1. Information We Collect
Account Information
When you create an account, we collect:
- Your email address and chosen password
- Your name or display name
- Account preferences and settings
Usage Data
We collect information about how you use Yangaaa:
- Project tracking data you create in the dashboard (tasks, sprints, milestones)
- Security events (logins, password changes, account actions) with IP address and browser information, kept for up to 12 months
- Analytics data via Google Analytics, only if you accept analytics cookies
AI Processing Data
When you use our AI features, the text you submit is sent to our third-party AI service provider for processing and the result is returned to you. Yangaaa does not store your AI prompts or generated outputs on our servers — they exist only in your browser session unless you save or export them yourself. Our AI provider processes this data under its own data-usage terms.
One exception: if you choose "Send to Dashboard" after running the Planning Agent, the resulting sprints, milestones, and tasks are saved to your dashboard as project tracking data. You can edit or delete these anytime, and they are included in your data export and removed when you delete your account.
Payment Data
Payments are handled entirely by Stripe. We never see or store your card details — we only store your Stripe customer reference and subscription status.
2. How We Use Your Information
We use your information to:
- Provide our services: Generate AI-powered SDLC assistance, save your projects, and deliver requested features
- Improve our platform: Enhance AI models, fix bugs, and develop new features
- Account management: Authenticate users, manage subscriptions, and provide customer support
- Communication: Send important updates, security notices, and subscription information
- Analytics: Understand usage patterns to improve user experience (anonymized when possible)
3. Information Sharing
We do not sell your personal information. We share data only with the service providers needed to run Yangaaa:
- AI service provider — processes the text you submit to AI tools; prompts and outputs are not stored by Yangaaa
- Stripe — payment and subscription processing (privacy policy)
- Resend — sends transactional emails such as verification links, password reset codes, and receipts (privacy policy)
- Google Analytics — usage analytics, only with your cookie consent (privacy policy)
- Google / GitHub — only if you choose to sign in with them (SSO)
- Replit / Neon — application hosting and database infrastructure
- Legal Requirements: When required by law or to protect our rights and users' safety
- Business Transfers: In the event of a merger, acquisition, or sale of assets
4. Data Security
We implement industry-standard security measures:
- Encryption of data in transit (HTTPS/TLS) and at rest
- Passwords hashed with bcrypt — we can never read your password
- Rate limiting, security headers, and input validation on all endpoints
- An append-only security audit log of account events (logins, password changes, deletions)
- Automatic cleanup of expired sessions, reset codes, and verification tokens
5. Your Rights and Choices
You have the following rights regarding your data (GDPR Articles 15–21 and similar laws), and you can exercise the main ones yourself, instantly:
- Access & Portability: Download a complete copy of your data anytime via Settings → Privacy & Data → "Download My Data" (machine-readable JSON)
- Correction: Update your name and account details in Settings
- Deletion: Permanently delete your account and all associated data via Settings → Danger Zone; this removes your profile, project tracking data, tokens, and active sessions immediately
- Consent withdrawal: Decline or revoke analytics cookies anytime on the Cookie Policy page
- Complaints: You may lodge a complaint with your local data protection authority
6. Data Retention
We keep data only as long as needed:
- Account and project data: retained while your account is active; deleted immediately when you delete your account
- Login sessions: expire automatically; expired sessions are purged daily
- Password reset codes: valid for 10 minutes, purged within 1 day of expiry
- Email verification links: valid for 24 hours, purged within 7 days of expiry
- Security audit logs: retained for 12 months, then deleted automatically
- Payment records: retained by Stripe as required by tax and accounting law
Account deletion is immediate and permanent — your profile, project tracking data, tokens, and sessions are removed in a single transaction.
7. Cookies and Tracking
We use cookies and similar technologies for:
- Essential: authentication and session management (always active)
- Analytics: Google Analytics — off by default, only enabled if you accept analytics cookies in our consent banner
We do not use marketing or advertising cookies. You can change your analytics choice anytime on the Cookie Policy page, or via your browser settings.
8. Children's Privacy
Yangaaa is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we become aware of such collection, we will take steps to delete the information.
9. International Data Transfers
Your information may be processed in countries other than your own. We ensure appropriate safeguards are in place to protect your data according to applicable privacy laws.
10. Changes to This Policy
We may update this privacy policy from time to time. We will notify you of significant changes via email or through our platform. Continued use of Yangaaa after changes constitutes acceptance of the updated policy.
11. Contact Us
If you have questions about this privacy policy or our data practices, please contact us:
- Email: info@yangaaa.com
- Support: Available through your account dashboard