Privacy Policy

Effective 2026-09-10 · Last updated 2026-09-10

Yōten (“we”, “us”, “our”) is a service operated by Growthgenix Consulting FZCO, a company registered with the International Free Zone Authority (IFZA), Dubai, United Arab Emirates. This policy explains what data we collect when you use Yōten, how we use it, who processes it on our behalf, and the rights you have over it.

1. What we collect

We collect only what's necessary to provide the service:

• Account data. The email address you sign up with, a password hash (bcrypt; we never see or store your plaintext password), your Google account email if you connect Google Calendar.
• Meeting content. Meeting URLs you send us, the audio recording captured by our bot (Recall.ai), the transcript produced by our transcription vendor (Soniox), and the AI-generated summary / action items / decisions produced by our LLM vendor (Anthropic Claude).
• Calendar metadata. If you connect Google Calendar, we read your upcoming events (title, time, participant list, meeting link) to know which meetings to join. We use calendar.readonly scope only — we cannot create, modify, or delete events on your calendar.
• Usage metadata. Server logs (IP address, user-agent, request timestamps) for security and abuse investigation; billing data (hours consumed, plan tier) for metering.
• Cookies. One essential session cookie (yoten_session) that keeps you logged in. No analytics trackers, no advertising cookies.

2. How we use it

• To provide the service: join meetings you tell us to join, transcribe them, produce summaries, and make them accessible in your dashboard.
• To improve the service: aggregate error logs and performance metrics. Never on identifiable user content.
• To secure the service: detect abuse, rate-limit requests, investigate suspicious activity.
• To communicate: service notifications, security alerts, and (with your consent) product updates.

We do not sell your data. We do not use your content to train machine-learning models — not ours, and (contractually) not our vendors'.

3. Legal basis (GDPR)

If you're in the EU/UK, we rely on:

• Contract — to provide the service you signed up for (Art. 6(1)(b) GDPR).
• Legitimate interests — to keep the service running securely and prevent abuse (Art. 6(1)(f)).
• Consent — for optional product-update emails and for accessing your Google Calendar (via OAuth consent screen).

4. Third-party processors

We use the following sub-processors. Each sees only the data necessary for their role, under a written processing agreement or equivalent contract. None see other users' data.

5. International transfers

Yōten operates from the UAE. Your data may be processed in the US, EU, or elsewhere depending on the vendor. Where required, we rely on Standard Contractual Clauses (SCCs) or equivalent transfer mechanisms for cross-border data flows.

6. Retention

• Free tier: 30 days from meeting date, then automatic deletion.
• Starter tier: 90 days.
• Pro tier: 12 months.
• Account data (email, plan): retained until you delete your account.
• Server logs: 30 days rolling.
• Billing records: retained for the period required by UAE tax law (typically 5 years).

You can request early deletion of any meeting or your entire account at any time.

7. Your rights

You can, at any time:

• Access and export the data we hold about you.
• Correct inaccurate account data.
• Delete individual meetings or your entire account.
• Withdraw consent for optional emails.
• Disconnect Google Calendar (via /onboardingor Google Account settings — either revokes our access).
• Complain to a supervisory authority. In the UAE, that's the UAE Data Office. In the EU/UK, your national data protection authority.

To exercise any of these, email privacy@yoten.ai. We respond within 5 business days.

8. Security

• All data in transit is encrypted (HTTPS via Let's Encrypt certificates on all endpoints).
• Passwords are hashed with bcrypt (cost factor 12). We never store plaintext.
• Data at rest lives in per-user-isolated database rows. Postgres row-level filtering prevents cross-user access even in the case of an application bug.
• OAuth refresh tokens are stored server-side and never exposed to the browser.
• We conduct incident response internally. If a breach affects your data, we'll notify you within 72 hours per GDPR Art. 33.

9. Children

Yōten is not intended for anyone under 16. We don't knowingly collect data from children under 16. If you believe we have, contact us and we'll delete it.

10. Changes to this policy

We may update this policy as the service evolves. Material changes will be announced by email (to registered users) at least 14 days before taking effect. The “Last updated” date at the top reflects the most recent revision.

11. Contact

Growthgenix Consulting FZCO
IFZA Business Park, Dubai Digital Park, Dubai Silicon Oasis, P.O. Box 342001, Dubai, United Arab Emirates
privacy@yoten.ai