YumiLegal
Yumi Privacy Policy
This policy explains how digitalCode Sagl processes personal data when you use Yumi: the yumi.digitalcode.ch website, the dashboard, the chat and the widget. It applies under the Swiss Federal Act on Data Protection (FADP) and, where applicable, the European Union’s General Data Protection Regulation (GDPR).
1. Who processes your data
digitalCode Sagl Via Livio 5, 6830 Chiasso, Switzerland Email: info@digitalcode.ch Phone: +41 (0)91 682 88 44
When we are the controller and when we are not
- We are the controller for the data of people who create an account or are invited to an Organization, for billing, support and visits to the Yumi website.
- When you write to the assistant of one of our customers, for example from the widget on their website, the controller is the customer. We process those messages on the customer’s behalf, in accordance with the Data Processing Agreement. To exercise your rights, contact the customer; we will help if needed.
- For the Yumi assistant on our own website, we are the controller.
2. What data we process
a) Account
Name, email address, password (stored only as a non-reversible cryptographic hash), language, theme, time zone, role in the Organization and, if you enable it, two-factor authentication. We also record the date on which you accepted the terms and the version you accepted.
b) Organization and billing
Organization name, contact person, email, phone, address, country, VAT number if any, plan, subscription status, Credit usage and invoices. Card or bank account details are collected directly by Stripe: we do not see them.
c) Content and conversations
The Sources you add (web pages and documents), assistant configurations and conversations: questions, answers, cited sources and optional ratings. To recognize a conversation we use a temporary technical Visitor identifier; we do not store the IP address or the browser of the person writing in the database.
d) Support and email
The messages you send us through support or by email, and the data of the service emails we send you (for example address verification, invitations, billing notices).
e) Technical and security data
For each request, the server logs the IP address, the requested page, the date and the browser type. We also use the IP address, only in encrypted form, to limit login attempts and abuse. We keep a log of important account operations (for example access to settings, invitations, plan changes).
f) Visit statistics
On the public presentation pages only, we use a statistics tool installed on our own servers and operated by us, without cookies and without recording the IP address. We collect, in aggregate form, the page visited, referring site, language, screen size, browser and device. We respect the Do Not Track signal. The dashboard, chat and widget are excluded from tracking.
3. Why we process it and on what basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and managing the account and providing Yumi | Performance of the contract (Art. 6(1)(b)) |
| Billing, payments and accounting obligations | Contract and legal obligation (points (b) and (c)) |
| Support and service communications | Contract (point (b)) |
| Security, abuse prevention and technical logs | Legitimate interest (point (f)) |
| Anonymous statistics on public pages | Legitimate interest (point (f)) |
| Answers from the assistant on our website | Legitimate interest in answering your questions (point (f)) |
We do not sell personal data, we do not carry out advertising profiling and we do not use customer content or conversations to train artificial intelligence models. We do not make automated decisions that produce legal effects concerning you.
4. Where the data is and who receives it
| Recipient | Role | Data | Location |
|---|---|---|---|
| Data center provider | Hosting of Yumi’s servers: application, database, documents and backups | All Yumi data, stored encrypted in backups | Germany |
| digitalCode servers | Content processing: indexing, search and reading of images in documents | Excerpts from Sources and questions | Switzerland |
| Artificial intelligence model provider | Generating answers with an artificial intelligence model | Question, latest exchanges of the conversation and relevant excerpts from Sources, without IP addresses or identifiers | United States; for additional capacity also Europe and Singapore |
| Stripe Payments Europe Ltd. and Stripe group companies | Payments and invoices | Billing and payment data | Ireland, United States |
According to its own statements, the artificial intelligence provider processes content only for as long as necessary to produce the answer, without storing it or using it for training. Service emails are sent from our own mail server.
For transfers to countries that do not ensure adequate protection, such as the United States, we rely on appropriate safeguards, in particular the standard contractual clauses recognized by the Federal Data Protection and Information Commissioner (FDPIC) and the European Commission.
We may disclose data to authorities when required by law.
5. How long we keep it
| Data | Retention |
|---|---|
| Account and Organization content | For the term of the contract; deleted within 90 days of termination |
| Conversations | According to the customer’s setting: 30, 90 (default), 180 or 365 days from the last activity, or until manual deletion |
| Conversations with the assistant on our website | 90 days |
| Invoices and accounting records | 10 years, as required by Swiss law |
| Server logs | 14 days |
| Login sessions | 12 hours |
| Content of service emails | Deleted after sending, at the latest after 48 hours |
| Aggregated visit statistics | 24 months |
| Encrypted backups | No more than 90 days |
6. Cookies and browser storage
We use only strictly necessary technical cookies:
| Name | Purpose | Duration |
|---|---|---|
projectnicky_session |
Keeps you signed in to the dashboard | 12 hours |
projectnicky_chat_session |
Keeps your access to private channels | 12 hours |
projectnicky.dashboard.locale |
Remembers the language chosen in the dashboard, only if you choose one | 1 year |
The chat and the widget do not use cookies: they keep a temporary conversation identifier in the browser tab’s storage, which is cleared when the tab is closed. The dashboard remembers the chosen theme in the browser’s local storage. Public pages do not set cookies.
7. Security
All connections are encrypted (HTTPS/TLS). The processing servers communicate only through an encrypted private network. Passwords are stored as hashes, each Organization’s data is kept separate, access is limited to authorized personnel and backups are encrypted.
8. Your rights
You can ask to access your data, have it rectified or erased, restrict its processing, object to processing based on legitimate interest and receive it in a structured format. Write to info@digitalcode.ch: we respond within 30 days.
You can also contact the Federal Data Protection and Information Commissioner (FDPIC) (www.edoeb.admin.ch) or, if you reside in the European Union, the supervisory authority of your country.
9. Changes
We may update this policy. The version in force is always published on this page; we notify account holders of important changes by email or in the dashboard.