Privacy Policy

1. Overview

This Privacy Policy explains how yoou.io collects, uses, stores, shares, and protects personal information when you visit the website, create an account, use the dashboard, connect integrations, request password resets, use creation tools, or subscribe to the service.

The data controller is yoou.io, located at Rue de la Wantzenau, 67116 Reichstett, France. Privacy questions and rights requests can be sent to privacy@yoou.io.

2. Information we collect

We may collect account information such as name, email, password hash, Google OAuth identifiers, phone number, company name, VAT or tax ID, billing/contact address, user role, trial and subscription status, customer IDs, payment status, workspace preferences, cookie choices, API key previews, encrypted API keys, analysis history, project data, prompts, uploaded or described designs, generated metadata, usage logs, IP-derived abuse-prevention signals, device/browser metadata, consented campaign attribution such as source, medium, campaign, landing page, referral host and hashed advertising click identifiers, marketing email preferences, public-gallery publication settings, image titles and alternative text, administrator audit records, and support communications.

3. How we use information

We use information to provide the service, authenticate users, create and secure accounts, process password resets, operate trials and subscriptions, generate SEO and assisted output, save projects, detect abuse, rate-limit requests, prevent fraud, provide support, send service emails, maintain security, analyze product reliability, comply with law, and improve yoou.io, operate the public Design Ideas gallery, and record accountable administrator changes.

4. Legal bases for processing

Where GDPR or similar laws apply, we process personal information under one or more legal bases: performance of a contract, legitimate interests in operating and securing the service, compliance with legal obligations, consent where required for optional cookies or marketing, and your direction when you connect third-party services or submit content for automated processing.

5. Assisted creation, private keys, and generated output

If a feature supports a personal service key, yoou.io encrypts it at rest and uses it only to send requests you initiate. Prompts, design descriptions, images, metadata, and related context may be sent to the selected third-party processing service so it can return output. That service's own terms and privacy policy may also apply.

6. Authentication, email, billing, and infrastructure providers

We may share necessary data with Google for sign-in, consented analytics, and Search Console administration; Resend for email delivery and support messaging; Stripe, and PayPal when enabled, for checkout and subscription events; OpenAI for user-initiated assisted features; Cloudflare R2 for public image storage; Etsy for official marketplace queries; DataImpulse for proxy connectivity used by configured market-data collectors; and the hosting, database, cache, monitoring, and security providers needed to operate yoou.io. These providers receive only the data needed for their role and may also process information to meet their own legal obligations. When Etsy API access is active, yoou.io sends the user's marketplace search phrase to Etsy and does not display listing information more than six hours older than the corresponding Etsy information. Etsy credentials remain server-side and are not exposed to the browser.

7. Public Design Ideas and administrator activity

Authorized administrators may upload images and add titles, descriptions, categories, and publication settings for the Design Ideas gallery. Drafts remain restricted to the administration area. When an item is published, its image and selected metadata become publicly accessible. yoou.io may retain the administrator account identifier, action, timestamp, and limited technical metadata in audit records for accountability, security, and incident investigation.

8. Cookies and local storage

Required cookies and local storage support authentication, security, account preferences, cookie consent, and basic app behavior. When configured, Google Analytics loads only after you accept optional analytics and may process page visits, device information, approximate location, and product interactions. With that same consent, yoou.io may retain first- and last-touch campaign attribution to understand which campaigns lead to registration and product activation. Advertising click identifiers are hashed before server storage. Choosing necessary-only keeps this attribution, anonymous first-party Core Web Vitals measurement, and Google Analytics disabled. When analytics is accepted, yoou.io may retain anonymous Design Studio performance measurements for up to 90 days. They contain a hashed metric identifier, bounded product-area label, values, rating, navigation type, and timestamps, but no account ID, raw IP address, URL, prompt, artwork, or device identifier. You can manage browser cookies in your browser settings; blocking required cookies may prevent login or dashboard access.

9. Password reset and security

Password reset tokens are stored as hashes and expire after 1 hour. Passwords are hashed before storage. API keys and payment secrets are encrypted at rest. We use rate limiting, access controls, webhook verification, and abuse-prevention checks, but no internet service can be guaranteed to be perfectly secure.

10. Retention

We keep personal information for as long as needed to provide the service, maintain your account, comply with legal and tax obligations, resolve disputes, enforce agreements, prevent abuse, and preserve security logs. You may request deletion, subject to legal, billing, security, fraud-prevention, and backup-retention limits.

11. International transfers

yoou.io and its providers may process data in countries other than your own. Where required, we rely on appropriate safeguards such as contractual commitments, provider data processing terms, and other lawful transfer mechanisms.

12. Your rights

Depending on your location, you may have rights to access, correct, delete, restrict, object to processing, receive a portable copy of your data, withdraw consent, opt out of sale or sharing where applicable, limit the use of sensitive personal information, and avoid discrimination for exercising privacy rights. We may need to verify your identity before fulfilling requests.

13. California privacy notice

For California residents, categories of personal information collected may include identifiers, customer records, commercial information, internet or network activity, geolocation approximations from IP where applicable, professional or business information, inferences from product usage, and sensitive information such as account credentials or payment-related identifiers. yoou.io does not intentionally sell personal information. If a future feature involves sale or sharing as defined by California law, we will provide the required notices and opt-out methods.

14. Children

yoou.io is intended for adults and business users. It is not intended for children under 13 or for anyone under the age required to create a binding account in their jurisdiction.

15. Changes

We may update this Privacy Policy as the product, providers, laws, or business operations change. Material updates will be reflected by the updated date and, where appropriate, by in-app or email notice.

16. Privacy requests and contact

To request access, correction, deletion, portability, or other privacy support, contact privacy@yoou.io from the email address connected to your account. You can also review the Privacy Requests page for request details.