Privacy Policy

Last updated: September 2026

1. Data Controller (Art. 13(1)(a) GDPR)

KonzeptWeber LLC
30 N Gould St Ste N
Sheridan, WY 82801, USA
Email: info@yachay.systems
Website: https://yachay.systems
App: Rikuna (rikuna.yachay.systems)

For data protection inquiries, please contact: info@yachay.systems

2. Data Collected and Purposes

2.1 Website Visit and Usage Analytics

When you visit our website, we collect the following data for the purpose of improving our service and understanding how our pages are used:

• IP address (automatically anonymized after 7 days)
• Approximate location (country, city) derived from IP address via ip-api.com
• Browser type and version (User-Agent)
• Referrer URL (the page you came from)
• Pages visited, page type, and associated industry vertical
• Scroll behavior (how far you scrolled on the page)
• Time spent on each page (session duration)
• Clicks on call-to-action buttons
• UTM campaign parameters (if present in the URL)

This data is stored in our own database on European servers. We do not use third-party analytics services (no Google Analytics, no Meta Pixel). A temporary session identifier is stored in your browser's sessionStorage, which is automatically deleted when you close the browser tab. We do not use tracking cookies. To recognise returning visits we derive a pseudonymous value on our server from your IP address and browser identifier, secured with a secret key that never leaves our server. It does not allow your IP address to be reconstructed. The value is deleted after 12 months together with the visit record. If your browser sends a Do-Not-Track (DNT) signal, no analytics data is collected.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure provision and improvement of the website)

2.2 Contact and Onboarding

When you use our contact form, onboarding form, or email address, we process:

• Name, company name
• Email address
• WhatsApp number (optional)
• Information about your business (opening hours, typical inquiries, etc.)
• Content of the message

Legal basis: Art. 6(1)(b) GDPR (contract initiation/fulfillment) or Art. 6(1)(f) (legitimate interest in processing inquiries)

2.3 Payment Processing

For purchases through our website, payment data (name, email, billing address, payment method information) is processed by our payment provider Stripe. We only receive from Stripe the information necessary for order processing (email, amount, package). Complete payment data (e.g., card numbers) is stored exclusively by Stripe.

Legal basis: Art. 6(1)(b) GDPR (contract fulfillment)

2.4 AI Agent Communication

In the course of operating AI communication agents for our customers (businesses), conversation data is processed through the following channels:

• WhatsApp Business API - Messages via the customer's WhatsApp business number
• Instagram Direct Messages - Messages via the customer's Instagram Business account
• Facebook Messenger - Messages via the customer's Facebook Page
• TikTok Content Posting API - Video and photo publishing from the Rikuna dashboard via the customer's TikTok account (OAuth). Post metadata is stored; uploaded media is hosted on European servers.
• Web chat widget - Chat function on the customer's website (no login required)
• Telegram Bot API - optional, at the customer's request

The following data categories may be processed:

• Name and contact details of end users (patients, clients, guests)
• Content of messages and inquiries
• Appointment requests, booking information
• Health-related information (e.g., complaints, prescription information) - only for medical verticals and only when voluntarily provided by the end user
• Prescription data (diagnosis or ICD-10 code, prescribed remedy, number and frequency of treatments, date of issue) and a photo of the prescription - physiotherapy customers only, see 2.4.1
• Treatment documentation dictated by the practice's practitioners - physiotherapy customers only, see 2.4.2
• Conversation metadata (timestamps, channel, conversation ID)

Messages are stored server-side to allow the customer (business) to view conversation histories via their admin dashboard. Data is stored on European servers.

Yachay Systems processes this data as a data processor on behalf of the respective customer (business), who acts as the data controller. Processing is based on a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR.

Legal basis: Art. 6(1)(b) GDPR (contract initiation/appointment coordination) and Art. 6(1)(f) GDPR (legitimate interest in processing customer inquiries).

2.4.1 Prescription Photos (Physiotherapy)

Patients of physiotherapy customers can send a photo of their medical prescription via WhatsApp. The photo is checked by an AI image model at OpenAI to determine whether it shows a prescription and whether it is legible; the model returns only that verdict. The photo is then stored, together with the prescription data recorded by the practice, in the customer's Rikuna dashboard on European servers, where the practice reviews it. Photos that are not recognized as a prescription are rejected and not stored. The temporary copy used for the check is deleted immediately afterwards.

The customer (practice) is the controller for this data and provides the legal basis for processing health data (typically Art. 9(2)(h) GDPR). Patients can present the prescription in person instead.

2.4.2 Voice Documentation (Physiotherapy)

Practitioners of physiotherapy customers can dictate a treatment note in the Rikuna dashboard. The recording is transmitted to OpenAI solely for transcription (speech to text) under API terms that exclude use for model training, and is not stored by us. Only the transcript, its duration in seconds, and a structured draft of the note (complaint, history, findings, goal, measures, next step) generated by an OpenAI language model are stored on European servers. The draft becomes part of the treatment record only after the practitioner has reviewed and confirmed it.

Data subjects are the patient (content of the note) and the practitioner (voice, authorship). The customer (practice) is the controller and is responsible for the statutory retention of treatment records.

2.5 Google Account Integration (Calendar & Business Profile)

Where a customer (business) chooses to connect their Google account to the Rikuna dashboard, we access Google user data via Google APIs strictly to provide the connected features. This integration is optional and is only activated through the customer's explicit OAuth consent.

Depending on the permissions granted, we access:

• Google Calendar (read-only) - calendar event titles, start/end times, descriptions and status, imported one-way into the dashboard so appointments stay in sync. We do not write to or modify the user's Google Calendar.
• Google account email address - to identify the connected account and display the connection status.
• Google Business Profile (where enabled) - business listing information such as opening hours and customer reviews, to display reviews in the dashboard, publish replies, and update opening hours on the business's own listing.

OAuth access and refresh tokens are stored encrypted at rest on European servers and are used solely to call the Google APIs on the customer's behalf. The customer can revoke access at any time by disconnecting in the dashboard or via their Google account permissions; revocation deletes the stored tokens and the data imported from Google.

We do not use Google user data for advertising, we do not sell it, and we do not use it to train generalized AI/ML models. Human access occurs only where necessary for support requested by the customer, for security, or where required by law.

Limited Use: Yachay Systems' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use and transfer of raw or derived user data received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Legal basis: Art. 6(1)(b) GDPR (provision of the contractually agreed dashboard features) and Art. 6(1)(a) GDPR (the OAuth consent given when connecting the account).

Google Data Segregation: Google user data obtained via Google APIs is processed solely by Google and OpenAI, in accordance with the Limited Use requirements of the Google API Services User Data Policy.

3. Third-Party Providers and Processors

Provider	Purpose	Location / Privacy
Stripe, Inc.	Payment processing	USA/EU · stripe.com/de/privacy
Hetzner Online GmbH	Server hosting and infrastructure	Germany · hetzner.com/legal/privacy-policy
OpenAI, LLC	AI language processing (agent responses), speech-to-text transcription of dictated notes, image check of prescription photos	USA · openai.com/policies/privacy-policy
Anthropic, PBC	AI language processing (agent responses)	USA · anthropic.com/policies/privacy
Google LLC	AI language processing (Gemini)	USA · policies.google.com/privacy
Meta Platforms Ireland Ltd.	WhatsApp Business API, Instagram Graph API, Facebook Messenger Platform (messaging channels)	Ireland · whatsapp.com/legal/privacy-policy
TikTok Technology Ltd.	TikTok Content Posting API (social publishing channel)	Ireland / Singapore · tiktok.com/legal/privacy-policy
Telegram Messenger Inc.	Telegram Bot API (messaging channel, optional)	UAE · telegram.org/privacy
Resend, Inc.	Transactional emails (confirmations, notifications)	USA · resend.com/legal/privacy-policy
BunnyWay d.o.o.	Font delivery (Bunny Fonts, privacy-friendly, no tracking)	EU (Slovenia) · bunny.net/privacy
ip-api.com	IP geolocation (country, city lookup for visit statistics)	Data queried in real-time, not stored by provider · ip-api.com/docs/legal

For the transfer of personal data to third countries (USA, China), we rely on Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR and, where applicable, the EU-US Data Privacy Framework.

4. Retention Period

Personal data is only stored as long as necessary for the respective purpose:

• Usage analytics: 1 year (IP addresses automatically anonymized after 7 days)
• Onboarding data, contract documents: 10 years (statutory retention obligation under HGB/AO)
• Payment records: 10 years (tax law retention obligation)
• Conversation data (AI agents): Per customer (controller) instructions, typically until contract termination
• Treatment records, prescription data and prescription photos (physiotherapy): Per customer (controller) instructions; the customer is subject to a statutory retention period of 10 years (Section 630f German Civil Code) and receives this data in the export upon termination
• Email correspondence: 3 years after conclusion of the inquiry

5. Cookies

Our website does not use cookies. For language and theme preferences, we use localStorage, which is stored locally in your browser and is never transmitted to our servers. For usage analytics, we use sessionStorage (a temporary session identifier that is automatically deleted when the browser tab is closed). No analytics, advertising, or tracking cookies are used. Cookie consent is therefore not required.

Customer websites that we operate for our clients may additionally display a map from Google Maps. This map is only loaded after you give your consent via the cookie banner. When loaded, content is requested from Google and Google may set cookies or use local storage in your browser. You can withdraw your consent at any time via the "Cookie settings" button, which stops the map from loading. Legal basis: Art. 6(1)(a) GDPR (consent).

6. Your Rights (Art. 15–22 GDPR)

You have the right to:

• Access (Art. 15 GDPR) - What data we process about you
• Rectification (Art. 16 GDPR) - Correction of inaccurate data
• Erasure (Art. 17 GDPR) - "Right to be forgotten"
• Restriction (Art. 18 GDPR) - Restriction of processing
• Data portability (Art. 20 GDPR) - Provision of your data in a machine-readable format
• Objection (Art. 21 GDPR) - Against processing based on legitimate interests
• Withdrawal - Of given consents, without affecting the lawfulness of prior processing

Please direct inquiries to: info@yachay.systems

7. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority. In Germany, please contact the state authority responsible for your place of residence. A list of supervisory authorities can be found at the Federal Commissioner for Data Protection:

www.bfdi.bund.de

8. Changes to This Privacy Policy

We reserve the right to update this privacy policy when changes to our services or legal requirements occur. The current version is always available at yachay.systems/legal/privacy.html.