Privacy Policy

1. Information We Collect

We collect information you provide directly: account details (name, email, hashed password credentials), business information you add to chatbots, payment information processed via Stripe (we never store full card numbers), and the content of conversations between your chatbots and their end users — which may include contact details and anything an end user chooses to type. Those conversations may come from a chatbot embedded on your website or, where you have connected one, from Facebook Messenger or Instagram direct messages (see section 4).

2. How We Use Information

We use the information we collect to: (a) provide and maintain the Service; (b) process payments; (c) send notifications about leads and account activity; (d) improve the Service; and (e) comply with legal obligations. We do not sell your data, and we do not use your conversation content to train our own models.

3. AI Processing

To generate chatbot replies, the content of conversations is sent to our AI provider, Anthropic, which processes it to return a response. Per Anthropic's commitments to its API customers, this content is not used to train its models. This applies to messages from a chatbot embedded on your website and to messages received through a connected Facebook Page or Instagram account — you are responsible for informing your visitors and obtaining any consent required in your jurisdiction. You should not configure a chatbot to request sensitive personal information (such as health, financial, or government-ID details).

4. Connected Messaging Channels (Facebook and Instagram)

A Yapr customer can connect their Facebook Page or Instagram professional account so that their chatbot answers messages sent to them there. Yapr is not affiliated with, endorsed by, or operated by Meta.

If you messaged a business and got an automated reply, that business uses Yapr and we processed the message on their behalf. When a message arrives we receive, from Meta: the content of your message, the account-scoped identifier Meta assigns you for that business, your public display name, and the time it was sent. We store the conversation so the assistant has context for later replies, and so the business can read it.

Message content is sent to Anthropic to generate the reply, exactly as described in section 3. If you provide contact details in the conversation — an email address or phone number — the business is notified and those details are saved to their lead records.

The business you messaged, not Yapr, decides what happens with that conversation. They are the controller of it; we process it for them under this Policy.

When a business connects an account, Meta issues us an access token that lets us send replies as them. Those tokens are encrypted before they are stored, and are deleted when the business disconnects the channel or removes our app.

Deleting your data. If you messaged a business through one of these channels, you can remove the Yapr app from your Facebook or Instagram settings and request deletion; Meta notifies us and we delete the conversation and every message in it, then show you a confirmation at getyapr.com/data-deletion. You can also email privacy@getyapr.com. Note that the business itself keeps its own records independently of us — including any contact details you gave them — and you would need to contact them directly about those.

5. How We Share Information

We do not sell your personal information. We share it only with the service providers and partners we use to operate Yapr, and only for the purposes described in this Policy. These service providers act as our processors and may have access to your information solely to perform services on our behalf:

• Anthropic (AI processing): We send conversation content and limited context to Anthropic so their Claude models can generate replies to website visitors.
• Supabase (database, authentication, and storage): We use Supabase to store account information, leads, conversations, and related operational data, and to handle authentication and authorization.
• Vercel (hosting and first-party analytics): We host the Yapr application and website on Vercel and may use its built-in analytics to understand performance and usage of our own properties.
• Resend (email delivery): We use Resend to send transactional emails, such as lead notifications, account-related messages, and support responses.
• Stripe (payments): We use Stripe to process subscription payments and manage billing; Stripe receives billing details and payment method information directly from you.
• Meta (Facebook and Instagram messaging): Where a customer has connected a Facebook Page or Instagram professional account, Meta delivers incoming messages to us and we send replies back through Meta's messaging APIs, as described in section 4. Meta handles that message data under its own privacy policy.

Each of these providers processes data under its own security and data processing commitments. We may also share information if required by law, regulation, legal process, or to protect our rights or the rights of others.

In addition, if you are a Yapr customer and you configure an integration — for example, a lead webhook to Zapier, Make, n8n, your CRM, or another endpoint, or a scheduling link to Calendly or Cal.com — we will transmit the relevant lead and conversation data to the destination you choose. In those cases, that third-party tool acts under your control and its own privacy terms, not ours.

6. Data Retention & Deletion

We keep account information for as long as your account is active. Conversation logs and captured leads are retained while your account is active and for up to 24 months afterward, unless you delete them sooner. You can delete individual conversations and leads at any time from your dashboard.

When you close your account, we delete or anonymize your personal data and your chatbots' conversation data within 30 days, except for limited records we must keep to meet legal, tax, or accounting obligations. To request deletion, email privacy@getyapr.com.

7. Data Security

We use industry-standard security practices including encryption in transit, secure authentication, and Row Level Security (RLS) on our database so one account cannot access another's data. However, no method of transmission over the internet is 100% secure.

8. Your Rights

You have the right to: (a) access the data we hold about you; (b) request correction of inaccurate data; (c) request deletion of your data; (d) export your data; and (e) opt out of marketing communications. You can access, export, and delete most of your data directly from your dashboard, or exercise any of these rights by emailing privacy@getyapr.com; we will respond within a reasonable time and as required by applicable law.

9. Cookies and Online Tracking

We use cookies and similar technologies to run Yapr and understand how it is used.

Essential cookies. We use essential cookies to keep you logged in, maintain your session, and help protect the Service from abuse. You cannot opt out of these cookies and still use core features.

First-party analytics. We may use first-party analytics tools (such as Vercel Analytics) to measure how Yapr's own website and app are performing, which pages are visited, and which features are used. These analytics are limited to our own online properties and are used to improve reliability, usability, and performance.

We do not use advertising cookies, we do not run cross-site behavioral ad tracking, and we do not sell data to advertisers. We also do not track your browsing activity across unrelated third-party websites.

10. International Data Transfers

Your information may be processed and stored in the United States and other countries where we or our service providers operate, which may have different data-protection laws than your own. Where we transfer personal data internationally, we rely on appropriate safeguards, such as our service providers' standard contractual clauses and data-processing agreements.

11. Children's Privacy

Yapr is a business tool for small businesses. Our Service and accounts are intended for adults operating on behalf of a business, and Yapr accounts are not for use by individuals under the age of 18 (or the age of majority in their jurisdiction).

We do not knowingly collect personal information directly from children under 13 years of age. However, our customers may choose to deploy Yapr on websites that can be visited by anyone, including minors. We require our customers to use Yapr in compliance with all applicable laws, including any obligations they may have under children's privacy laws when they operate their own sites.

If we learn that Yapr has stored personal information from a child under 13 without appropriate consent or legal basis, we will take reasonable steps to delete that information. If you believe a child under 13 has provided personal information to Yapr through a customer's chatbot, please contact us at privacy@getyapr.com so we can investigate and delete it where appropriate.

12. Changes to This Policy

We may update this policy periodically. We will notify users of significant changes via email or through the Service, and update the date above.

13. Contact

For privacy-related questions or to exercise your rights, contact us at privacy@getyapr.com. Yapr is the controller responsible for your personal data.