Privacy Policy for YATFA

This Privacy Policy (the "Policy") explains how YATFA ("YATFA," "we," "us," or "our"), operated by YATFA Inc., collects, uses, stores, and protects information about users ("you" or "your") when using our website yatfa.com, CLI tools, API, and associated agentic automation services.

We understand the value of your intellectual property and the confidentiality of your code. Our architecture is designed around the principle of data minimization.

On Sign-Up: We collect your name, email address, and authentication data (including your GitHub account details when authenticating via OAuth).

Billing Information: Payment processing is handled by third-party certified payment processors. YATFA does not store your credit card or billing details on its servers.

Agent Usage: We track the compute each agent consumes — metered in Compute Credits (YATFA's unit of account, derived from the LLM tokens used) — for metering, limits, and billing purposes.

Technical Logs: Information about agent execution, error tracking (including Sentry integrations), execution times, and backlog queues.

No Permanent Storage: YATFA does not store your source code on its permanent database servers. Code is temporarily cloned into isolated Docker sandboxes solely for the duration of a specific task (Worker, Reviewer, or Researcher session) and is completely deleted immediately after the session ends.

No Model Training: We never use your source code, commit history, or pull request comments to train our own or third-party machine learning models.

Local Embeddings: Vector embeddings used for semantic search within your codebase and agent memory are generated and processed locally within our infrastructure. They are not transmitted to external third-party embedding generation services.

LLM Providers (Large Language Model APIs): Agent tasks and code context are transmitted through our own routing gateway to third-party large language model providers. For customer workloads we route to providers operating in the United States or the European Union, and only to providers whose commercial terms restrict the use of customer data for model training. If you are located outside those regions, this means your data is processed outside your country of residence. We select and may change providers at our discretion; a current list is available on request.

Error Tracking Services (Sentry): Application error data may be sent to Sentry for debugging and platform maintenance.

Sandboxed Execution: All agents run inside isolated Docker containers. They have no access to the host machine or other users' data.

Encryption: All data transmitted between the CLI, YATFA agents, and the platform is encrypted in transit using TLS and Secure WebSockets (WSS).

GitHub Authentication: We use the official GitHub App protocol with short-lived, automatically rotated tokens. We do not collect or store your personal GitHub passwords or permanent Personal Access Tokens (PATs).

Performance of a contract: creating and operating your account, connecting your repositories, running agent tasks, and metering usage. Without this processing we cannot provide the Service.

Legitimate interests: keeping the platform secure, preventing abuse, diagnosing faults, and improving reliability. We balance these against your rights and use the least data that achieves the purpose.

Legal obligation: retaining billing and accounting records where the law requires it.

Consent: only where we ask for it explicitly, such as optional notifications. You may withdraw consent at any time without affecting processing carried out beforehand.

We retain personal data for as long as your account is active, and for a limited period afterwards where we need it to resolve disputes, enforce our agreements, or meet legal, tax, and accounting obligations.

Technical logs and usage metrics are kept for a shorter operational period sufficient for debugging, billing accuracy, and abuse investigation. You may request deletion of your account and associated data at any time — see Your Rights below.

Right to Access and Export: You may request a copy of your personal data and project metadata stored on YATFA.

Right to Erasure ("Right to be Forgotten"): You have the right to request the complete deletion of your account, associated project metadata, agent memories, and knowledge bases.

Right to Withdraw Consent: You can revoke the GitHub App's access to your repositories at any time through your GitHub account settings, which will immediately stop YATFA from interacting with your code.

Right to Rectification: You may ask us to correct personal data about you that is inaccurate or incomplete.

Right to Restriction and Objection: You may ask us to restrict how we process your personal data, and you may object to processing we carry out on the basis of legitimate interests.

Right to Data Portability: You may request the personal data you provided to us in a structured, commonly used, machine-readable format.

Right to Complain: If you are in the European Economic Area or the United Kingdom, you may lodge a complaint with your local data protection supervisory authority. We would appreciate the chance to address your concern first.

California residents: we do not sell or share your personal information as those terms are defined by the CCPA, and we have not done so in the preceding twelve months. You may exercise the rights above without being discriminated against in the pricing or quality of the Service.

Automated decision-making: we do not make decisions about you that produce legal or similarly significant effects based solely on automated processing. The agents write and review code; they do not make decisions about your rights, pricing, or account standing.

Company Name: YATFA Inc.

Entity Type: Delaware C Corporation

Address: c/o Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA

Email: [email protected]