Yovi Privacy Policy

What This Policy Covers

This policy covers the Yovi service: the admin console, Yovi sign-in, the browser extension, the desktop and mobile apps, and integrations with other services (together, "the Service"). It also covers this website.

Our Role

Most of the information in Yovi is processed on behalf of the organisation that uses it (our "customer"). The customer is the controller of that information and we are its processor. We use it only to provide the Service to that customer, under our agreement with them. If you use Yovi through your employer, your employer's own privacy notice also applies. Questions about how they use Yovi should go to their IT team.

We are the controller of the information we handle for our own purposes: the account details of customer administrators and billing contacts, billing records, support conversations, and messages you send us.

Information We Collect

What we collect depends on which parts of Yovi an organisation uses and how it configures them.

• Account and directory details. Name, work email address, and role or group membership. These come from your organisation's sign-in or directory provider, or are entered by an administrator. If you sign in to Yovi with a password, we store it only in hashed form.
• Sign-in activity. The apps and websites people sign in to for work, the account used, and when and how each sign-in happened. This includes the IP address, approximate location and browser involved, and how strong the password was. The strength check runs on your device, and the password itself never leaves it.
• Connections between apps. When one app or AI tool asks for access to another: which tool asked, which service, and what access it requested or was granted.
• Device information. Device type, operating system and version, security settings such as encryption and update status, and an identifier that lets us recognise the device. If your organisation's policy requires it, we also collect which app started a sign-in, and the apps installed on the device so we can check them against your organisation's app policy.
• Connected services. If your organisation connects Yovi to a service such as Google Workspace, Microsoft 365 or Okta, we receive what its chosen features need. This can include user and group lists, and the third-party apps people have granted access to.
• Billing. Billing contact and subscription details. Payments are handled by Stripe, and we don't receive or store full card numbers.
• Communications. What you send us when you ask for support or otherwise get in touch.
• Technical logs. Records of requests to the Service, including IP address, browser and time. We use these to operate and secure the Service.

What We Don't Collect

• The passwords you use for other services
• The content of web pages, emails, messages, documents or files
• Your general browsing. Yovi records sign-ins, not every page you visit
• Precise GPS location

This website does not use cookies, analytics or advertising trackers.

How We Use Information

• To provide the Service to the organisation that uses it, including showing activity to its administrators
• To sign people in, and to send sign-in approvals and security notifications
• To produce security insights and summaries for administrators, including with AI models
• To keep the Service secure, prevent misuse and fix problems
• To provide support and to manage accounts and billing
• To meet our legal obligations

We use a customer's data only to provide the Service to that customer.

Legal Basis

When we act as a processor, the customer is responsible for having a legal basis for the processing. When we are the controller, we rely on one of three grounds. We need the information to perform our contract with you or your organisation. We have a legitimate interest in running, securing and improving our business, and in replying to you. Or the law requires us to keep it.

Who We Share It With

We don't sell personal information. We share it only with:

• Your organisation. Its administrators can see the information collected for it.
• Service providers. Google Cloud hosts the Service, including storage, email delivery, mobile notifications and the AI models behind security insights. It processes information on our behalf and can't use it for its own purposes.
• Payments. Stripe processes payments for us. It also uses payment information for its own fraud prevention and legal compliance, under Stripe's Privacy Policy.
• Services your organisation connects. When your organisation links Yovi to another service, we exchange the information that service needs with it.
• Legal requirements. We share information when the law requires it, or when it is needed to protect people's rights, safety or security.
• Business changes. If Yovi is involved in a merger, acquisition or sale of assets, information may pass to the new owner. It remains protected by this policy.

Google User Data

Yovi's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Our Chrome extension also complies with the Chrome Web Store User Data Policy.

Where Information Is Stored

The Service runs on Google Cloud. Some information may be processed outside the UK and the European Economic Area. When it is, we protect it with approved safeguards such as the UK International Data Transfer Addendum and the EU Standard Contractual Clauses.

How Long We Keep It

We keep a customer's data while the customer uses Yovi, in line with its settings and our agreement with it. We delete or anonymise data within a reasonable period when any of the following happens:

• a user is removed
• a device is unenrolled
• the customer stops using Yovi

The exception is data the law requires us to keep. We keep account, billing and support records only as long as we need them, or as long as accounting and legal rules require.

Security

Information is encrypted in transit and at rest. Credentials that Yovi holds for connected services receive an extra layer of encryption. Access to customer data within Yovi is limited to the people who need it to run and support the Service.

If personal information is lost, exposed or accessed without authorisation, we investigate and contain it. Where we process that information for a customer, we tell the customer without undue delay and give it what it needs to meet its own reporting duties. Where we are the controller, we notify the Information Commissioner's Office and the people affected when the law requires it.

Your Rights

Depending on where you live, you may have the right to access, correct, delete or export your personal information. You may also have the right to object to or restrict how it is used. If we process your information for your organisation, send your request to your organisation, and we will help it respond. For anything else, email us.

You can also complain to a data protection authority. In the UK, that is the Information Commissioner's Office.

Your Choice

When setting up the Firefox extension, if your administrator has not already answered for your organisation by policy, Yovi asks before it collects anything, and you can decline.

Yovi needs this data to record sign-ins and the connections between applications, and to verify your device for the applications your organisation protects. If you are asked and choose to decline, the extension removes itself rather than staying installed and unable to work. You can install it again at any time.

Children

Yovi is a workplace service and is not intended for children.

Changes to This Policy

When we update this policy, we change the date at the top. If a change is significant, we tell our customers before it takes effect.

Contact

Yovi Ltd is responsible for this policy. For questions or requests, email info@yovi.ai. If you use Yovi through your employer, you can also ask their IT team.