Privacy Policy

Who we are

YLAÜXI runs ylauxi.com and the YLAÜXI platform: a hosted service where businesses run their brand, shop, clients and operations. Privacy requests: privacy@ylauxi.com.

Two roles

For your account, we are the controller. This covers the details you give us to open and run a YLAÜXI account: your name, email, business details, plan and billing history, sign-in and security records, support messages, and how you use the product.

For your customers, we are your processor. When you use YLAÜXI to sell, book, invoice, email or serve your own customers and clients, you decide what is collected and why; we process it on your instructions under our Data Processing Agreement. If you bought from, booked with or were contacted by a business that uses YLAÜXI, that business's own privacy policy applies, and you can ask it, or us, to help with your rights.

How the platform is built

YLAÜXI is a shared, hosted service. Each account's data is kept apart from every other account's by the application: every record belongs to one account and is only served to that account and the people it invites. Prestige accounts can have dedicated infrastructure. Our servers are hosted by Hostinger in the European Union.

What we collect

• Account Name, email, password (stored only as a hash), business category and details you add, plan, trial and billing status.
• Billing Handled by Stripe. We keep invoices and payment status, never full card numbers.
• Security Sign-in times, IP addresses and devices, two-factor settings, and an audit record of sensitive actions.
• Product use Which features you use and errors you meet, to run and improve the service. We do not use third-party analytics on ylauxi.com.
• Support and enquiries Messages you send us, contact and Prestige application forms, and careers enquiries.
• Connected services When you connect an account such as Stripe, Meta, Google or a bank, the access it grants and the data you choose to sync.

How we use it

To provide and secure your account (contract), to bill you (contract and legal obligation), to send service and account messages (contract), to answer support (contract and legitimate interest), to prevent fraud and abuse and keep the platform safe (legitimate interest and legal obligation), and to improve the product (legitimate interest). We send marketing email only if you agree, and every one carries an unsubscribe link. We do not sell personal information or share it for cross-context advertising.

AI features

When you use AI features, the prompt and the content needed to answer it are sent to the AI providers listed on our Sub-processors page, such as Anthropic (Claude) and Higgsfield (MUSE). We do not use your data or your customers' data to train AI models. The AI Disclosure explains what the features do and what you should review.

Who we share it with

Only with the service providers that help us run YLAÜXI, listed with their purpose and location on the Sub-processors page; with services you connect yourself; and where the law requires it. Providers act on our instructions and are bound to protect the data.

International transfers

Our hosting is in the European Union. Some providers, including Stripe, Postmark and our AI providers, are in the United States. Transfers out of the EEA, UK and Switzerland rely on the European Commission's Standard Contractual Clauses (and the UK addendum) or the provider's certification under the EU-US Data Privacy Framework, as set out in the DPA.

How long we keep it

• Account data While your account is open. When you delete your account (Settings → Danger Zone), your profile and content are erased or anonymised straight away.
• Records the law requires Invoices, income records and signed contracts are kept for 7 years, then deleted automatically.
• Backups Backups expire on a rolling schedule: nightly database backups after 30 days, and our hosting provider's whole-server backups on its own schedule. Deleted data leaves each backup when it expires.
• Security records Kept as long as needed to protect accounts and investigate abuse.

Security

Traffic is encrypted with TLS. Passwords are stored only as hashes. Stored credentials, such as authenticator seeds, single sign-on secrets and connected bank and ad-account tokens, are encrypted individually with AES-256. Access to production systems is limited to the people who run the service. We keep nightly backups. We do not hold SOC 2 certification today, and we do not claim to.

Your rights

Depending on where you live, you can ask to see, correct, export or delete your personal data, to restrict or object to how we use it, and to withdraw consent at any time. You can export your data and delete your account yourself in Settings, or write to privacy@ylauxi.com. We reply within one month. You can also complain to your data protection authority.

California. You have the right to know, delete and correct personal information and to not be discriminated against for using these rights. We do not sell or share personal information and do not use sensitive personal information to infer characteristics.

Children

YLAÜXI accounts are for adults. A talent profile for a minor can only be created and managed by a parent or guardian, who is responsible for it.

Cookies

The Cookie Policy lists everything we store on your device.

Changes

When this policy changes materially, we tell account holders by email before it takes effect. The date at the top shows the latest version.

Contact

Privacy requests: privacy@ylauxi.com. Anything else: Contact page.

User Service Agreement · AI Disclosure · MUSE Terms · Privacy Policy · Data Processing Agreement · Cookie Policy · Terms of Service · Acceptable Use · Refund Policy · Service Level Agreement · Accessibility · Sub-processors · Data residency