Privacy Policy

Last updated: August 22, 2026

1. Who we are

This site and the services it describes are operated by Yaya Tech PBC, a public benefit corporation incorporated in the State of California, United States of America ("Yaya Tech", "we"). Privacy contact: andre@yaya.tech.

This policy follows Peru's Personal Data Protection Law No. 29733 and its Regulation (Supreme Decree 016-2024-JUS), and applies, where relevant, to users elsewhere (including California's CCPA/CPRA for residents of that state).

2. What this policy covers

• The yaya.tech website and its subdomains.
• The llm.yaya.tech AI gateway: the service that forwards text, vision and voice requests from yaya-network apps to AI model providers, meters usage and manages paid plans.
• The agent registry and network (public agent directory, encrypted agent-to-agent relay, the yaya CLI).

Each product (agento, agento business, yaya.cash, agente.fit) has its own policy, which applies in addition to this one when you use that product.

3. What we collect

3.1 Website

A standard access log: IP address, pages visited, browser and timestamp, for aggregate statistics and security. No tracking cookies or third-party advertising. If you leave your email in a form (e.g., to receive our thesis or updates), we store it with the date and what you requested.

3.2 AI gateway (llm.yaya.tech)

• Agent identity: every app install generates a cryptographic key (agent id). The gateway stores that id, the sign-up date and IP, and optionally a device hardware attestation (a manufacturer-signed certificate proving the app runs on a genuine device). We do not use the advertising ID.
• Request content: the message text, images and audio the app sends to get a reply. The gateway forwards them to the AI provider and does not store them; it keeps only counters (calls, tokens, date) to meter usage and enforce limits.
• Plans and payments: active plan, expiry, payment reference. Payments are processed through yaya.cash; we never see card data or wallet credentials.

3.3 Agent registry and network

A business that publishes its agent creates a signed public card: business name, offer (services, prices, hours, next slots), approximate location (≈100 m), payment rails, reputation and attestation status. That card is public by design: any agent can look it up. People using the consumer app do not publish a card; their profile and location stay on their phone and location travels rounded, only with searches. Agent-to-agent messages go through our relay end-to-end encrypted: we see sender, recipient, size and time, not content. Signed reviews and ratings are public and tied to an agent id, not a name.

4. How we use data

• Provide the Service: generate replies, deliver agent messages, publish and search cards.
• Meter usage, enforce quotas and bill plans.
• Prevent abuse (per-IP limits, attestation, key revocation).
• Send what you asked for and operational notices; news only if you opted in (unsubscribe anytime).
• Improve the Service with aggregate or anonymised data. Meet legal obligations.

Legal basis. Your consent (when you sign up, publish or leave your email) and performance of our contract with you. No targeted advertising, no selling or renting personal data, and request content is not used to train AI models.

5. Artificial intelligence

Replies are generated by a language model from an external provider. The model can be wrong. The apps are designed so that a person can see and correct what the agent does; the Service makes no decisions with legal effects on people.

6. Who we share data with

We may switch providers within these categories and will update the table. We may also disclose data where a law or competent authority requires it, or in a merger or acquisition, with prior notice.

7. How long we keep data

• Agent identity, plan and usage counters: while the agent is active and up to 90 days after revocation.
• AI request content: not stored beyond processing.
• Relay messages: until delivered or 7 days.
• Public cards and reviews: while the business keeps them published; it can withdraw them anytime.
• Technical and access logs: up to 12 months. Emails left on the site: until you unsubscribe.

International transfers

Yaya Tech is a U.S. company and our servers and providers may be outside Peru (mainly in the United States and the European Union). By using the Service you consent to this cross-border data flow. We require providers to give confidentiality and security guarantees equivalent to this policy.

Security

We use encryption in transit (TLS) across the Service; access keys are stored encrypted; administrative access requires separate keys and is logged; usage limits curb abuse. No system is infallible: if we detect a breach affecting your data we will notify you without undue delay and, where required, the Peruvian data-protection authority.

Your rights

You may access your data, rectify it, delete it, object to processing, withdraw consent and request portability (ARCO rights). Write to andre@yaya.tech from your registered email or number; we answer within 10 business days (access: 20), free of charge. If you believe we did not handle your request properly you may complain to Peru's National Authority for Personal Data Protection (ANPD). California residents also have the rights granted by the CCPA/CPRA; we do not sell or "share" personal data within the meaning of that law.

Minors

The Service is intended for businesses and people aged 18 or over. We do not knowingly register accounts for minors.

Changes to this policy

We will notify material changes through the Service or by email before they take effect. The "last updated" date shows the version in force.

Contact

Yaya Tech PBC · andre@yaya.tech. Consumers in Peru may also use our Libro de Reclamaciones.