Privacy Policy

Who we are and how to reach us

Yadi is operated by Embiro Technologies (U) Limited (“Yadi”, “we”, “us”), a company registered in Uganda under URSB registration number 80034279720092, with offices at Stage 5, Luzira, Nakawa Division, Kampala. We are the data controller for the personal data described here.

For any privacy question or to exercise a right, email privacy@embiro.com.

Who this policy covers

This policy applies to people who create a Yadi account and the workspaces they belong to. It also applies to people whose data passes through Yadi because an account holder connected a tool or asked a teammate to act — the people in their inbox, on their calendar, and in their meetings who are not themselves Yadi users. There is a short section on that below.

The data we collect

Account and identity

Your name, email, phone number, hashed password, the workspaces you belong to and your role in them, and your billing contact.

What you give your teammate

The tasks, instructions, and messages you send; files you upload to the knowledge base; and the business documents and website content you ask us to index.

Data from the tools you connect

When you connect Gmail, Google Calendar, Slack, Notion, and similar tools, your teammate reads the minimum needed to do a task — message content, calendar events, contacts, and files. Access is brokered by Composio. We never receive or store your passwords or OAuth tokens.

WhatsApp messages

For the personal-assistant teammate, the content of the messages you exchange over WhatsApp, plus your WhatsApp phone number and profile name, handled through the Meta WhatsApp Cloud API.

Meeting recordings and transcripts

Where you connect Fathom or Fireflies, we receive transcripts and summaries of your meetings. These contain the words and identities of everyone in the meeting, including people who are not Yadi users.

Memory

Facts your teammate learns to work better over time, stored in Mem0. You can view, edit, or delete any memory in the app.

Payment data

Your plan, billing history, and the partial card details Stripe returns. Card numbers are handled by Stripe; we never see or store them.

Usage, device, and log data

How you use Yadi, your IP address, browser and device information, and our audit log — a record of every tool run, approval, and automated action.

Cookies and analytics

We use essential cookies that keep you signed in and the app working. We also use PostHog to understand how the product is used and to capture errors, which may set cookies or similar identifiers in your browser. We do not use advertising cookies.

Special personal data

Emails, files, and meetings can contain special personal data under the Act — financial information, health details, or religious and political views. We do not ask for it, but it can appear in the content you ask a teammate to handle. We apply the same protections to it and process it only to do the task you set.

Why we use your data, and our lawful basis

We rely on the lawful bases in section 7 of the Act:

• To provide the service and perform the tasks you set — performance of our contract with you.
• To access the tools you connect and act on your instruction — your consent, given when you connect each tool, together with performance of the contract.
• To learn and recall facts that improve your teammate — your consent, which you can withdraw by deleting the memory.
• To bill you and prevent fraud — performance of the contract and our legitimate interest in running the business.
• To secure the service and keep the audit log — our legitimate interest in security and our duty to account for how we process data.
• To meet legal and regulatory duties in Uganda — compliance with a legal obligation.

You can withdraw consent at any time. Doing so stops the related processing going forward, though it does not affect what we did before.

AI processing and model providers

To generate a teammate’s replies and actions, we send the relevant content to AI model providers — Anthropic, Google, and OpenAI — through the Vercel AI Gateway.

These providers process your content only to produce a response for you. They do not use it to train their models, and the gateway runs with zero data retention. We send the least context a task needs and strip older conversation before each call.

Automated processing and your teammate’s autonomy

Your teammate can take actions on your behalf. You control what runs automatically and what waits for your approval. Anything that contacts a person outside your organization, and any movement of money, always waits for your explicit approval — even in Auto mode. You can review every action in the audit log and change a teammate’s autonomy at any time.

Who we share data with

• Subprocessors — vetted providers who host, power, or extend the service. The current list, with purpose and location, is in our Data Processing Addendum. We require each to protect your data and use it only to provide their service to us.
• Connected services — when you ask a teammate to act in a tool you connected, we send the data the task needs to that service, under its own terms.
• Legal and safety — where the law requires it, or to protect rights and safety.

We do not sell your personal data.

Sending data outside Uganda

Most of our subprocessors operate outside Uganda, mainly in the United States, so using Yadi involves transferring your data to them. We do this in line with section 19 of the Act: with your consent, given when you accept this policy and connect a tool, and under contracts that require each provider to protect your data to a comparable standard.

How long we keep it

• Account data — for as long as your account is open.
• Task content, threads, and memory — until you delete them, or until your account is deleted.
• Connected-tool data — we hold only what a task needs and do not keep a standing copy of your inbox or calendar.
• Audit logs — retained for at least 12 months for security and accountability.
• Billing records — kept for as long as Ugandan tax and company law require.

When you delete your account, we remove your content and memory within 30 days, except where we must keep specific records to meet a legal obligation.

How we protect your data

We encrypt data in transit and at rest, broker credentials so we never hold your tokens, scope each teammate’s access to the tools you grant, isolate each workspace, and keep an append-only audit log. No method is perfectly secure, so we also commit to the breach process below. You can read more on our Security page.

If something goes wrong

If personal data is exposed to someone who should not have it, we will notify the Personal Data Protection Office and the affected people without undue delay, as the Act requires, and tell you what happened and what to do.

Your rights under the Act

Depending on your situation, you can:

• Access the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data deleted or destroyed.
• Object to or stop processing that causes you damage or distress.
• Withdraw a consent you gave.
• Complain to the Personal Data Protection Office.

To exercise any of these, email privacy@embiro.com. We will respond within the time the Act allows. You can also complain directly to the Personal Data Protection Office.

People who aren’t Yadi users

When an account holder connects a tool or records a meeting, data about other people flows through Yadi — the senders in an inbox, the guests on a calendar, the voices in a meeting. The account holder is responsible for having the right to share that data and, where the law or the meeting’s setting requires it, for getting consent to record. We process this data only to provide the service to the account holder, and the rights above apply to it.

Children

Yadi is not intended for children under 18, and we do not knowingly collect their data. Where a child’s data is processed, the Act requires the consent of a parent or guardian. If you believe we hold a child’s data without that consent, contact us and we will remove it.

Changes to this policy

We will post changes here and update the date above. For significant changes we will give notice in the app or by email.

Contact and complaints

Privacy questions or requests: privacy@embiro.com. If you believe we have mishandled your data, you can also complain to the Personal Data Protection Office of Uganda.