Document

Privacy policy

Effective from 14 October 2026

Version prelaunch-2026-10-14-v3

This notice describes the data and flows handled by Yuteki. During the private preparation period, public self-service registration may be closed. Existing accounts and controlled invitations work in line with permissions. The scope of processing depends on the functions, settings and activated integrations actually used. The document is a version prepared before the public launch and may be updated before the start; every version has a mark and a date.

1. Data controller and contact

The controller of personal data is Michał Piłat, an entrepreneur entered in CEIDG, NIP 9222839601, REGON 542359454. Place of business: Jatutów 90, 22-400 Jatutów, Polska. Address for service: Rabindranatha Tagore 5A/54, 93-503 Łódź, Polska. In this document we call them the operator.

Contact on matters of the service, privacy and security: biuro@yuteki.eu. Do not send a password or access tokens in your message.

The operator is the controller of the data it processes for its own purposes: the account, contact, settlements with users, the waiting list and the security of the service. Data entered into a workspace may come from its owner, employees, the client or other authorised persons. A person who is a CRM contact does not need to have an account.

When an organisation, for example an agency, runs a workspace in Yuteki and invites its employees or users of its clients to it, the controller of the content of that workspace (tasks, messages, files, CRM contacts, working time and settlements) is that organisation. The operator processes this content on its behalf as a processor, to the extent needed to provide the service. Matters concerning such data are primarily for the organisation that entered it; the operator will forward the request to it or help handle it. The rules of this processing are set out in the Data processing agreement.

2. Categories of data and purposes of functions

Account: name, email, password hash, verification status, declaration of legal age when a new account is created through self-service registration or an invitation, 2FA and recovery settings, sessions and access tokens. They are used for logging in, account protection and access management.
Workspaces and CRM: memberships, roles, permissions, agency-client links, company names, contact details, addresses, company identifiers and notes. They are used to organise cooperation and contacts.
Work: projects, tasks, descriptions, checklists, comments, assignees, deadlines, schedules, absences, working time and reminders. The data enables planning, carrying out and reporting work.
Communication: conversations, messages, reactions, attachments and presence status. The content may come from agency or client users.
Files: uploaded documents, names, metadata, profile pictures, logos and sharing links. They are used for storage and sharing within the selected scope.
Finance: rates, costs, settlements, instalments, proposals and decisions on them, module orders, subscription statuses, amounts, currencies, transaction and payment profile identifiers. The imoje integration handles payments; the application's data model does not store the full card number or the CVV code.
Technical data: IP, user agent, request context, security events, change history and diagnostics. They are used for operation, explaining problems and protecting the service. A push subscription contains the endpoint and keys needed to deliver a notification.
Choices and contact: notification settings, marketing preference, AI acceptance, signing up to the waiting list and the content of correspondence with the operator.

Do not enter unnecessary health information or other particularly sensitive data in free-text fields. The application does not need a medical diagnosis to describe an ordinary absence. Data provided in specific forms is needed to perform the given function; without login data the account cannot be used. Additional fields should be limited to the purpose of the work.

3. Legal bases of processing

Running the account and providing the service, including logging in, two-factor authentication, application functions, paid modules and handling requests and complaints: Article 6(1)(b) GDPR, that is concluding and performing the agreement for the provision of electronic services.
The account of a person invited to an organisation's workspace: Article 6(1)(b) GDPR as regards the agreement concluded when the account is created, and as regards access granted on behalf of the organisation also Article 6(1)(f) GDPR, that is the legitimate interest of enabling the organisation to work with its team and clients. The operator processes workspace content on the instructions of the organisation, which is its controller and is responsible for choosing the legal basis.
Waiting list: Article 6(1)(a) GDPR, that is consent to a single message about the launch of the service. Consent can be withdrawn at any time by writing to the contact address.
Security of the service, including security logs, form protection by Cloudflare Turnstile, request limiting, blocking abuse and diagnostics: Article 6(1)(f) GDPR, that is the legitimate interest of protecting the service and its users.
Issuing and keeping invoices and keeping accounting and tax records: Article 6(1)(c) GDPR in connection with tax and accounting law.
Establishing, exercising or defending claims: Article 6(1)(f) GDPR.
Optional analytics and marketing in the browser, launched through Google Tag Manager, and optional marketing messages: consent, that is Article 6(1)(a) GDPR, given in the cookie settings or in the account preferences. Consent can be withdrawn at any time.

Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal. You may object to processing based on a legitimate interest.

4. Access and recipients

Data may be visible to authorised workspace members, persons of the client or agency in line with the link and permissions, and to recipients of knowingly shared links and exports. A public link is access within the scope of the link, not a confirmation of the recipient's identity.

Recipients of data may be, to the extent needed for the given function:

OVH SAS, 2 rue Kellermann, 59100 Roubaix, France, the hosting provider the application runs on: servers, databases, file storage and backups;
OVH SAS, the provider of the email service through which the application sends account messages, invitations, notifications and reports;
the imoje payment operator, when paid modules are ordered and paid for;
Cloudflare, Inc. (USA), the provider of the Cloudflare Turnstile form protection, which receives the verification token and browser connection metadata;
Google, the provider of Google Tag Manager and the tags it launches, for example analytics; the script is loaded only after consent to at least one optional cookie category;
Bunny Fonts, a font provider established in the European Union, which the browser connects to when displaying the page;
the push service operators relevant to the browser, if you turn on push notifications;
Anthropic, the provider of the Claude API, only after the built-in AI is activated, as described in section 5.

The specific range of recipients depends on the deployment and the activated services. The details of the browser mechanisms are described in the Cookie policy.

OVH provides the hosting and email services in the European Economic Area; to that extent data is not transferred outside the EEA. Some recipients are established outside the EEA or may process data outside it, in particular Cloudflare, Google and Anthropic. Cloudflare and Google participate in the EU-US Data Privacy Framework, so a transfer to them is based on the European Commission's adequacy decision (Article 45 GDPR) and, as a fallback, on the standard contractual clauses approved by the European Commission and included in these providers' data processing terms (Article 46(2)(c) GDPR). The transfer mechanism for Anthropic is described in section 5. Information on the mechanism applied is available at the contact address.

Notifications may create copies of content in the application, email or the browser's push infrastructure. Queues, failed jobs, logs and exports have a life cycle separate from the main record. Persons authorised for maintenance, support and security may need access within the scope of their work; we make no assurance that staff can never see any data.

5. AI and data transfer

After the built-in AI is knowingly activated, selected content is transferred to the Anthropic Claude API: task titles and descriptions, criteria/checklists, type and status, deadlines and person labels, and excerpts of permitted channels. In the main agency-client channel these may be messages of client users. This does not mean analysis of all conversations.

Filtering of selected data is partial. Some fields, including checklists, type and status names, may be transferred without such filtering. We do not guarantee anonymisation. Results, comments, proposals and usage and cost metadata are stored by Yuteki. The detailed scope and the provider's qualified rules are described in the AI notice.

Data transferred to an external service may be processed outside the EEA. Anthropic's public DPA provides for transfer mechanisms, including appropriate contractual clauses; this is not a declaration that Yuteki has an active EU-only region or Zero Data Retention. The actual account terms are checked before activation. An external tool connected through an MCP token is a separate integration chosen by the token holder.

6. Retention periods

Loss of access is not equivalent to physical deletion of data. Deleting a person's account or membership, or the expiry of a module, does not automatically delete shared content, financial data or the entire history of the workspace. We keep the individual categories of data as follows:

Account: for as long as it exists. The account can be deleted in the profile settings after entering the password; this is not possible while the person owns a workspace or has employee settlements issued. Deleting the account removes its record, but content added to shared workspaces remains there.
Workspace content: for as long as the workspace operates. The standard ending of a workspace starts 90 days of owner access in recovery mode, with limited existing exports and the possibility of resuming before the deadline. After that deadline the workspace awaits further handling; in the current version no automatic physical deletion of all data takes place.
The test procedure for permanent deletion of a workspace, if made available in private mode, provides for 7 days for cancellation. Then the workspace is blocked until retention rules are determined; the procedure does not yet perform physical deletion of data.
Application logs: 7 days, in the default configuration of the service.
Security logs: 90 days, in the default configuration of the service; blocks imposed after abuse may last longer.
Change history in workspaces: 365 days, in the default configuration of the service.
Invoices and accounting records: for the period required by tax and accounting law, as a rule 5 years from the end of the calendar year in which the tax payment deadline passed.
Orders, transactions and subscription statuses: for as long as the service is used, and then for the period needed to fulfil tax obligations and to establish, exercise or defend claims. They are currently not deleted automatically.
Waiting list: until the message about the launch of the service is sent or consent is withdrawn, whichever comes first. The address is currently removed manually.
Correspondence with the operator: for as long as needed to handle the matter and to demonstrate how it was handled.

Deletion requests require an assessment of the scope, roles and any obligations of further retention. This applies in particular to financial data, settlements, security evidence and change history, and data needed to establish or defend claims. The 90-day and 7-day periods concern product functions, not statutory periods or the AI provider's retention.

Retention of backups, email, downloaded exports and data at providers is separate. Deleting a record does not mean immediate deletion of every copy. Switching off AI does not reverse earlier transfers or erase saved results. The visibility of proposals may expire earlier than their physical storage.

7. Choices and rights of persons

You have the right of access to data, rectification, erasure, restriction of processing, data portability and the right to object. For these matters, contact the operator. The applicability and scope of a given right depend on the circumstances of processing. We may need appropriate identity verification and to determine whether the matter should be handled with the organisation that entered the data. Exporting a business report is not automatically a complete exercise of the right to data portability.

Where processing is based on consent, you can withdraw it at any time: consent to the waiting list and marketing messages by a message to the contact address or by changing the preference in the settings, and consent to optional cookies by reopening the cookie settings.

You have the right to lodge a complaint with the supervisory authority, which in Poland is the President of the Personal Data Protection Office (UODO). Current details and contact methods are on the official UODO website.

The waiting list is used for information related to signing up and the launch. The voluntary marketing preference is separate from operational messages and cookie settings. You can change this preference in the settings; refusing marketing does not block the service. Push permission can be withdrawn in the application or browser settings, which does not reverse messages already delivered.

8. Automation and security

Reports and planning process work data. AI may automatically publish an auxiliary question or reminder, while a task proposal from the chat requires a decision by an authorised person. The function is not intended for assessing employees or for significant HR decisions. Results should be checked before being used in a significant decision.

The application applies access control and workspace boundaries, authentication mechanisms, request limiting and event logging. No description of security measures is a guarantee of complete security. Material changes to the information on processing require appropriate notice to the persons concerned.