Yappa

Privacy Policy

What personal data we collect, why, and your rights under UK GDPR.

Last updated: 18 June 2026

Precise Impact Ltd, trading as Yappa ("Yappa", "we", "our", "us"), is committed to protecting your privacy and the security of your personal information. This Privacy Policy explains how we collect, use, store, share and protect personal data when you use Yappa, our multi-tenant content and AI-visibility platform (the "Service"), and the rights you have under UK data protection law.

1. Introduction

Yappa turns a business's own ideas and existing knowledge into published, verified, search- and AI-optimised website content, and then distributes that content across channels such as your blog or WordPress site, email and social media. You interact with the Service through our web application, and through our Telegram front door, the @GetYappaBot bot.

We act in two distinct roles, and it is important to understand the difference:

  • As a data controller. For the personal data covered by this policy — your account and authentication details, your organisation's profile, billing information, support correspondence, marketing preferences and website usage — we decide how and why it is processed, so we are the data controller.
  • As a data processor. For the content and data your organisation puts into the Service — the source documents, Business Brain content, prompts and any personal data about your own customers, website visitors or contacts that flows through Yappa — your organisation decides the purposes of processing and is the controller, and we act as a processor on your instructions. That processing is governed by our Data Processing Agreement, not by this policy.

This policy applies to all users of our website and web application. By using the Service, you acknowledge that you have read and understood it.

2. Data Controller

The data controller responsible for your personal data is:

Precise Impact Ltd
Trading as Yappa
128 City Road
London
EC1V 2NX
England & Wales

Company Registration: 15244656 (England & Wales)
ICO Registration: ZB829059

For any questions about this Privacy Policy or our data practices, contact our privacy team at privacy@getyappa.com.

3. Information We Collect

We collect different types of information depending on how you interact with the Service.

3.1 Information you provide directly

Account and authentication data:

  • Full name
  • Email address
  • Password (stored only in hashed form; we never see or store it in plain text)

Organisation and tenant data:

  • Organisation name and business details
  • Your role and permissions within the organisation
  • Brand, voice, audience and configuration settings for your tenant

Telegram front door:

  • Your Telegram user identifier, username and display name when you connect to or message @GetYappaBot
  • The messages, instructions and content you send to the bot in the course of using the Service

Communications:

  • Support enquiries and correspondence
  • Feedback and survey responses

3.2 Content and Business Brain data

To deliver the Service, we process the content your organisation provides or generates:

  • Source documents and materials you upload (for example notes, briefs, existing pages, transcripts and reference files)
  • Business Brain content — the structured, editable per-tenant knowledge that powers generation — together with the vector embeddings we derive from it to enable search and retrieval
  • Generated content (drafts, verified articles, distribution copy) and the records of how it was produced, reviewed and approved

Where these materials contain personal data about your own customers, contacts or website visitors, your organisation is the controller for that data and we process it as a processor under the Data Processing Agreement.

3.3 Billing data

Subscriptions and payments are handled by Stripe, our payment processor. Stripe collects and processes your payment details directly. We receive limited billing information such as your subscription plan, payment and renewal status, and the billing contact and address. We never receive or store your full card numbers.

3.4 Information collected automatically

Technical data:

  • IP address
  • Browser type and version
  • Device type and operating system
  • Time zone and language preferences
  • Login timestamps and session duration

Usage and analytics data:

  • Pages visited and features used
  • Actions taken within the application
  • Error logs and performance data

Cookies and consent:

  • Essential cookies required for the Service to work, and a record of your cookie choices. Analytics cookies are only set after you opt in — see section 11.

4. Legal Basis for Processing

Under UK GDPR we must have a valid legal basis for processing your personal data. The table below summarises what we collect, why, and the basis we rely on.

What we collect Why we use it Lawful basis
Account and authentication data Create and secure your account; provide the Service Contract
Organisation and tenant data Set up and operate your tenant; apply your brand, voice and permissions Contract
Telegram identifiers and messages Operate the @GetYappaBot front door so you can run the Service conversationally Contract
Uploaded source documents and Business Brain content Generate, verify and publish content on your instructions Contract (and processed as processor on your organisation's behalf)
Billing data Manage subscriptions and payments; keep accounting records Contract and Legal Obligation
Usage and analytics data Operate, secure and improve the Service Legitimate Interests (aggregated improvement and security) and Consent (analytics cookies)
Marketing preferences and contact details Send marketing communications you have asked to receive Consent
Records required by law Meet tax, accounting and other legal duties Legal Obligation

Where we rely on legitimate interests, we have considered your rights and interests and balanced them against ours; you can object to this processing at any time (see section 10).

5. How We Use Your Information

5.1 Service delivery

  • Creating and managing your account, organisation and tenant
  • Operating the @GetYappaBot Telegram front door and your dashboard
  • Building and maintaining your Business Brain, including generating and storing embeddings so content can be searched and retrieved
  • Generating, verifying and elevating content, and recording how each pipeline stage ran
  • Publishing approved content to your connected channels (such as your WordPress site) and distributing it through email and social channels you configure
  • Processing subscription payments and managing billing

5.2 Communication

  • Sending transactional emails (account verification, password resets, billing and security notifications)
  • Notifying you of important service updates or changes
  • Responding to your enquiries and support requests
  • Sending marketing communications, only where you have opted in

5.3 Service improvement

  • Analysing usage patterns to improve features
  • Identifying and fixing technical issues
  • Developing new functionality based on user needs
  • Conducting research and analytics using aggregated, anonymised data

5.4 Security and compliance

  • Protecting against unauthorised access and security threats
  • Detecting and preventing fraud and abuse
  • Enforcing our Terms of Service
  • Complying with legal and regulatory requirements

6. Use of AI and Content Generation

Yappa is a content-generation, verification and distribution platform. To produce and check content, your prompts, your Business Brain content and the drafts produced may be processed by AI model and inference providers, including Anthropic and other model providers we use behind a controlled routing layer.

  • We route most pipeline stages to local models, and use commercial AI providers principally for critic, verification and elevation passes.
  • Content and prompts sent to AI providers are processed to return results to you. We work with providers who, under our agreements, do not use this content to train their general-purpose models.
  • You should avoid putting personal data into prompts or source material unless it is necessary for the content you want to produce, and you should ensure you have a lawful basis to do so.

The decisions about what to publish remain with you: content moves through review and approval before it is published or distributed.

7. Data Sharing and Disclosure

We do not sell, rent or trade your personal information. We share data only in the limited circumstances below.

7.1 Service providers (sub-processors)

We work with carefully selected providers who help us deliver the Service. They are contractually bound to protect your data and to process it only on our instructions:

  • Railway: application hosting, PostgreSQL database (with pgvector for Business Brain embeddings) and object storage
  • Stripe: subscription and payment processing
  • Resend: transactional email delivery
  • AWS S3 / Railway object store: storage of uploaded source documents, images, exports and generated assets
  • Cloudflare: DNS, content delivery and security proxy
  • Anthropic and other model / inference providers: content generation, verification and elevation (see section 6)
  • GoHighLevel (AutomagicalCRM): distribution, CRM and marketing automation
  • Telegram: the @GetYappaBot conversational front door
  • Your own WordPress site: the publishing target to which approved content is sent via the Yappa receiver plugin

Some providers process data outside the UK and EEA; see section 9. A current list of sub-processors is maintained in our Data Processing Agreement and is available on request.

7.2 Legal requirements

We may disclose your information if required to do so by law, or where we believe in good faith that disclosure is necessary to:

  • Comply with a legal obligation, court order or legal process
  • Protect and defend our rights or property
  • Prevent or investigate possible wrongdoing
  • Protect the personal safety of users or the public

7.3 Business transfers

If we are involved in a merger, acquisition or sale of assets, your personal data may be transferred as part of that transaction. We will notify you of any such change and any choices you may have.

7.4 Within your organisation

Yappa is built for organisations. Information such as your name, email address and activity within the Service may be visible to other authorised users of your organisation, in line with the roles and permissions your organisation configures.

8. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

  • Tenant isolation at the database layer: every tenant-owned record is scoped to its tenant and protected by Postgres row-level security, so one tenant's data is never returned to another
  • Encryption in transit: all data is transmitted over TLS (HTTPS)
  • Password security: passwords are stored only in hashed form
  • Encrypted credentials: external API keys and OAuth tokens are encrypted and referenced rather than stored inline; WordPress plugin tokens are hashed
  • Access controls: role-based access within organisations and for our team
  • Resilient hosting: managed database with automated backups
  • Monitoring: ongoing monitoring for threats and service issues

While we apply strong security measures, no system is completely secure. We encourage you to use a strong, unique password and to keep your account credentials confidential.

For more detail on our security practices, see our Security page.

9. International Data Transfers

Some of our sub-processors process personal data outside the UK and EEA — for example certain hosting, email, AI and CRM providers operate in the United States or other countries.

Where personal data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place, such as:

  • The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses
  • Standard Contractual Clauses (SCCs)
  • UK adequacy regulations, where the destination country is covered

You can contact us for more information about the specific safeguards applied to your data.

10. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

  • Right of access: request a copy of the personal data we hold about you
  • Right to rectification: ask us to correct inaccurate or incomplete data
  • Right to erasure: request deletion of your personal data, subject to certain exceptions
  • Right to restrict processing: ask us to limit how we use your data
  • Right to data portability: request your data in a structured, machine-readable format
  • Right to object: object to processing based on legitimate interests, and to direct marketing at any time
  • Right to withdraw consent: where processing is based on consent, withdraw it at any time
  • Rights related to automated decision-making: not be subject to decisions based solely on automated processing that produce legal or similarly significant effects

To exercise any of these rights:

We will respond within one month. In complex cases we may extend this by a further two months, and will tell you if we need to.

Where your request relates to your organisation's content or service data (for which your organisation is the controller), we may refer the request to your organisation or assist it in responding, in line with our Data Processing Agreement.

11. Cookies and Analytics

We use essential cookies required for the Service to function (authentication, security and session management). For analytics we use Google Analytics, which is loaded only after you opt in via our cookie banner. We do not use advertising cookies or session-replay tools.

You can change your cookie preferences at any time. For the specific cookies we use and how to manage them, see our Cookie Policy.

12. Marketing Communications

We will only send you marketing communications if you have opted in to receive them. We use GoHighLevel (AutomagicalCRM) to manage these communications. They may include:

  • Product updates and new features
  • Tips and best practice for content, SEO and AI visibility
  • Offers and event invitations

You can unsubscribe at any time by:

Even if you opt out of marketing, we will still send essential service communications such as security alerts and billing notifications.

13. Automated Decision-Making

Yappa uses automation and AI to generate, verify and elevate content, and to decide when content has earned the right to be published automatically. This operates on the content and instructions your organisation provides, with human review and approval available in the workflow.

We do not carry out profiling or automated decision-making that produces legal effects, or similarly significantly affects you, in relation to your personal data.

14. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected.

14.1 Active accounts

While your account, organisation and tenant are active, we retain the data needed to provide the Service, including your Business Brain content, embeddings and generated content.

14.2 Account or organisation deletion

On deletion of your account or organisation:

  • Personal information is permanently deleted within 30 days
  • Backup copies are purged within 90 days
  • Billing and accounting records may be retained longer where required for tax or legal purposes

14.3 Anonymised data

We may retain anonymised, aggregated data, which cannot identify you, for analytical purposes indefinitely.

15. Third-Party Links

The Service may contain links to third-party websites or services, including your own connected channels and tools. We are not responsible for the privacy practices of those third parties, and we encourage you to read their privacy policies.

16. Children's Privacy

The Service is designed for businesses and is not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us and we will take steps to delete it.

17. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make changes:

  • We will update the "Last updated" date at the top of this page
  • For significant changes, we will notify you by email or through the Service
  • We encourage you to review this policy periodically

Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

18. Complaints

If you have concerns about how we handle your personal data, please contact us first — we would welcome the chance to resolve them before you approach the regulator.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection:

Information Commissioner's Office
Website: ico.org.uk
Helpline: 0303 123 1113

19. Contact Us

For any privacy-related questions, concerns, or to exercise your rights:

Data protection enquiries
Email: privacy@getyappa.com

Postal address
Precise Impact Ltd t/a Yappa
128 City Road
London
EC1V 2NX
England & Wales

Related policies