Privacy Policy

Effective Date: February 16, 2026

Yellah LLC ("we", "us", or "our") operates the Yellah Content Moderation platform. This Privacy Policy explains how we collect, use, store, and protect your personal data in compliance with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable data protection laws.

1. Data We Collect

1.1 Account Information

Name, email address, and profile photo (provided during sign-up)
Company/organization name
Team membership and role information

1.2 Billing & Payment Data

Subscription plan selection and billing interval
PayPal subscription ID and payer ID (we do not store credit card numbers)
Transaction history, invoice amounts, and credit balances

1.3 Usage Data

Moderation actions performed (text scans, image reviews, etc.)
API usage metrics and credit consumption
Session timestamps and game-room hours

1.4 Technical Data

IP address, browser type, operating system
Cookies and similar technologies (see Section 6)
Error logs and diagnostic information

2. Legal Basis for Processing (GDPR Article 6)

Purpose	Legal Basis
Providing the platform & subscriptions	Contract fulfillment (Art. 6(1)(b))
Processing payments via PayPal	Contract fulfillment (Art. 6(1)(b))
Sending service notifications	Legitimate interest (Art. 6(1)(f))
Analytics & platform improvement	Consent (Art. 6(1)(a))
Marketing communications	Consent (Art. 6(1)(a))
Tax & legal record-keeping	Legal obligation (Art. 6(1)(c))

3. Payment Processing & PayPal

We use PayPal as our payment processor for subscriptions and one-time credit purchases. When you subscribe or purchase credits:

You are redirected to PayPal or interact with PayPal's embedded checkout.
PayPal processes your payment details under their own Privacy Statement.
We receive only a subscription ID, payer ID, and transaction status — never your card number or bank details.
PayPal acts as an independent data controller for payment data it collects directly.

We have a Data Processing Agreement (DPA) with PayPal in accordance with GDPR Article 28.

4. Who We Share Data With

Recipient	Purpose	Data Shared
PayPal	Payment processing	Name, email, transaction amounts
Supabase (Postgres)	Database hosting	All app data (encrypted at rest)
Vercel	Application hosting	Server logs, IP addresses
Slack / Teams / Zapier	Notifications (if enabled)	Moderation alerts (no PII)

We do not sell your personal data to third parties.

5. Data Retention

Account data — retained while your account is active, deleted within 30 days of account closure (unless legally required).
Billing records — retained for 7 years to meet tax/legal obligations.
Moderation logs — retained for 90 days, then automatically purged.
Server/error logs — retained for 30 days.

6. Cookies & Tracking

We use the following categories of cookies:

Category	Purpose	Examples	Consent Required
Necessary	Authentication, CSRF protection, session management	Supabase auth cookies, active_team cookie	No (always on)
Payment	Secure checkout via PayPal	PayPal SDK cookies, fraud detection	Yes
Analytics	Usage measurement and improvement	Page views, feature usage	Yes
Marketing	Personalized offers	Email campaign tracking	Yes

You can manage your cookie preferences at any time using the cookie banner on our site. Non-essential cookies (payment, analytics, marketing) are only loaded after you consent.

7. Your Rights (GDPR Articles 15–22)

As a data subject, you have the right to:

Access — Request a copy of all personal data we hold about you.
Rectification — Correct inaccurate data via your Profile settings or by contacting us.
Erasure ("Right to be Forgotten") — Request deletion of your account and associated data. Tax/billing records may be retained as required by law.
Portability — Export your data in a machine-readable format (JSON).
Restriction — Request that we stop processing your data while a dispute is resolved.
Object — Object to processing based on legitimate interest (e.g., marketing).
Withdraw Consent — Withdraw previously given consent at any time (e.g., cookie preferences).

To exercise any of these rights, email privacy@yellah.com. We will respond within 30 days.

8. Data Export & Deletion

You can request a full data export or account deletion through your Profile Settings page, or by emailing privacy@yellah.com.

Data Export — We provide your data in JSON format within 72 hours.
Account Deletion — We cancel any active subscriptions, delete your profile, team memberships, and moderation data within 30 days. Billing records are anonymized and retained for 7 years per legal requirements.

9. Security Measures

All data encrypted in transit (TLS 1.3) and at rest (AES-256)
Row-level security (RLS) enforced at the database level
Service role keys restricted to server-side only
Webhook signature verification for all incoming PayPal events
Regular dependency audits and security patching

10. International Data Transfers

Our servers are hosted in the United States. If you are located in the EU/EEA, data transfers are protected by Standard Contractual Clauses (SCCs) with our sub-processors (Supabase, Vercel, PayPal).

11. Children's Privacy

Our service is not directed to individuals under 18 years of age. We do not knowingly collect personal data from children. If you are a parent and believe your child has provided us with personal data, contact us at privacy@yellah.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email and/or a prominent notice on our platform at least 30 days before taking effect.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights:

Email: privacy@yellah.com
Company: Yellah LLC

If you are unsatisfied with our response, you have the right to lodge a complaint with your local Data Protection Authority (DPA).