Privacy Policy

Yekar.AI ("Yekar.AI", "we", "us") provides an agent management system at app.yekar.ai - a platform where organizations build, run, and govern AI agents connected to their tools and data. This policy explains how we handle personal information when you visit yekar.ai, communicate with us, or use the platform.

An organization that provides your workspace generally decides why and how workspace content is processed. For that content, Yekar.AI processes information on the organization's instructions. Yekar.AI decides how account administration, service security, support, operational communications, and website analytics data is processed. If a separate customer agreement or data processing agreement applies, it may provide additional terms for workspace data.

• Account information - your name, email address, profile picture, sign-in identifiers, organization membership, role, and account preferences.
• Workspace content - agents, instructions, configurations, knowledge documents, memory, sessions, inputs, outputs, approvals, and run history created or processed by your organization.
• Connection information - API keys, OAuth tokens, connection settings, and data returned by the third-party tools your organization connects. Credentials are encrypted at rest and used to operate the connections you configure.
• Usage and device information - IP address, browser and device details, timestamps, pages viewed, feature usage, model and tool usage, request metadata, diagnostic events, and security logs.
• Communications and commercial information - messages sent to support, demo requests, feedback, billing contacts, plan information, usage entitlements, and related records.

We receive this information from you, your organization and its administrators, the services you connect, identity providers, service providers, and automatically through your use of the website and platform.

We use information to:

• provide, secure, maintain, troubleshoot, and improve the website and platform;
• authenticate users and administer organizations, permissions, plans, and usage;
• run agents, model calls, tools, integrations, approvals, and the features your organization configures;
• store and display session, run, audit, and governance history;
• send service and security communications, including activation, approval, budget, and support notices;
• respond to questions, demo requests, feedback, and legal or privacy requests;
• detect abuse, investigate incidents, enforce our terms, and comply with law; and
• analyze aggregate usage and develop new or improved features.

We do not sell personal information. We do not use workspace content for advertising, and we do not share personal information for cross-context behavioral advertising.

If you sign in with Google, we receive your basic profile information, such as your name, email address, and profile picture, and use it to authenticate you and associate you with the appropriate account. We do not use Google sign-in to access other Google services.

If your organization connects a Google service, such as Google Sheets, an agent accesses that data only as directed by the agents and permissions your team configures. We do not use Google user data for advertising, and we do not sell it. Yekar.AI's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Running an agent involves sending content to the model provider selected for that agent. This may include the agent's instructions, user messages, conversation history, relevant knowledge and memory, and tool results. Stored connection credentials are used to call connected tools and are not included in prompts sent to model providers.

Depending on the provider and your organization's configuration, a model call may use an API key supplied by your organization or a Yekar.AI-managed provider connection. When your organization supplies the key, its agreement with the provider governs the provider's handling of the call. When Yekar.AI supplies the connection, the provider processes the call as a Yekar.AI service provider. Separately, we use OpenAI's API under our account to create embeddings for search across knowledge documents and saved memory.

Yekar.AI does not use workspace content to train general-purpose AI models. Wherever a provider's API lets a request say "do not keep this", Yekar.AI says it on every model call; beyond that, model providers may retain and process API content as described in the terms that apply to the relevant customer-key or managed connection. Which providers offer such a control, and what each keeps, is set out provider by provider in our documentation under what the model provider keeps. Your organization is responsible for choosing providers and configurations appropriate for the information its agents process.

We share information with providers only as needed to operate the service. Our current providers include Amazon Web Services for application and database hosting, Cloudflare for website hosting, content delivery, cookieless website page-view counts, and object storage, Resend for outbound email, OpenAI for search embeddings and managed model features, Google for sign-in and, if you allow it, website analytics, PostHog for platform product analytics, for session recording where an organization turns it on, and for server error reporting when enabled, and Sentry for error reporting in our web apps when enabled. These providers may process information in India, the United States, and other countries where they or their infrastructure operate. We use contractual, organizational, and technical protections appropriate to the service and the information involved.

If you choose to schedule a demo, you leave our website and provide scheduling information to Cal.com. Its handling of that information is governed by its own privacy policy. We may update our provider list as the service changes and will describe material changes in this policy. The complete, current list, with what each provider receives, is on our Subprocessors page.

Agent sessions may send data to services your organization connects, such as Google Sheets, Slack, Stripe, and other tools in the integration library. We access those accounts only within the permissions granted to the connection and as directed by the agents your organization configures. Disconnecting a service removes the active stored connection from the workspace, although records of actions already performed and encrypted backup copies may remain for the periods described below. Connected services process information under their own terms and privacy policies.

Web search is on by default in every workspace where we offer it, and agents can be given tools that read pages. Every search run in a workspace is sent to Serper, a search provider, on our account, carrying the search text without your organization's identity or your session cookies. When an agent reads a specific page, the destination site receives an ordinary request from our infrastructure. Search text and requested addresses may reflect the material being processed. Connection credentials are not included.

Yekar.ai and docs.yekar.ai use Google Analytics to understand website traffic and improve our pages, but only if you accept it when each site asks; until then the Google Analytics script is not loaded. If you accept, Google Analytics uses cookies and receives information such as pages visited, device and browser information, IP-derived approximate location, and referral information. You can change or withdraw your choice at any time with Cookie settings at the foot of each page; the choice is asked again after a year. Both sites also use Cloudflare Web Analytics, which counts page views without cookies or any storage on your device and does not identify you; it runs whether or not you accept Google Analytics.

The platform at app.yekar.ai does not use Google Analytics. It uses essential storage required for sign-in, security and user preferences. When product analytics is enabled, it asks each signed-in person whether it may use PostHog to record which pages they visit, identified by account and workspace, with query strings removed and no IP address in the events we send. Nothing is collected unless you allow it, your answer is saved to your account with the date you gave it and asked again after a year, you can change it in your account settings, and it never runs during support sessions. Session recording additionally requires an administrator of your organization to turn it on, and recordings mask all text and inputs. Error reports, from our web apps to Sentry and from our servers to PostHog, have email addresses, tokens and query strings removed first. Our Cookie Policy lists each cookie we set, what it is for, and how long it lasts.

We may disclose information:

• to your organization and its administrators, according to workspace roles and permissions;
• to the service providers, model providers, and connected services described above;
• when you or your organization direct us to or give consent;
• when reasonably necessary to comply with law, legal process, or a valid government request, or to protect the rights, safety, and security of users, Yekar.AI, or others; and
• in connection with a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality protections.

We use technical and organizational safeguards designed to protect information. Connection credentials are encrypted at rest, traffic is encrypted in transit, and workspace access is restricted through organization membership and permissions. No system is completely secure, so we cannot guarantee that unauthorized access or loss will never occur. Notify us promptly at the address below if you believe an account or connection has been compromised.

We retain account and workspace information while the organization's account is active and as needed to provide the service. Run history and audit records are generally retained for the life of the account because they form the organization's governance trail. Detailed per-call tool logs are pruned on a rolling window, which is 90 days by default. Different periods may apply under a customer agreement or workspace setting.

After an account or workspace is deleted, we remove its information from active systems within a reasonable period. Encrypted copies may remain until overwritten through normal backup cycles. We may retain limited records longer when needed for security, fraud prevention, dispute resolution, legal compliance, or to establish or defend legal claims. We may retain information that has been aggregated or de-identified so it no longer identifies an individual or organization.

Depending on where you live, you may have rights to ask for access to your personal information, a summary of how it is used, correction, deletion, or withdrawal of consent, and to raise a grievance or nominate another person to exercise rights where applicable. You may also object to or request restriction of certain processing where applicable. Contact us using the address below. We may need to verify your identity and may retain information where the law allows or requires it.

If your request concerns data in a workspace controlled by your employer or another organization, contact the organization or its workspace administrator first. We will assist the organization with requests when required. You may disconnect integrations through the platform, change your website analytics choice with Cookie settings, manage cookies through your browser, and unsubscribe from non-operational email using the instructions in the message. Operational and security messages cannot always be disabled while an account remains active.

The service is intended for business use and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided information to us, contact us so we can review and delete it where appropriate.

We may update this policy as the product, providers, or legal requirements change. We will update the date at the top and provide additional notice when a change materially affects how we handle information. Privacy questions, rights requests, and grievances can be sent to [email protected].