Privacy Policy

Last updated: March 2026

1. Data Controller (Art. 13(1)(a) GDPR)

KonzeptWeber LLC
30 N Gould St Ste N
Sheridan, WY 82801, USA
Email: info@yachay.systems
Website: https://yachay.systems

For data protection inquiries, please contact: info@yachay.systems

2. Data Collected and Purposes

2.1 Website Visit and Usage Analytics

When you visit our website, we collect the following data for the purpose of improving our service and understanding how our pages are used:

• IP address (automatically anonymized after 7 days)
• Approximate location (country, city) derived from IP address via ip-api.com
• Browser type and version (User-Agent)
• Referrer URL (the page you came from)
• Pages visited, page type, and associated industry vertical
• Scroll behavior (how far you scrolled on the page)
• Time spent on each page (session duration)
• Clicks on call-to-action buttons
• UTM campaign parameters (if present in the URL)

This data is stored in our own database on European servers. We do not use third-party analytics services (no Google Analytics, no Meta Pixel). A temporary session identifier is stored in your browser's sessionStorage, which is automatically deleted when you close the browser tab. We do not use cookies or persistent identifiers for tracking. If your browser sends a Do-Not-Track (DNT) signal, no analytics data is collected.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure provision and improvement of the website)

2.2 Contact and Onboarding

When you use our contact form, onboarding form, or email address, we process:

• Name, company name
• Email address
• WhatsApp number (optional)
• Information about your business (opening hours, typical inquiries, etc.)
• Content of the message

Legal basis: Art. 6(1)(b) GDPR (contract initiation/fulfillment) or Art. 6(1)(f) (legitimate interest in processing inquiries)

2.3 Payment Processing

For purchases through our website, payment data (name, email, billing address, payment method information) is processed by our payment provider Stripe. We only receive from Stripe the information necessary for order processing (email, amount, package). Complete payment data (e.g., card numbers) is stored exclusively by Stripe.

Legal basis: Art. 6(1)(b) GDPR (contract fulfillment)

2.4 AI Agent Communication

In the course of operating AI communication agents for our customers (businesses), conversation data is processed through the following channels:

• WhatsApp Business API - Messages via the customer's WhatsApp business number
• Instagram Direct Messages - Messages via the customer's Instagram Business account
• Facebook Messenger - Messages via the customer's Facebook Page
• Web chat widget - Chat function on the customer's website (no login required)
• Telegram Bot API - optional, at the customer's request

The following data categories may be processed:

• Name and contact details of end users (patients, clients, guests)
• Content of messages and inquiries
• Appointment requests, booking information
• Health-related information (e.g., complaints, prescription information) - only for medical verticals and only when voluntarily provided by the end user
• Conversation metadata (timestamps, channel, conversation ID)

Messages are stored server-side to allow the customer (business) to view conversation histories via their admin dashboard. Data is stored on European servers.

Yachay Systems processes this data as a data processor on behalf of the respective customer (business), who acts as the data controller. Processing is based on a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR.

Legal basis: Art. 6(1)(b) GDPR (contract initiation/appointment coordination) and Art. 6(1)(f) GDPR (legitimate interest in processing customer inquiries).

3. Third-Party Providers and Processors

Provider	Purpose	Location / Privacy
Stripe, Inc.	Payment processing	USA/EU · stripe.com/de/privacy
Hetzner Online GmbH	Server hosting and infrastructure	Germany · hetzner.com/legal/privacy-policy
OpenAI, LLC	AI language processing (agent responses)	USA · openai.com/policies/privacy-policy
Anthropic, PBC	AI language processing (agent responses)	USA · anthropic.com/policies/privacy
Google LLC	AI language processing (Gemini)	USA · policies.google.com/privacy
DeepSeek	AI language processing (agent responses)	China · deepseek.com/privacy
OpenRouter, Inc.	AI model routing and processing	USA · openrouter.ai/privacy
Meta Platforms Ireland Ltd.	WhatsApp Business API, Instagram Graph API, Facebook Messenger Platform (messaging channels)	Ireland · whatsapp.com/legal/privacy-policy
Telegram Messenger Inc.	Telegram Bot API (messaging channel, optional)	UAE · telegram.org/privacy
Resend, Inc.	Transactional emails (confirmations, notifications)	USA · resend.com/legal/privacy-policy
BunnyWay d.o.o.	Font delivery (Bunny Fonts, privacy-friendly, no tracking)	EU (Slovenia) · bunny.net/privacy
ip-api.com	IP geolocation (country, city lookup for visit statistics)	Data queried in real-time, not stored by provider · ip-api.com/docs/legal

For the transfer of personal data to third countries (USA, China), we rely on Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR and, where applicable, the EU-US Data Privacy Framework.

4. Retention Period

Personal data is only stored as long as necessary for the respective purpose:

• Usage analytics: 1 year (IP addresses automatically anonymized after 7 days)
• Onboarding data, contract documents: 10 years (statutory retention obligation under HGB/AO)
• Payment records: 10 years (tax law retention obligation)
• Conversation data (AI agents): Per customer (controller) instructions, typically until contract termination
• Email correspondence: 3 years after conclusion of the inquiry

5. Cookies

Our website does not use cookies. For language and theme preferences, we use localStorage, which is stored locally in your browser and is never transmitted to our servers. For usage analytics, we use sessionStorage (a temporary session identifier that is automatically deleted when the browser tab is closed). No analytics, advertising, or tracking cookies are used. Cookie consent is therefore not required.

6. Your Rights (Art. 15–22 GDPR)

You have the right to:

• Access (Art. 15 GDPR) - What data we process about you
• Rectification (Art. 16 GDPR) - Correction of inaccurate data
• Erasure (Art. 17 GDPR) - "Right to be forgotten"
• Restriction (Art. 18 GDPR) - Restriction of processing
• Data portability (Art. 20 GDPR) - Provision of your data in a machine-readable format
• Objection (Art. 21 GDPR) - Against processing based on legitimate interests
• Withdrawal - Of given consents, without affecting the lawfulness of prior processing

Please direct inquiries to: info@yachay.systems

7. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority. In Germany, please contact the state authority responsible for your place of residence. A list of supervisory authorities can be found at the Federal Commissioner for Data Protection:

www.bfdi.bund.de

8. Changes to This Privacy Policy

We reserve the right to update this privacy policy when changes to our services or legal requirements occur. The current version is always available at yachay.systems/legal/privacy.html.