Privacy Policy

Last updated: 30.03.2026

Who is responsible for your data?

The data controller is Top Online Sp. z o.o., headquartered in the EU at: Millennium Towers, 6th floor, rooms 6.02, 6.26, 6.27, Strzegomska 42AB, 53-611 Wrocław, Poland ("Top Online", "We", "Us", "Our").

Questions or requests? Email us at [email protected]. Any information you provide when contacting us is used solely to answer your inquiry.

Introduction

Your privacy matters to us. This Privacy Policy explains what personal data we collect, why we collect it, and how we protect it when you visit yosa.ai or use the YOSA platform.

By using our platform, you consent to the data practices described here — subject to the rights and controls described below.

This Policy applies to personal data collected when you visit yosa.ai (including any sub-pages) and/or when you use the YOSA platform.

We may update this Policy from time to time, but we will never do so in a way that undermines our commitment to your privacy. Where appropriate, changes will be communicated by email. Continued use of the platform constitutes acceptance of the updated Policy.

All capitalised terms used here have the same meaning as in the Terms of Service and applicable law.

Definitions

What data we collect and why

The personal data we collect depends on whether you are a visitor to the YOSA website or a registered Customer/User of the platform.

In general, we process personal data for the following purposes: account creation, provision of services, handling complaints or claims, analytics, marketing, service improvement, security monitoring and abuse prevention, and compliance with legal obligations.

Visitors to the YOSA website

When you visit yosa.ai or any of our sub-sites or sub-domains, we may temporarily collect: the name of your internet service provider, your IP address, the website you came from, the pages you visited on our site, the date and duration of your visit, and device information (e.g. device type, operating system, screen resolution, language, country, browser type).

We use this data to analyse, develop, improve, secure, and optimise our site, and to ensure we are reaching the right audience.

Where possible, we use this data in aggregated and/or anonymised form.

Legal basis: Article 6(1)(a) and Article 6(1)(f) GDPR (depending on context).

Customers and Users of the YOSA platform

When you create an account, contact our support team, or subscribe to our content or offers, we may ask for personal data such as your name, email address, and details about you or your organisation.

Legal basis for account data: Article 6(1)(b) GDPR.

We temporarily store IP addresses of platform Customers and Users to monitor performance metrics and track application errors. We will never access these IP addresses without an operational or security need.

Legal basis for IP data: Article 6(1)(f) GDPR.

We may use technical data (e.g. timestamps) to analyse, develop, improve, and optimise the platform.

You can delete your YOSA account at any time. After deletion, we may retain some personal data (in part or in full) to meet regulatory and reporting requirements and to handle any outstanding customer service issues, for the timeframes required by law.

We may use personal data and other data about our Customers and Users (including demographic and location information, and device data) to create anonymised, aggregated analytics where possible.

Legal basis: Article 6(1)(f) GDPR.

Website crawling for Project knowledge base

As part of the Service, the YOSA platform may crawl your website to build a knowledge base for a given Project. This process may incidentally collect personal data publicly visible on your website pages — such as names, email addresses, or other identifying information present in the crawled content.

Such data is processed solely for the purpose of building and maintaining the Project knowledge base and is not used for any other purpose.

As the data controller for your website, you are responsible for ensuring you have an appropriate legal basis for making that data available to us through the crawling process. This obligation is set out in the Personal Data Processing Agreement (Appendix No. 1 to the Terms of Service).

Legal basis on our part: Article 6(1)(b) GDPR. All data collected through website crawling is stored exclusively in the EU.

Cookies

What are cookies?

Cookies are small text files placed on your device when you visit a website. They are widely used to make websites work efficiently, to remember your preferences, and to provide information to site owners.

What cookies do we use?

We use the following categories of cookies on yosa.ai:

We do not use advertising or tracking cookies.

Legal basis: Article 6(1)(a) GDPR (consent) for analytics and functional cookies; Article 6(1)(f) GDPR (legitimate interest) for strictly necessary cookies.

Managing your cookie preferences

When you first visit yosa.ai, a cookie consent banner (powered by Usercentrics) allows you to accept or decline non-essential cookies. You can review and change your preferences at any time by clicking the "Privacy Settings" link in the footer of our website.

You may also manage or delete cookies directly in your browser settings:

• Chrome: Settings → Privacy and security → Cookies and other site data
• Firefox: Settings → Privacy & Security → Cookies and Site Data
• Safari: Preferences → Privacy → Manage Website Data
• Edge: Settings → Cookies and site permissions → Cookies and site data

To opt out of Google Analytics tracking specifically, you can install the Google Analytics Opt-out Browser Add-on.

Please note that disabling non-essential cookies may affect certain features of our website or platform.

Data Retention

We retain personal data for as long as necessary to deliver our Services or to meet our legal obligations. Anonymous or aggregated data may be retained indefinitely for analytics purposes.

Data Sharing and Disclosure

We do not sell your personal data.

We may share personal data only in the following circumstances:

• with trusted third-party service providers (e.g. hosting, cloud platforms, analytics, support), under strict confidentiality and data protection agreements;
• to comply with legal obligations or valid governmental requests;
• in connection with a business transfer (e.g. merger or acquisition).

Sub-processors

We use sub-processors to deliver parts of our service infrastructure. These include:

• cloud service providers (e.g. Hetzner),
• analytics providers (e.g. Google Analytics),
• authorisation and authentication platforms (e.g. Auth0),
• email service providers (e.g. Resend),
• payment processors (e.g. Stripe),
• AI model providers (e.g. OpenAI, Anthropic, Google),
• SEO data providers (e.g. DataForSEO, SEMSTORM),
• traffic analytics platforms (e.g. Agent Monitor),
• cookie consent management platforms (e.g. Usercentrics).

All sub-processors are contractually bound to ensure data protection compliance, including Standard Contractual Clauses where applicable.

Privacy policies of our main sub-processors:

Children's Privacy

Our Services are not intended for anyone under the age of 18. We do not knowingly collect personal data from children. If we become aware that a child has provided us with personal data, we will delete it. If you become aware of this, please contact us at [email protected].

Your Rights

If we hold personal data about you, you have the right to:

• access your data and be informed about how it is processed,
• rectify inaccurate or incomplete data,
• erasure / anonymisation of your data (subject to exceptions under applicable law),
• restrict processing of your data (subject to exceptions under applicable law),
• data portability - receive your data in a structured, commonly used, machine-readable format.

Withdrawing consent: Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. Please note that withdrawing consent may affect the quality of our site or platform. Where data was processed solely on the basis of consent, we may delete it upon withdrawal - meaning it will no longer be accessible or recoverable by you.

Complaints: You have the right to lodge a complaint with your national data protection authority.

Verification: To protect your privacy, we will verify your identity before fulfilling any request. We can identify you by email address and can only act on your request if we hold personal data about you through your direct contact with us or your use of our platform.

California Consumer Privacy Act (CCPA)

This section applies only to our processing of personal data as a "business" under the CCPA.

If you are a California resident and wish to exercise your rights under the CCPA, contact us at [email protected]. We will process your request in accordance with applicable law.

We do not "sell" personal data, and we do not have actual knowledge of any sale of personal data of minors under 16 years of age.

Only you, or someone legally authorised to act on your behalf, may make a verifiable consumer request under the CCPA. You may also make a request on behalf of your minor child where applicable.

Lei Geral de Proteção de Dados (LGPD)

This section applies only to our processing of personal data under the Brazilian LGPD.

If you are a Brazilian resident, or were in Brazil when your personal data was collected, and wish to exercise your rights under the LGPD, contact us at [email protected]. We will process your request in accordance with applicable law.