Privacy Policy

1. Controller

The controller within the meaning of the GDPR is:

Markus Holzner

Kinderheimgasse 76

2732 Willendorf

Austria

Email: hello@yowo7.com

Website: https://www.yowo7.com

No data protection officer has been appointed. Privacy requests can be sent to the contact above. The competent supervisory authority is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna (https://www.dsb.gv.at).

2. Scope

This policy applies to the use of YOWO7 services, in particular:

• Marketing website at yowo7.com
• Web app at app.yowo7.com
• Mobile app (iOS and Android)
• Public forms (forms.yowo7.com and embeds)
• Support widget (widget.yowo7.com)
• Public help center / knowledge base
• Public API and MCP interfaces (api.yowo7.com)

3. Roles: controller and processor

YOWO7 processes data in two roles:

As controller, we process data about website visitors, registered user accounts, billing, our own support, and marketing communications.

As processor, we store and process content that customers create in their workspace or collect via forms, widget, inbox, chat, calendar, and files. The customer remains the controller for that end-customer data. Processing on behalf of the customer is governed by our Data Processing Agreement (DPA) at https://www.yowo7.com/dpa.

4. Data we process as controller

• Master data: name, email address, optional phone number, avatar, language and theme settings
• Access and session data: password hash, login times, refresh sessions, device information
• Workspace and company profile: workspace name, billing address, VAT ID, payment contact details
• Billing data: plan, invoices, payment status (via Stripe)
• Support communications with us (email, tickets)
• Website usage data with consent: page views, device type, approximate location (via Google Analytics 4) and first-party tracking (cookie yowo7_vid); after form submission, page visits may be linked to a contact
• Technical logs: IP address or hashed IP, user agent, error and security logs as required

5. Data we process on behalf of the customer

Depending on usage, a customer workspace may include categories such as:

• CRM contacts and companies including custom properties
• Email content, attachments, and marketing opt-in status (inbox / email marketing)
• Form submissions including technical metadata (hashed IP, user agent, captcha score)
• Support widget tickets (name, email, messages, page context)
• Files and versions in storage
• Chat messages and, where applicable, video meeting metadata
• Calendar events and OAuth tokens for Google/Outlook connections
• Project, time, and sales data relating to people
• Special categories of personal data only if the customer stores them (e.g. via custom fields) — YOWO7 does not actively request such data

6. Purposes and legal bases

As controller, we rely in particular on:

• Art. 6(1)(b) GDPR – contract: registration, platform operation, billing, customer support
• Art. 6(1)(f) GDPR – legitimate interests: security, abuse prevention, product stability, audit and operations logs
• Art. 6(1)(a) GDPR – consent: optional website analytics (Google Analytics and first-party tracking), marketing communications where required
• Art. 6(1)(c) GDPR – legal obligation: tax and commercial retention duties
• As processor, we process customer data under the customer’s instructions and the DPA (Art. 28 GDPR)

7. Recipients and processors

We share data only as needed for contract performance, legal obligations, or with consent. Subprocessors and auxiliary services are listed at https://www.yowo7.com/subprocessors and bound by Art. 28 GDPR agreements.

8. International transfers

YOWO7’s core infrastructure (application, database, object storage, platform email sending, AI) runs exclusively in the European Union — on Amazon Web Services in Frankfurt (eu-central-1). Workspace content and AI processing stay there.

Auxiliary services for payments, captcha, optional calendar connections, video calls, and mobile push may additionally process data in the United States or transfer it there. For such transfers we use EU-recognised safeguards: the EU-US Data Privacy Framework and/or the EU Standard Contractual Clauses.

The mapping per provider is at https://www.yowo7.com/subprocessors.

9. Cookies and tracking

On the marketing website we use technically necessary cookies or storage for operation. Optional analytics load only with your consent: Google Analytics 4 (measurement ID G-SQ43VB0ZB2) and our first-party website tracking (track.js script, cookie yowo7_vid). This may include page views, time on page, approximate location, device type, and browser. After you submit a form, page visits may be linked to your contact. Cookies such as _ga, _ga_* and yowo7_vid may be stored for up to 24 months. You can withdraw consent at any time via “Cookie settings” in the footer.

In the web app we use session/authentication cookies (domain .yowo7.com) for login. There is no separate product-analytics tracking on the app UI.

Public forms may load Cloudflare Turnstile or Google reCAPTCHA to prevent abuse; technical data may be sent to the respective provider.

10. Artificial intelligence

YOWO7 offers optional AI features (e.g. summaries and text suggestions). Processing uses AWS Bedrock with EU models. Customer content is processed on behalf of the customer and is not released to train third-party foundation models where the contracted service excludes that.

11. Retention

We store personal data only as long as needed for the respective purposes or as required by law.

• Account and contract data: duration of the business relationship plus statutory retention periods (especially tax law)
• Technical worker logs: typically 14 days
• Workflow run logs: typically 30 days after completion
• API request logs (private apps): typically 30 days; aggregated stats up to 90 days
• File trash: typically 30 days, then permanent deletion
• CRM and workspace content: deletion or return per customer instructions and after contract end under the DPA
• Google Analytics cookies (_ga, _ga_*): up to 24 months or until withdrawal
• First-party tracking cookie (yowo7_vid): up to 24 months or until withdrawal

12. Security

We implement technical and organisational measures under Art. 32 GDPR, including TLS in transit, encryption at rest, EU hosting of core systems, malware scanning on uploads, role-based access control, and audit logs. More information: https://www.yowo7.com/security.

13. Your rights

Subject to the legal basis and statutory requirements, you have the rights listed below. For data we process on behalf of your employer or a YOWO7 customer, please contact that controller (the customer) first. We support them under the DPA.

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
• Complaint with a supervisory authority (Art. 77 GDPR), in particular the Austrian Data Protection Authority

14. Children and automated decisions

YOWO7 is aimed at businesses and professional users. We do not knowingly offer services to children under 16.

We do not make solely automated decisions that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

15. Changes

We update this privacy policy when services, law, or processing change. The version published on this page with the stated date prevails. We will notify material changes appropriately (e.g. email to workspace owners or an in-app notice).

16. Contact

Privacy questions: hello@yowo7.com. We usually respond within 30 days.