Privacy Policy

Yekar.AI ("Yekar.AI", "we", "us") provides an agent management system at app.yekar.ai - a platform where organizations build, run, and govern AI agents connected to their tools and data. This policy explains how we handle personal information when you visit yekar.ai, communicate with us, or use the platform.

An organization that provides your workspace generally decides why and how workspace content is processed. For that content, Yekar.AI processes information on the organization's instructions. Yekar.AI decides how account administration, service security, support, operational communications, and website analytics data is processed. If a separate customer agreement or data processing agreement applies, it may provide additional terms for workspace data.

• Account information - your name, email address, profile picture, sign-in identifiers, organization membership, role, and account preferences.
• Workspace content - agents, instructions, configurations, knowledge documents, memory, sessions, inputs, outputs, approvals, and run history created or processed by your organization.
• Connection information - API keys, OAuth tokens, connection settings, and data returned by the third-party tools your organization connects. Credentials are encrypted at rest and used to operate the connections you configure.
• Usage and device information - IP address, browser and device details, timestamps, pages viewed, feature usage, model and tool usage, request metadata, diagnostic events, and security logs.
• Communications and commercial information - messages sent to support, demo requests, feedback, billing contacts, plan information, usage entitlements, and related records.

We receive this information from you, your organization and its administrators, the services you connect, identity providers, service providers, and automatically through your use of the website and platform.

We use information to:

• provide, secure, maintain, troubleshoot, and improve the website and platform;
• authenticate users and administer organizations, permissions, plans, and usage;
• run agents, model calls, tools, integrations, approvals, and the features your organization configures;
• store and display session, run, audit, and governance history;
• send service and security communications, including activation, approval, budget, and support notices;
• respond to questions, demo requests, feedback, and legal or privacy requests;
• detect abuse, investigate incidents, enforce our terms, and comply with law; and
• analyze aggregate usage and develop new or improved features.

We do not sell personal information. We do not use workspace content for advertising, and we do not share personal information for cross-context behavioral advertising.

If you sign in with Google, we receive your basic profile information, such as your name, email address, and profile picture, and use it to authenticate you and associate you with the appropriate account. We do not use Google sign-in to access other Google services.

If your organization connects a Google service, such as Google Sheets, an agent accesses that data only as directed by the agents and permissions your team configures. We do not use Google user data for advertising, and we do not sell it. Yekar.AI's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Running an agent involves sending content to the model provider selected for that agent. This may include the agent's instructions, user messages, conversation history, relevant knowledge and memory, and tool results. Stored connection credentials are used to call connected tools and are not included in prompts sent to model providers.

Depending on the provider and your organization's configuration, a model call may use an API key supplied by your organization or a Yekar.AI-managed provider connection. When your organization supplies the key, its agreement with the provider governs the provider's handling of the call. When Yekar.AI supplies the connection, the provider processes the call as a Yekar.AI service provider. Separately, we use OpenAI's API under our account to create embeddings for search across knowledge documents and saved memory.

Yekar.AI does not use workspace content to train general-purpose AI models. Model providers may retain and process API content as described in the terms that apply to the relevant customer-key or managed connection. Your organization is responsible for choosing providers and configurations appropriate for the information its agents process.

We share information with providers only as needed to operate the service. Our current providers include Railway for application and database hosting, Cloudflare for website hosting, content delivery, and object storage, Resend for outbound email, OpenAI for search embeddings and managed model features, Google for sign-in and website analytics, and Sentry for application error reporting when enabled. These providers may process information in the United States, India, and other countries where they or their infrastructure operate. We use contractual, organizational, and technical protections appropriate to the service and the information involved.

If you choose to schedule a demo, you leave our website and provide scheduling information to Cal.com. Its handling of that information is governed by its own privacy policy. We may update our provider list as the service changes and will describe material changes in this policy.

Agent sessions may send data to services your organization connects, such as Google Sheets, Slack, Stripe, and other tools in the integration library. We access those accounts only within the permissions granted to the connection and as directed by the agents your organization configures. Disconnecting a service removes the active stored connection from the workspace, although records of actions already performed and encrypted backup copies may remain for the periods described below. Connected services process information under their own terms and privacy policies.

Agents can be given tools that search the web and read pages. Searches are relayed through search infrastructure we operate, which sends the search text to public search engines without your organization's identity or your session cookies. When an agent reads a specific page, the destination site receives an ordinary request from our infrastructure. Search text and requested addresses may reflect the material an agent is processing. Connection credentials are not included.

Yekar.ai uses Google Analytics to understand website traffic and improve our pages. Google Analytics uses cookies and receives information such as pages visited, device and browser information, IP-derived approximate location, and referral information. You can limit or delete cookies using your browser settings. The platform at app.yekar.ai does not use Google Analytics. It may use essential storage and diagnostic tools required for sign-in, security, reliability, and user preferences. Our Cookie Policy lists each cookie we set, what it is for, and how long it lasts.

We may disclose information:

• to your organization and its administrators, according to workspace roles and permissions;
• to the service providers, model providers, and connected services described above;
• when you or your organization direct us to or give consent;
• when reasonably necessary to comply with law, legal process, or a valid government request, or to protect the rights, safety, and security of users, Yekar.AI, or others; and
• in connection with a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality protections.

We use technical and organizational safeguards designed to protect information. Connection credentials are encrypted at rest, traffic is encrypted in transit, and workspace access is restricted through organization membership and permissions. No system is completely secure, so we cannot guarantee that unauthorized access or loss will never occur. Notify us promptly at the address below if you believe an account or connection has been compromised.

We retain account and workspace information while the organization's account is active and as needed to provide the service. Run history and audit records are generally retained for the life of the account because they form the organization's governance trail. Detailed per-call tool logs are pruned on a rolling window, which is 90 days by default. Different periods may apply under a customer agreement or workspace setting.

After an account or workspace is deleted, we remove its information from active systems within a reasonable period. Encrypted copies may remain until overwritten through normal backup cycles. We may retain limited records longer when needed for security, fraud prevention, dispute resolution, legal compliance, or to establish or defend legal claims. We may retain information that has been aggregated or de-identified so it no longer identifies an individual or organization.

Depending on where you live, you may have rights to ask for access to your personal information, a summary of how it is used, correction, deletion, or withdrawal of consent, and to raise a grievance or nominate another person to exercise rights where applicable. You may also object to or request restriction of certain processing where applicable. Contact us using the address below. We may need to verify your identity and may retain information where the law allows or requires it.

If your request concerns data in a workspace controlled by your employer or another organization, contact the organization or its workspace administrator first. We will assist the organization with requests when required. You may disconnect integrations through the platform, manage cookies through your browser, and unsubscribe from non-operational email using the instructions in the message. Operational and security messages cannot always be disabled while an account remains active.

The service is intended for business use and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided information to us, contact us so we can review and delete it where appropriate.

We may update this policy as the product, providers, or legal requirements change. We will update the date at the top and provide additional notice when a change materially affects how we handle information. Privacy questions, rights requests, and grievances can be sent to [email protected].