Controller and scope
AWMB Sp. z o.o. is the data controller for account administration, billing relationships, support, and product use. Privacy requests may be sent to hello@awmbltd.com.
- This notice covers yoteeky.com, its passwordless account flow, workspace, subscriptions, and support requests.
- It does not govern TikTok, Stripe, or other third-party services acting under their own notices.
- YoTeeky is not directed to children under 13, or under 16 where that higher threshold applies.
Data categories and sources
We receive data directly from you, from service providers needed to operate your account, and from creator analytics files you choose to import.
- Identity and account data: email, passwordless authentication events, workspace membership, and account identifiers.
- Creator data: handles, profile labels, follower counts, imported post metrics, content labels, recommendations, scripts, experiments, and outcomes.
- Commercial and operational data: subscription status and Stripe identifiers—not full card details—support messages, security logs, audit events, and service diagnostics.
- AI operational records: model used, token counts, estimated provider cost, request identifiers where available, and sanitized execution status. Provider credentials are never collected from creators.
- First-party aggregate traffic events: page path, UTC day, a rotating one-way daily visitor token, referrer host, and coarse country/region where the hosting provider supplies it. Raw IP addresses, precise location, user-agent strings, advertising identifiers, and cross-site profiles are not retained.
Purposes and legal bases
We process data only for stated purposes and under an applicable GDPR legal basis.
- Contract: create and secure the account, provide the workspace, analyze imported history, generate requested outputs, and administer subscriptions.
- Legitimate interests: prevent abuse, protect the service, diagnose failures, improve reliability, and understand account-scoped product outcomes, balanced against user rights.
- Legal obligation: accounting, tax, fraud prevention, lawful requests, and records we must retain. Consent is used where law requires it, including any future non-essential cookies or optional marketing.
Recipients, processors, and transfers
Data is disclosed only as needed to operate the service, comply with law, or protect rights. Current provider categories include Vercel hosting, Supabase authentication and Postgres in Frankfurt, Stripe billing, transactional email, managed OpenAI processing, and the configured support-delivery provider.
- For classification, YoTeeky sends the creator account id, handle, label, niche, follower count and each selected post's id, title, caption, date, duration, views, likes, comments, shares, saves, follower count, and existing classification to OpenAI. For recommendations and scripts, the same account and post fields are sent with the current classification.
- YoTeeky uses a server-held OpenAI credential for requested workspace processing. Creator-facing surfaces never receive that credential, token accounting, or provider-cost records.
- Providers may process data outside the EEA. Where required, transfers rely on an adequacy decision, Standard Contractual Clauses, or another lawful safeguard.
- We do not sell personal data or use creator imports for third-party advertising.
Retention and security
Active workspace data is retained while the account is active and as needed to provide the service. Retention is then limited by deletion requests, legal duties, dispute needs, and security requirements.
- Verified active-data deletion requests are targeted for completion within 30 days, subject to lawful exceptions.
- Security and audit events may be retained for up to 365 days; billing and tax records may be retained for the legally required period.
- Production data is account-scoped in Postgres with row-level access controls; passwordless sessions use essential cookies. The managed OpenAI credential remains server-only and is never included in exports, logs, or creator-facing errors. No system is completely secure.
Your rights
Depending on the circumstances, you may request access, rectification, erasure, restriction, portability, or object to processing. You may withdraw consent without affecting earlier lawful processing.
- Use the workspace export and support controls, or the public privacy contact once confirmed. Identity verification may be required.
- Requests are answered without undue delay and generally within one month, subject to lawful extensions.
- You may complain to the data-protection authority in your habitual residence, workplace, or place of the alleged infringement.
Managed AI processing and retention
YoTeeky uses a server-held OpenAI credential to perform the requested contract service. Creator workspaces cannot supply, view, replace, or export that credential.
- Usage events contain operation, model, token counts, estimated provider cost, request id when available, time, account, and error code; this operational accounting is not shown to creators.
- Requested creator data transmitted to OpenAI may involve international transfers and provider-specific retention controls; YoTeeky does not promise that a provider stores nothing.
Automated processing and changes
YoTeeky uses automated analysis and generative AI to classify posts and suggest recommendations or scripts. These outputs support creator decisions; they do not make legal or similarly significant decisions about people.
- You choose whether to use, edit, test, or publish an output.
- Material privacy changes will be dated and presented through the service where appropriate.
- If a new purpose is incompatible with the original purpose, we will provide additional notice and obtain consent where required.