Privacy Policy

Last updated October 28, 2026

This privacy notice explains how Yaay ApS ("Yaay," "we," "us," or "our") collects, uses, stores and shares ("processes") your personal information when you use our services (the "Services"), including when you:

Use the Yaay app on iOS or Android

Message the Yaay Agent on iMessage, SMS, Instagram Direct Messages or inside the Yaay app

Open a page or short link on yaay.link that the Yaay Agent or another person sent you

Visit https://yaaytravel.com or any other website of ours that links to this notice

Email us, forward a booking to us, or otherwise get in touch

Yaay ApS is the controller of your personal information. If you have questions, or do not agree with how we handle your information, contact us at privacy@yaaytravel.com.


SUMMARY OF KEY POINTS

What do we collect? Your account details, what you save and plan in Yaay, what you send the Yaay Agent, and technical data about your device and how you use the Services. See section 1.

Is the Yaay Agent a person? No. The Yaay Agent is a social AI agent. Your messages to it are processed by AI models run by the providers listed in section 5. See section 3.

Do we get information from third parties? Yes, for example when you sign in with Apple, Google, Facebook or TikTok, when you message us on Instagram, and when you share a public post with us. See section 1.

Do we sell your information? No. We do not sell your personal information and we do not use it for third-party advertising.

Do we use your information to train AI models? We do not let our AI providers train their models on your information. See section 3.

Where is it stored? Our main databases and servers are in the European Union (Ireland). Some providers process data outside the EU. See section 7.

What are your rights? You can access, correct, export or delete your information, and object to some processing. Email privacy@yaaytravel.com or delete your account in the app. See section 11.


TABLE OF CONTENTS

1. WHAT INFORMATION DO WE COLLECT?
2. HOW DO WE USE YOUR INFORMATION?
3. THE YAAY AGENT AND AI
4. WHAT LEGAL BASES DO WE RELY ON?
5. WHO DO WE SHARE YOUR INFORMATION WITH?
6. COOKIES AND ANALYTICS
7. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?
8. HOW LONG DO WE KEEP YOUR INFORMATION?
9. HOW DO WE KEEP YOUR INFORMATION SAFE?
10. CHILDREN
11. WHAT ARE YOUR PRIVACY RIGHTS?
12. ADDITIONAL INFORMATION FOR UNITED STATES RESIDENTS
13. UPDATES TO THIS NOTICE
14. HOW CAN YOU CONTACT US?


1. WHAT INFORMATION DO WE COLLECT?

In Short: We collect what you give us, what you send the Yaay Agent, what your device tells us, and some information from the services you connect.


Information you give us

Account details: your name, email address, phone number, username, profile picture, country and city.

Optional profile details: your date of birth and gender, if you choose to share them during onboarding.

Sign-in details: identifiers from the sign-in method you use (Apple, Google, Facebook, TikTok, email code or phone number). We do not store passwords. We store sessions as one-way hashes.

What you save and plan: places, links, videos and posts you save, your boards and collections, ratings, notes, trips, events and the friends and groups you share them with.

Addresses: if you choose to, addresses you ask the Yaay Agent to remember, such as home or work.

Bookings and expenses: booking confirmations you forward to us (for example to trips@yaay.link), and shared expense tabs you create with the Yaay Agent.

Photos, videos and voice: photos and screenshots you send or pick in the app, and voice messages or dictation.

Feedback and support: what you write when you contact us, rate the app, or report a problem.


Information you send the Yaay Agent

When you message the Yaay Agent on iMessage, SMS, Instagram or in the app, we receive and store the messages, photos, links, voice notes, reactions and locations you send, together with your phone number, Apple ID email, or Instagram account id and username. If you add the Yaay Agent to a group chat, we also receive the messages in that group that are addressed to it. We store what the Yaay Agent learns from the conversation (for example your preferences or plans) so it can remember them later. See section 3.


Information from your device

Location: if you allow it, your device's location, to show nearby places and answer questions about where you are. You can share a location with the Yaay Agent from a yaay.link page. You can turn location access off in your device settings at any time.

Contacts: if you allow it, we check the phone numbers and email addresses in your address book against Yaay accounts so we can show which of your contacts use Yaay. We do not keep your contacts' details in readable form.

Photos and camera: if you allow it, the photos you choose to share with Yaay. We do not access photos you do not pick.

Microphone: if you allow it, for dictation and voice messages.

Push notifications: a device token, if you allow notifications. You can turn them off in your device settings.

Device and usage data: device model, operating system, app version, language, IP address, crash reports, performance data, and how you use the Services (for example which screens you open and which features you use).


Information from third parties

Sign-in providers: when you sign in with Apple, Google, Facebook or TikTok, we receive your name, email address and account id from that provider, as allowed by your settings there.

Instagram (Meta): when you message @yaaytravel on Instagram, Meta sends us your messages, your Instagram-scoped id, username and display name.

Content you share or import: when you save or share a link, or import saves from another app you connect, we fetch the public content behind it so we can find the places in it.

Other users: another user may share a board, a trip or a yaay.link page with you, add you to a group chat with the Yaay Agent, or upload a contact list that contains your number or email (which we do not keep in readable form).


Information we infer

To personalise the Services, we derive some information from what you give us, such as a summary of the kinds of places you like and your preferences. Information we derive is kept separate from what you tell us yourself and never overwrites it.


Sensitive information

We do not ask for sensitive information (such as health, religion, sexual orientation or political views). If you choose to include it in a message to the Yaay Agent, it is processed only to answer you. Please avoid sending it.


Payment information

We do not process payments today. If you book through a link the Yaay Agent sends you, you pay the booking site directly, under its own terms and privacy notice.


2. HOW DO WE USE YOUR INFORMATION?

In Short: To run the Services, to personalise them, to keep them safe, and to improve them.

To create and manage your account and let you sign in, including linking the accounts you use to reach us (app, phone number, Instagram).

To provide the Services: save and organise places, find places and events in the content you save, build trips, show maps, answer your questions and run the yaay.link pages the Yaay Agent makes for you.

To personalise recommendations, using your saves, ratings, taste profile, location and the preferences you share.

To connect you with friends, including showing which of your contacts use Yaay, if you allow it.

To send you service messages, such as verification codes, replies from the Yaay Agent, reminders you asked for, and notifications you have turned on.

To support you and respond to your feedback.

To understand how the Services are used and improve them, including measuring and evaluating the quality of our AI features.

To keep the Services safe, prevent abuse and fraud, and debug problems.

To comply with the law and enforce our Terms.


3. THE YAAY AGENT AND AI

In Short: The Yaay Agent is an AI, not a person. Our AI providers process your messages to answer you, and may not use them to train their models.


The Yaay Agent is an artificial intelligence system, not a person. Its answers are generated automatically and can be wrong, so check important details (such as prices, opening hours and booking terms) before you rely on them.

To answer you, the Yaay Agent sends the relevant parts of your conversation, the places and content involved and, where needed, your location to the AI model and search providers listed in section 5. It also uses AI to read the posts and videos you save (including transcribing their audio and reading text in images) to find the places in them.

Our AI model providers process this data only to return a result to us. Under our agreements with them they may not use it to train or improve their own models. Some providers keep requests for a limited time to detect abuse.

The Yaay Agent remembers things you tell it (for example your preferences, plans and addresses) so it does not have to ask again. You can ask it to forget something, or ask us to delete everything it remembers.

We do not use the Yaay Agent to make decisions that have legal or similarly significant effects on you.

Instagram messages. When you message us on Instagram, we use the information Meta sends us only to provide the Yaay Agent to you and to operate and improve that service. We do not sell it, use it for advertising, or share it except with the service providers needed to answer you. You can ask us to delete it at any time (see section 11).

Group chats. In a group chat, the Yaay Agent only responds when someone addresses it. What it learns from a group is visible only to that group.


4. WHAT LEGAL BASES DO WE RELY ON?

In Short: If you are in the EU, EEA or UK, we rely on the legal bases below.

Performance of a contract: to provide the Services you asked for, including your account and the Yaay Agent's answers.

Consent: for location, contacts, photos, microphone and notifications (through your device's permission prompts), for optional profile details, and for marketing messages. You can withdraw consent at any time without affecting earlier processing.

Legitimate interests: to personalise and improve the Services, to evaluate the quality of our AI features, to understand usage through analytics, to keep the Services secure and prevent abuse, and to infer the information described in section 1. You can object to this processing (see section 11).

Legal obligations: to comply with laws, for example on accounting, or when a court or authority requires it.


5. WHO DO WE SHARE YOUR INFORMATION WITH?

In Short: With the service providers that help us run Yaay, with people you choose to share with, and where the law requires it. We do not sell your information.


Service providers

We share personal information with service providers ("processors") that process it on our behalf and under our instructions, bound by data processing agreements. The providers we use today are:

Hosting, storage and databases
- Amazon Web Services (servers, file storage, queues, email delivery, image text recognition, and some AI models through Amazon Bedrock). Ireland, with some AI requests in the United States.
- PlanetScale (databases). Hosted on AWS in Ireland.
- Cloudflare (yaay.link pages and short links, forwarded booking emails, video storage, website delivery). Global network.

AI models
- Microsoft Azure OpenAI (our main AI models, including the Yaay Agent). Sweden and Western Europe.
- Google Gemini and Vertex AI (video understanding and backup models). Global.
- OpenAI (backup models and audio transcription). United States.
- xAI (backup models). United States.
- Anthropic (backup models). United States.

Search, maps and travel data
- Google Maps Platform (place details, photos and maps). Global.
- Apple MapKit and WeatherKit (maps and weather forecasts). Global.
- SearchAPI (flight, hotel and web search results). United States.
- Exa, Brave Search and Google Custom Search (web search). United States.
- Booking.com (hotel availability and prices). Netherlands.
- RapidAPI and the API providers behind it (fetching public posts and videos you save). Various.
- OpenGraph.io (link previews). United States.

Messaging and sign-in
- Linq and Photon (delivering Yaay Agent messages on iMessage and SMS). United States.
- Meta (Instagram Direct Messages, and Facebook sign-in). United States and Ireland.
- Prelude (sending phone verification codes by SMS). France.
- Apple, Google and TikTok (sign-in). United States.

Analytics, monitoring and support
- PostHog (product analytics, AI quality monitoring, support tickets and push notifications). European Union.
- Sentry (crash reports and error monitoring). Germany.

App distribution
- Apple App Store and TestFlight, Google Play, and Expo (app builds and updates).

Internal tools, which our team may use to handle support requests, incidents and bug reports that contain personal information
- Slack, Notion, Linear, incident.io, GitHub, Google Workspace and 1Password.


Other situations

People you share with: boards, trips, yaay.link pages and group chats are visible to the people you share them with, or to anyone with the link if you make them public.

Booking and partner sites: when you open a link to a booking site, that site receives what you send it. Some links carry an affiliate tag so we may earn a commission. We do not send them your personal information.

Business transfers: if we are involved in a merger, acquisition or sale of assets, your information may be transferred as part of that deal, under this notice.

Legal requirements: when the law requires it, or to protect the rights, property or safety of Yaay, our users or others.


6. COOKIES AND ANALYTICS

In Short: We use cookies and similar technologies to keep you signed in and to understand how the Services are used. We do not use advertising cookies.

yaay.link uses a cookie to keep you signed in and a cookie with a random id for analytics. The app and yaay.link use PostHog to measure usage, and Sentry to report errors. We do not use cookies for third-party advertising or cross-site tracking. You can block or delete cookies in your browser settings, though some features may stop working.

We do not currently respond to Do-Not-Track browser signals, as there is no common standard for them.


7. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?

In Short: Our main systems are in the EU, but some providers process information in other countries.

Our servers and databases are in Ireland, and our main AI models run in Sweden and Western Europe. Some of the providers in section 5 process information in the United States or other countries outside the EU, EEA and UK. When we transfer personal information outside the EU, EEA or UK, we rely on an adequacy decision (such as the EU-US Data Privacy Framework, where the provider is certified) or the European Commission's Standard Contractual Clauses, together with the additional safeguards those require. You can ask us for a copy of the safeguards that apply.


8. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: As long as you have an account, and shorter where we do not need it.

We keep your account information, saves and Yaay Agent conversations while your account is active, so the Services can work and the Yaay Agent can remember you. If you message the Yaay Agent without creating an account, we keep that conversation in the same way until you ask us to delete it.

Some information has a shorter, fixed lifetime:
- A location you share through yaay.link: as long as the Yaay Agent needs to read it, and at most two hours on a shared live map.
- Forwarded emails as received: three days (the booking details we read from them stay with your trip).
- Photos in a shared yaay.link album: 90 days.
- yaay.link sign-in sessions: deleted after 90 days without use.
- Email delivery logs: 30 days.

When you delete your account, we remove it from the Services straight away and delete or anonymise your personal information within six (6) months, unless we must keep some of it longer to comply with the law, resolve disputes or prevent abuse. Copies in our backups are deleted as the backups expire.


9. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We use technical and organisational measures to protect your information.

We encrypt information in transit and at rest, limit access to the people who need it, store secrets in a password manager, store sessions and contact details only in a form that cannot be read back, and monitor our systems for errors and abuse. No system is perfectly secure, so we cannot guarantee that your information will never be accessed without permission. If a breach affects you, we will tell you and the authorities as the law requires.


10. CHILDREN

In Short: You must be at least 16 to use Yaay.

The Services are not intended for anyone under 16 years of age, and we do not knowingly collect information from them. If we learn that we have collected information from someone under 16, we will delete it. If you believe we have, please contact us at privacy@yaaytravel.com.


11. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: You can access, correct, export and delete your information, and object to or restrict how we use it.

Depending on where you live (including in the EU, EEA, UK, Switzerland, Canada and several US states), you have the right to:
- access your personal information and get a copy of it,
- correct information that is wrong,
- delete your information,
- receive your information in a portable format,
- restrict or object to our processing, including processing based on legitimate interests,
- withdraw consent at any time.

How to use your rights:
- Delete your account in the app's settings, which deletes your account and the information linked to it.
- Ask the Yaay Agent to forget something it remembers about you.
- Email privacy@yaaytravel.com for anything else, including deleting your Yaay Agent conversations or Instagram messages. Please send the request from, or tell us, the email address, phone number or Instagram username you use with Yaay, so we can find your information and verify that it is yours.

We will respond within one month. We will not treat you differently for using your rights.

You can tell the Yaay Agent to stop sending you reminders and check-ins at any time, and turn off notifications in your device settings. You can unsubscribe from marketing emails using the link in each email.

If you are in the EU, EEA or UK and think we have handled your information unlawfully, you can complain to your local data protection authority. Our lead authority is the Danish Data Protection Agency (Datatilsynet, https://www.datatilsynet.dk).


12. ADDITIONAL INFORMATION FOR UNITED STATES RESIDENTS

In Short: US residents have the rights in section 11. We do not sell or share personal information for targeted advertising.

In the past twelve (12) months we collected these categories of personal information, for the purposes in section 2, from the sources in section 1, and disclosed them to the service providers in section 5:
- Identifiers (name, email address, phone number, account ids, IP address)
- Customer records (name, contact details, addresses)
- Protected characteristics (date of birth and gender, if you share them, and estimates of them)
- Commercial information (bookings you forward to us)
- Internet or network activity (how you use the Services)
- Geolocation data
- Audio, electronic and visual information (photos, voice messages and dictation)
- Inferences (your taste profile)
- Sensitive personal information: precise geolocation, only when you allow it, used only to provide the Services

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not knowingly sell or share the personal information of anyone under 16.

To use your rights, email privacy@yaaytravel.com. We will verify your identity using the information already linked to your account. You may use an authorized agent, who must show written permission from you. If we deny your request, you can appeal by replying to our answer.

California "Shine the Light": we do not disclose personal information to third parties for their own direct marketing.


13. UPDATES TO THIS NOTICE

We update this notice when our Services or the law change. The date at the top shows when it was last updated. If we make material changes, we will tell you in the app, by the Yaay Agent, or by email before they take effect.


14. HOW CAN YOU CONTACT US?

Email: privacy@yaaytravel.com

Post:
Yaay ApS
Attn: Privacy
Østergade 19
1100 Copenhagen K
Denmark