Privacy Policy

Last updated: September 2026

1. Data Controller (Art. 13(1)(a) GDPR)

KonzeptWeber LLC
30 N Gould St Ste N
Sheridan, WY 82801, USA
Email: info@yachay.systems
Website: https://yachay.systems
App: Rikuna (rikuna.yachay.systems)

For data protection inquiries, please contact: info@yachay.systems

2. Data Collected and Purposes

2.1 Website Visit and Usage Analytics

When you visit our website, we collect the following data for the purpose of improving our service and understanding how our pages are used:

• IP address (automatically anonymized after 7 days)
• Approximate location (country, city) derived from IP address via ip-api.com
• Browser type and version (User-Agent)
• Referrer URL (the page you came from)
• Pages visited, page type, and associated industry vertical
• Scroll behavior (how far you scrolled on the page)
• Time spent on each page (session duration)
• Clicks on call-to-action buttons
• UTM campaign parameters (if present in the URL)

This data is stored in our own database on European servers. We do not use third-party analytics services (no Google Analytics, no Meta Pixel). A temporary session identifier is stored in your browser's sessionStorage, which is automatically deleted when you close the browser tab. We do not use tracking cookies. To recognise returning visits we derive a pseudonymous value on our server from your IP address and browser identifier, secured with a secret key that never leaves our server. It does not allow your IP address to be reconstructed. The value is deleted after 12 months together with the visit record. If your browser sends a Do-Not-Track (DNT) signal, no analytics data is collected.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure provision and improvement of the website)

2.2 Contact and Onboarding

When you use our contact form, onboarding form, or email address, we process:

• Name, company name
• Email address
• WhatsApp number (optional)
• Information about your business (opening hours, typical inquiries, etc.)
• Content of the message

Legal basis: Art. 6(1)(b) GDPR (contract initiation/fulfillment) or Art. 6(1)(f) (legitimate interest in processing inquiries)

2.3 Payment Processing

For purchases through our website, payment data (name, email, billing address, payment method information) is processed by our payment provider Stripe. We only receive from Stripe the information necessary for order processing (email, amount, package). Complete payment data (e.g., card numbers) is stored exclusively by Stripe.

Legal basis: Art. 6(1)(b) GDPR (contract fulfillment)

2.4 AI Agent Communication

In the course of operating AI communication agents for our customers (businesses), conversation data is processed through the following channels:

• WhatsApp Business API - Messages via the customer's WhatsApp business number
• Instagram Direct Messages - Messages via the customer's Instagram Business account
• Facebook Messenger - Messages via the customer's Facebook Page
• TikTok Content Posting API - Video and photo publishing from the Rikuna dashboard via the customer's TikTok account (OAuth). Post metadata is stored; uploaded media is hosted on European servers.
• Web chat widget - Chat function on the customer's website (no login required)
• Telegram Bot API - optional, at the customer's request

The following data categories may be processed:

• Name and contact details of end users (patients, clients, guests)
• Content of messages and inquiries
• Appointment requests, booking information
• Health-related information (e.g., complaints, prescription information) - only for medical verticals and only when voluntarily provided by the end user
• Prescription data (diagnosis or ICD-10 code, prescribed remedy, number and frequency of treatments, date of issue) and a photo of the prescription - physiotherapy customers only, see 2.4.1
• Treatment documentation dictated by the practice's practitioners - physiotherapy customers only, see 2.4.2
• Conversation metadata (timestamps, channel, conversation ID)

Messages are stored server-side to allow the customer (business) to view conversation histories via their admin dashboard. Data is stored on European servers.

Yachay Systems processes this data as a data processor on behalf of the respective customer (business), who acts as the data controller. Processing is based on a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR.

Legal basis: Art. 6(1)(b) GDPR (contract initiation/appointment coordination) and Art. 6(1)(f) GDPR (legitimate interest in processing customer inquiries).

2.4.1 Prescription Photos (Physiotherapy)

Patients of physiotherapy customers can send a photo of their medical prescription via WhatsApp. The photo is checked by an AI image model at OpenAI to determine whether it shows a prescription and whether it is legible; the model returns only that verdict. The photo is then stored, together with the prescription data recorded by the practice, in the customer's Rikuna dashboard on European servers, where the practice reviews it. Photos that are not recognized as a prescription are rejected and not stored. The temporary copy used for the check is deleted immediately afterwards.

The customer (practice) is the controller for this data and provides the legal basis for processing health data (typically Art. 9(2)(h) GDPR). Patients can present the prescription in person instead.

2.4.2 Voice Documentation (Physiotherapy)

Practitioners of physiotherapy customers can dictate a treatment note in the Rikuna dashboard. The recording is transmitted to OpenAI solely for transcription (speech to text) under API terms that exclude use for model training, and is not stored by us. Only the transcript, its duration in seconds, and a structured draft of the note (complaint, history, findings, goal, measures, next step) generated by an OpenAI language model are stored on European servers. The draft becomes part of the treatment record only after the practitioner has reviewed and confirmed it.

Data subjects are the patient (content of the note) and the practitioner (voice, authorship). The customer (practice) is the controller and is responsible for the statutory retention of treatment records.

2.5 Google Account Integration (Calendar, Business Profile & YouTube)

Where a customer (business) chooses to connect their Google account to the Rikuna dashboard, we access Google user data via Google APIs strictly to provide the connected features. This integration is optional and is only activated through the customer's explicit OAuth consent.

Depending on the permissions granted, we access:

• Google Calendar (reading) - calendar event titles, start/end times, descriptions and status, read so that appointments stay in sync and times the business is already busy are never offered for booking.
• Google Calendar (writing bookings) - for appointments booked through our product, we create, update and delete the corresponding event in the calendar the business connected, including a Google Meet link for online sessions. If the business enters a customer's email address, the customer is added as a guest so Google sends them the invitation. Events our product did not create are never modified or deleted, and we do not create, delete or share calendars.
• Google account email address - to identify the connected account and display the connection status.
• Google Business Profile (where enabled) - business listing information such as opening hours and customer reviews, to display reviews in the dashboard, publish replies, and update opening hours on the business's own listing.
• YouTube channel and videos (read-only) - the title and avatar of the channel the business connects, so the dashboard can show which channel is connected, and the titles and public counts (views, likes, comments) of that channel's own videos for its statistics screen. We do not search, rate, comment on, edit or delete anything on the channel, and we access no other channel.
• YouTube video upload - videos the business composes in the dashboard are uploaded to that same business's own channel, immediately or at a time the business schedules.
• YouTube statistics (read-only) - views, watch time, average view duration, likes, comments, shares and subscribers gained or lost for the connected channel, shown to that business on its own statistics screen. We do not access revenue or monetisation data.

Our use of YouTube API Services is subject to the YouTube Terms of Service and the Google Privacy Policy.

OAuth access and refresh tokens are stored encrypted at rest on European servers and are used solely to call the Google APIs on the customer's behalf. The customer can revoke access at any time by disconnecting in the dashboard or via their Google account permissions; revocation deletes the stored tokens and the data imported from Google. For YouTube in detail: disconnecting in the dashboard also withdraws our access at Google and deletes the tokens immediately; access withdrawn in the Google account deletes them the next time we try to use them; video titles and per-video figures are deleted within 48 hours of the channel being disconnected. A video title we have not refreshed for 30 days is deleted even while the channel stays connected. Aggregated channel statistics collected while the connection existed contain no viewer-level data and are retained.

We do not use Google user data for advertising, we do not sell it, and we do not use it to train generalized AI/ML models. Human access occurs only where necessary for support requested by the customer, for security, or where required by law.

Limited Use: Yachay Systems' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use and transfer of raw or derived user data received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Legal basis: Art. 6(1)(b) GDPR (provision of the contractually agreed dashboard features) and Art. 6(1)(a) GDPR (the OAuth consent given when connecting the account).

How we use, process and share YouTube data: We use the data received from YouTube API Services only to show the connected business its own channel, to upload the videos the business itself releases, and to show the business its own statistics. The data is processed and stored on our servers at Hetzner Online GmbH in Germany (see section 3). Internally, it is shown only to the business that connected the channel, in its own dashboard; our staff access it only for support the business requests, for security, or where required by law. Externally, we share it with no one: it is not sold, not passed to advertisers, not passed to OpenAI or any other AI provider, and not shown to any other customer. The only external party that receives data from us in this integration is Google itself, when we upload a video or request statistics on the business's behalf.

Revoking access and deleting stored YouTube data: The business can revoke our access at any time, either with "Disconnect" on the YouTube screen of the dashboard or on the Google security settings page at myaccount.google.com/connections. In both cases the stored data is deleted as described above. To have all stored YouTube data deleted, including the aggregated channel statistics, the business can email info@yachay.systems; we delete it within 30 days at the latest and confirm the deletion by email.

Google Data Segregation: Google user data obtained via Google APIs is processed solely by Google and OpenAI, in accordance with the Limited Use requirements of the Google API Services User Data Policy. Data received from YouTube API Services is not passed to OpenAI.

2.6 How We Protect Your Data

We protect personal data, and in particular sensitive data and data received from Google APIs, with the following technical and organisational measures:

• Encryption in transit: Every connection to our website, the Rikuna dashboard and our APIs runs over HTTPS (TLS). HSTS instructs browsers to connect to us only over encrypted connections.
• Encryption at rest: OAuth access and refresh tokens for Google (Calendar, Business Profile, YouTube) and all other connected accounts are stored with AES encryption. The encryption key is kept separately from the database.
• Passwords and sessions: Dashboard passwords are stored only as salted bcrypt hashes, never in plain text. Session cookies are marked HttpOnly and Secure. After five failed password attempts the account is temporarily locked.
• Access control: Every dashboard request is authenticated and limited to the business the login belongs to. A business never sees another business's data. Our staff access customer data only as described in section 2.5.
• Hosting in the EU: Our servers are operated by Hetzner Online GmbH in ISO/IEC 27001-certified data centres in Germany.
• Data minimisation: We request only the Google permissions a feature needs, store only the data that feature uses, and delete stored Google data when the account is disconnected (see section 2.5).
• Data breaches: If a personal data breach occurs, we notify the competent supervisory authority and the affected customers as required by Art. 33 and 34 GDPR.

3. Third-Party Providers and Processors

Provider	Purpose	Location / Privacy
Stripe, Inc.	Payment processing	USA/EU · stripe.com/de/privacy
Hetzner Online GmbH	Server hosting and infrastructure	Germany · hetzner.com/legal/privacy-policy
OpenAI, LLC	AI language processing (agent responses), speech-to-text transcription of dictated notes, image check of prescription photos	USA · openai.com/policies/privacy-policy
Anthropic, PBC	AI language processing (agent responses)	USA · anthropic.com/policies/privacy
Google LLC	AI language processing (Gemini)	USA · policies.google.com/privacy
Meta Platforms Ireland Ltd.	WhatsApp Business API, Instagram Graph API, Facebook Messenger Platform (messaging channels)	Ireland · whatsapp.com/legal/privacy-policy
TikTok Technology Ltd.	TikTok Content Posting API (social publishing channel)	Ireland / Singapore · tiktok.com/legal/privacy-policy
Telegram Messenger Inc.	Telegram Bot API (messaging channel, optional)	UAE · telegram.org/privacy
Resend, Inc.	Transactional emails (confirmations, notifications)	USA · resend.com/legal/privacy-policy
BunnyWay d.o.o.	Font delivery (Bunny Fonts, privacy-friendly, no tracking)	EU (Slovenia) · bunny.net/privacy
ip-api.com	IP geolocation (country, city lookup for visit statistics)	Data queried in real-time, not stored by provider · ip-api.com/docs/legal

For the transfer of personal data to third countries (USA, China), we rely on Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR and, where applicable, the EU-US Data Privacy Framework.

4. Retention Period

Personal data is only stored as long as necessary for the respective purpose:

• Usage analytics: 1 year (IP addresses automatically anonymized after 7 days)
• Onboarding data, contract documents: 10 years (statutory retention obligation under HGB/AO)
• Payment records: 10 years (tax law retention obligation)
• Conversation data (AI agents): Per customer (controller) instructions, typically until contract termination
• Treatment records, prescription data and prescription photos (physiotherapy): Per customer (controller) instructions; the customer is subject to a statutory retention period of 10 years (Section 630f German Civil Code) and receives this data in the export upon termination
• Email correspondence: 3 years after conclusion of the inquiry

5. Cookies

Our website does not use cookies. For language and theme preferences, we use localStorage, which is stored locally in your browser and is never transmitted to our servers. For usage analytics, we use sessionStorage (a temporary session identifier that is automatically deleted when the browser tab is closed). No analytics, advertising, or tracking cookies are used. Cookie consent is therefore not required.

Customer websites that we operate for our clients may additionally display a map from Google Maps. This map is only loaded after you give your consent via the cookie banner. When loaded, content is requested from Google and Google may set cookies or use local storage in your browser. You can withdraw your consent at any time via the "Cookie settings" button, which stops the map from loading. Legal basis: Art. 6(1)(a) GDPR (consent).

6. Your Rights (Art. 15–22 GDPR)

You have the right to:

• Access (Art. 15 GDPR) - What data we process about you
• Rectification (Art. 16 GDPR) - Correction of inaccurate data
• Erasure (Art. 17 GDPR) - "Right to be forgotten"
• Restriction (Art. 18 GDPR) - Restriction of processing
• Data portability (Art. 20 GDPR) - Provision of your data in a machine-readable format
• Objection (Art. 21 GDPR) - Against processing based on legitimate interests
• Withdrawal - Of given consents, without affecting the lawfulness of prior processing

Please direct inquiries to: info@yachay.systems

7. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority. In Germany, please contact the state authority responsible for your place of residence. A list of supervisory authorities can be found at the Federal Commissioner for Data Protection:

www.bfdi.bund.de

8. Changes to This Privacy Policy

We reserve the right to update this privacy policy when changes to our services or legal requirements occur. The current version is always available at yachay.systems/legal/privacy.html.