. After you unsubscribe, Yori keeps your email address on a suppression list so that it does not email you again. When a user account is deleted, Yori removes that user from the mailing list.
Billing records. Billing, payment, tax, accounting and transaction records are kept for the period required by tax, accounting, audit and legal rules, which is typically six years from the end of the financial year to which they relate, or longer where necessary for legal claims.
Operational records. Yori deletes records of AI run progress within one day, agent checkpoints after two days, connection sign-in records after 24 hours, and processed payment and authentication webhook records after 30 days. Diagnostic reports about failed AI responses may contain excerpts or summaries of the affected conversation. Yori keeps them for as long as they are needed to investigate and fix the underlying fault and to check that it does not recur, including after the related chat is deleted. Working copies of files used in code-execution sandboxes may remain in Yori’s hosting provider’s storage after the related chat is deleted, until they are removed.
Backups. Copies in backups may persist for a limited period after deletion from live systems, subject to ordinary backup rotation and access controls.
Aggregated data. Aggregated, anonymised or de-identified information that no longer identifies an individual may be kept and used for lawful business purposes.
Security
Yori uses technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration and disclosure. These include encryption in transit and at rest, organisation-scoped access controls and database row-level security, optional multi-factor authentication, isolated code-execution sandboxes, rate limiting, bot detection at sign-up, webhook signature verification, protection against cross-site request forgery, file validation, managed secret storage, provider due diligence, confidentiality obligations and restricted staff access. Annex 3 of the DPA describes these measures in more detail. No internet service can be guaranteed to be completely secure, and users should avoid submitting data where disclosure would create unacceptable risk unless separately agreed controls are in place.
Your privacy rights
Under the UK GDPR you have the right to access your personal data, to have it corrected, to have it deleted, to restrict its use, to receive a portable copy of it, and to object to certain uses of it. Where we rely on consent, you can withdraw your consent at any time. You also have rights in relation to automated decision-making. If the EU GDPR or another privacy law applies to you, you may have similar rights under that law.
Your right to object. You can object at any time to our use of your personal data based on legitimate interests, and to its use for direct marketing. To object, email legal@askyori.ai or use the unsubscribe link in any marketing email.
If Yori acts as controller for the relevant data, Yori will handle your request directly, subject to applicable law, identity verification and any lawful exceptions. If Yori acts as processor for your organisation, Yori may refer your request to that organisation or act on that organisation’s instructions. To exercise your rights, contact legal@askyori.ai.
Complaints
If you are unhappy with how we have used your personal data, you can complain to us by emailing legal@askyori.ai. We will acknowledge your complaint within 30 days of receiving it, look into it, keep you updated and tell you the outcome without undue delay.
You also have the right to complain to the Information Commission, the UK data protection regulator (known as the ICO), at ico.org.uk. If you live in the European Economic Area, you can also complain to your local data protection authority.
Children
The Services are designed for business use and are not intended for anyone under 18. We do not knowingly collect personal data from children. If we learn that a person under 18 has an account, we will close it and delete their personal data unless we must keep it by law.
Marketing communications
Yori may send service, security, billing and administrative communications where necessary to operate the Services. Yori may send marketing communications where permitted by law. For individual subscribers, including sole traders and some partnerships, Yori sends marketing emails only with consent or where the soft opt-in in regulation 22(3) of the Privacy and Electronic Communications Regulations 2003 applies. You can opt out of marketing communications using the unsubscribe link in the message or by contacting Yori. You may still receive non-marketing service communications.
You can sign up for product news and marketing tips using the form on our website. Yori sends these emails through its email provider, Loops. Like most email services, Loops uses a small image and tracked links in each marketing email to tell Yori whether the email was opened and which links were clicked, so that Yori can see what is useful and improve its emails.
Changes to this Privacy Policy
Yori may update this Privacy Policy from time to time to reflect changes to the Services, law, technology, providers, data practices or business operations. If Yori makes material changes, Yori will provide notice through the Services, by email or by another reasonable method. Where Yori plans to use personal data for a materially new purpose, Yori will provide that notice, and obtain consent where required, before starting the new processing.
Contact
For privacy questions or requests, contact Yori at legal@askyori.ai. Please include enough information for Yori to verify your identity and understand the request. If your request relates to workspace data controlled by your organisation, Yori may need to involve that organisation before responding.