YamaXAI – Privacy Policy

Your privacy is fundamental to how we operate. This Privacy Policy ("Policy") explains how YamaXAI ("we," "us," or "our") collects, uses, shares, and protects information when you use our Services. By using YamaXAI, you agree to the practices described in this Policy.

1. Information We Collect

1.1 Information You Provide Directly

• Account Information: Name, email address, phone number, company details, billing address
• Profile Information: Job title, department, preferences, and other profile details
• Communications Data: Messages, call recordings, transcripts, and other content processed through our Services
• Payment Information: Credit card details, billing address (processed through secure third-party providers)
• Support Communications: Information in help requests, feedback, and customer support interactions

1.2 Information Collected Automatically

• Usage Data: Features used, time spent, clicks, navigation patterns, and interaction metrics
• Technical Data: IP address, browser type, device information, operating system, and access times
• Log Data: System logs, error reports, and performance metrics
• Communication Metadata: Phone numbers, call duration, timestamps, delivery status, and routing information

1.3 Information from Third Parties

• Integration Data: Information from connected services like CRM systems, communication platforms, and payment processors
• Analytics Data: Aggregated data from third-party analytics services
• Enrichment Data: Publicly available business information to enhance service functionality

2. How We Use Your Information

2.1 Service Provision and Improvement

• Deliver and maintain YamaXAI Services
• Process communications, payments, and transactions
• Provide customer support and troubleshooting
• Analyze usage patterns to improve service performance
• Develop new features and enhance existing functionality

2.2 AI Model Training and Enhancement

• Train and improve our AI models using aggregated, de-identified data
• Enhance natural language processing and communication capabilities
• Improve accuracy of automated responses and analytics

Note: We do not use identifiable personal information for AI training without explicit consent.

2.3 Business Operations

• Authenticate users and maintain account security
• Send important service updates and security notifications
• Comply with legal obligations and enforce our Terms of Service
• Prevent fraud, abuse, and security threats

2.4 Communications (With Your Consent)

• Send product updates and feature announcements
• Provide educational content and best practices
• Share relevant industry insights and case studies

You can opt out of promotional communications at any time.

3. How We Share Your Information

3.1 With Your Consent

We may share information when you explicitly authorize us to do so, such as when integrating with third-party services.

3.2 Service Providers and Partners

We work with trusted third parties who assist in providing our Services:

• Communication Providers: Twilio, Exotel for voice and messaging services
• AI Services: ElevenLabs for voice synthesis and processing
• Cloud Infrastructure: Secure cloud providers for hosting and data storage
• Payment Processors: Stripe, PayPal for billing and payment processing
• Analytics Providers: Services that help us understand usage patterns

All third parties are contractually required to protect your information and use it only for specified purposes.

3.3 Legal and Safety Requirements

We may disclose information when required by law or when we believe disclosure is necessary to:

• Comply with legal processes, government requests, or regulatory requirements
• Enforce our Terms of Service or other agreements
• Protect the rights, property, or safety of YamaXAI, our users, or others
• Prevent fraud, security threats, or illegal activities

3.4 Business Transfers

In the event of a merger, acquisition, or asset sale, your information may be transferred as part of the business transaction, subject to equivalent privacy protections.

4. Data Security and Protection

4.1 Security Measures

• Encryption: Data is encrypted in transit (TLS 1.3) and at rest (AES-256)
• Access Controls: Role-based access with multi-factor authentication
• Network Security: Firewalls, intrusion detection, and network monitoring
• Audit Logging: Comprehensive logs of system access and data handling
• Security Training: Regular security training for all personnel

4.2 Infrastructure Security

• SOC 2 Type II compliance (in progress)
• Regular security audits and penetration testing
• Private cloud deployment options available
• Data backup and disaster recovery procedures

4.3 Data Breach Response

In the unlikely event of a security breach, we will:

• Investigate and contain the incident immediately
• Notify affected users within 72 hours when required by law
• Work with law enforcement and regulatory authorities as appropriate
• Implement additional safeguards to prevent future incidents

5. Your Rights and Choices

5.1 Access and Control

• Access: Request copies of your personal information
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your personal information (subject to legal and operational requirements)
• Portability: Receive your data in a structured, machine-readable format
• Restriction: Request limitation of processing in certain circumstances

5.2 Communication Preferences

• Opt out of promotional emails using unsubscribe links
• Manage notification preferences in your account settings
• Contact us to update communication preferences

5.3 Cookie and Tracking Controls

• Manage cookie preferences through browser settings
• Opt out of analytics tracking (may affect service functionality)
• Control advertising preferences through third-party opt-out tools

6. Data Retention and Deletion

6.1 Retention Periods

• Account Data: Retained while your account is active and for 30 days after termination
• Communication Data: Retained as needed for service provision, typically 2–7 years based on business needs
• Usage and Analytics Data: Aggregated data may be retained indefinitely in de-identified form
• Legal Compliance: Some data may be retained longer to comply with legal obligations

6.2 Data Deletion

You can request data deletion by:

• Using account deletion features in your dashboard
• Contacting our support team at privacy@yamaxai.com
• Submitting a formal deletion request

Note: Some information may be retained in backups for up to 90 days after deletion request processing.

7. International Data Transfers

YamaXAI may transfer your information to countries outside your region. When we do so, we ensure appropriate safeguards are in place:

• Standard contractual clauses approved by relevant authorities
• Adequacy decisions by regulatory bodies
• Your explicit consent for specific transfers
• Other legally recognized transfer mechanisms

8. Children's Privacy

YamaXAI Services are not intended for children under 13 (or applicable age in your jurisdiction). We do not knowingly collect personal information from children. If we become aware of such collection, we will delete the information immediately.

9. Cookies and Tracking Technologies

9.1 Types of Cookies

• Essential Cookies: Required for service functionality
• Performance Cookies: Help us understand how you use our Services
• Functional Cookies: Remember your preferences and settings
• Marketing Cookies: Used to deliver relevant advertisements (with consent)

9.2 Managing Cookies

You can control cookies through your browser settings or our cookie preference center. Disabling certain cookies may affect service functionality.

10. Third-Party Links and Services

Our Services may contain links to third-party websites or integrate with external services. This Policy does not apply to those third parties. We encourage you to review their privacy policies before sharing information.

11. Updates to This Policy

We may update this Policy periodically to reflect changes in our practices, technology, or legal requirements. We will:

• Notify you of material changes via email or service notifications
• Post the updated Policy with the effective date
• Maintain previous versions for your reference

Continued use of our Services after updates constitutes acceptance of the revised Policy.

12. Regional Privacy Rights

12.1 European Union (GDPR)

If you are in the EU, you have additional rights including:

• Right to object to processing
• Right to withdraw consent
• Right to lodge complaints with supervisory authorities
• Right to data portability

12.2 California (CCPA)

California residents have rights including:

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt out of sale of personal information
• Right to non-discrimination for exercising rights

We do not sell personal information to third parties.

12.3 Other Jurisdictions

We respect privacy rights under applicable local laws and will comply with valid requests according to legal requirements.

14. Compliance and Certifications

YamaXAI is committed to maintaining the highest standards of data protection:

• SOC 2 Type II compliance (in progress)
• GDPR compliance framework implementation
• Regular privacy impact assessments
• Industry-standard security certifications

This Privacy Policy is effective as of the date listed above and supersedes any previous versions. By using YamaXAI Services, you acknowledge that you have read and understand this Privacy Policy.