Privacy Policy

1. Controller

The controller within the meaning of the GDPR is:

YOWO7 e.U.
Kinderheimgasse 76
2732 Willendorf
Austria
Commercial register court: Regional Court Wiener Neustadt (Landesgericht Wiener Neustadt)
Company register number: FN 689952k
DUNS: 30-326-6010
Email: hello@yowo7.com
Website: https://www.yowo7.com

No data protection officer has been appointed. Privacy requests can be sent to the contact above. The competent supervisory authority is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna (https://www.dsb.gv.at).

2. Scope

This policy applies to the use of YOWO7 services, in particular:

• Marketing website at yowo7.com
• Web app at app.yowo7.com
• Mobile app (iOS and Android)
• Public forms (forms.yowo7.com and embeds)
• Support widget (widget.yowo7.com)
• Public help center / knowledge base (docs.yowo7.com)
• Blog at blog.yowo7.com
• AI connection and API (api.yowo7.com)

3. Roles: controller and processor

YOWO7 processes data in two roles:

• As controller, we process data about website visitors, registered user accounts, billing, our own support, and marketing communications.
• As processor, we store and process content that customers create in their workspace or collect via forms, widget, inbox, chat, calendar, and files. The customer remains the controller for that end-customer data. Processing on behalf of the customer is governed by our Data Processing Agreement (DPA) at https://www.yowo7.com/en/dpa.

4. Data we process as controller

• Master data: name, email address, optional phone number, avatar, language and theme settings
• Access and session data: password hash, login times, refresh sessions, device information
• Workspace and company profile: workspace name, billing address, VAT ID, payment contact details
• Billing data: plan, invoices, payment status (via Stripe)
• Support communications with us (email, tickets)
• Website usage data with consent: page views, device type, approximate location (via Google Analytics 4) and first-party tracking with a pseudonymous visitor identifier (cookie yowo7_vid); after form submission, track.js can link that identifier to a CRM contact via identify(email)
• Support chat on the marketing website when you click the chat button: current page address, IP address, browser information, messages, and a local browser session
• Technical logs: IP address or hashed IP, user agent, error and security logs as required

5. Data we process on behalf of the customer

Depending on usage, a customer workspace may include categories such as:

• CRM contacts and companies including custom properties
• Email content, attachments, and marketing opt-in status (inbox / email marketing)
• Form submissions including technical metadata (hashed IP, user agent, captcha score)
• Support widget tickets (name, email, messages, page context)
• Files and versions in storage
• Chat messages and, where applicable, video meeting metadata
• Calendar events and OAuth tokens for Google/Outlook connections
• Project, time, and sales data relating to people
• Special categories of personal data only if the customer stores them (e.g. via custom fields) — YOWO7 does not actively request such data

6. Purposes and legal bases

As controller, we rely in particular on:

• Art. 6(1)(b) GDPR – contract: registration, platform operation, billing, customer support
• Art. 6(1)(f) GDPR – legitimate interests: security, abuse prevention, product stability, audit and operations logs
• Art. 6(1)(a) GDPR – consent: optional website analytics (Google Analytics and first-party tracking), marketing communications where required
• Art. 6(1)(c) GDPR – legal obligation: tax and commercial retention duties
• As processor, we process customer data under the customer’s instructions and the DPA (Art. 28 GDPR)

7. Recipients and processors

We share data only as needed for contract performance, legal obligations, or with consent. Subprocessors and auxiliary services are listed at https://www.yowo7.com/en/subprocessors and bound by Art. 28 GDPR agreements.

This includes Vercel Inc. (USA) for hosting and delivery of the web frontends (website, app interface, forms, widget, booking pages, blog, help center), CDN/edge, and forwarding of form submissions.

8. International transfers

The website and app run at Vercel Inc. (USA) in the Frankfurt am Main region (fra1). Our core systems and databases are located in data centers in Frankfurt (EU); storage and the backend (application, database, object storage, platform email sending, AI) run there on Amazon Web Services (eu-central-1). Vercel delivers static content and cached responses through its worldwide delivery network; data (in particular the IP address and technical connection data) may also be processed outside the EU, for example when you access the website from outside the EU.

Transfer basis: Vercel is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR); in addition, the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) from the data processing agreement with Vercel apply.

Auxiliary services for payments, captcha, optional calendar connections, video calls, and mobile push may additionally process data in the United States or transfer it there. For such transfers we use EU-recognised safeguards: the EU-US Data Privacy Framework and/or the EU Standard Contractual Clauses.

The mapping per provider is at https://www.yowo7.com/en/subprocessors.

9. Hosting and server log files

The website and app run as web frontends at Vercel Inc. (USA) in the Frankfurt am Main region (fra1). Our core systems and databases are located in data centers in Frankfurt (EU); storage, the backend, and the database run there on Amazon Web Services (eu-central-1). Vercel delivers static content and cached responses through its worldwide delivery network; data (in particular the IP address and technical connection data) may also be processed outside the EU, for example when you access the website from outside the EU. Form submissions on forms.yowo7.com are forwarded via Vercel.

Requesting these frontends creates server log files. They contain the IP address, the time of the request, the requested URL, the referrer, the user agent, and the status code.

The purpose is secure and stable operation and the prevention of abuse. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation).

Vercel stores these server log files (IP address, time of the request, requested URL, referrer, user agent, and status code) only for a short period of at most 30 days and then deletes them automatically.

10. Cookies and tracking

We use technically necessary cookies or storage for operation. We load Google Analytics 4 (measurement ID G-SQ43VB0ZB2) and our first-party website tracking (track.js script, cookie yowo7_vid with a pseudonymous visitor identifier) on yowo7.com, docs.yowo7.com (help center) and blog.yowo7.com, in each case only after your consent to statistics. This may include page views, time on page, approximate location, device type, and browser. The yowo7_vid cookie holds a pseudonymous visitor identifier and no plain identity data. After you submit a form, track.js can link that identifier to the CRM contact via identify(email); a visit alone does not create a contact. Cookies such as _ga and _ga_* may be stored for up to 24 months. The yowo7_vid cookie is stored for up to 13 months. We use Google Analytics 4 for statistics only. Google Signals and ad personalization are disabled. You can change or withdraw consent at any time via “Cookie settings” in the footer of the respective website. Withdrawal deletes _ga, _ga_* and yowo7_vid in the browser.

We load the support chat only when you click the chat button. The current page address, your IP address and browser information are then sent to widget.yowo7.com. Where your request concerns a contract or steps toward one, we rely on Art. 6(1)(b) GDPR; otherwise on Art. 6(1)(f) GDPR (legitimate interest in answering inquiries). Storing the chat session locally is strictly necessary for the chat you explicitly requested (§ 165(3) TKG 2021 (Austrian Telecommunications Act)). If you have consented to usage statistics and a chat session already exists, the identifier from the yowo7_vid cookie may be linked to that session.

In the web app we use session/authentication cookies (domain .yowo7.com) for login. There is no separate product-analytics tracking on the app UI.

Public forms may load Cloudflare Turnstile or Google reCAPTCHA to prevent abuse; technical data may be sent to the respective provider.

11. Artificial intelligence

YOWO7 offers optional AI features (e.g. summaries and text suggestions). Processing uses AWS Bedrock with EU models. Customer content is processed on behalf of the customer and is not released to train third-party foundation models where the contracted service excludes that.

12. Retention

We store personal data only as long as needed for the respective purposes or as required by law.

• Account and contract data: duration of the business relationship plus statutory retention periods (especially tax law)
• Invoices and accounting records: 7 years from the end of the calendar year in which they were issued (§ 132 Austrian Federal Fiscal Code, BAO), and beyond that for as long as they are relevant to pending proceedings
• Technical worker logs: typically 14 days
• Server log files of the web frontends (Vercel): only for a short period of at most 30 days, then deleted automatically
• Workflow run logs: typically 30 days after completion
• API request logs (private apps): typically 30 days; aggregated stats up to 90 days
• File trash: typically 30 days, then permanent deletion
• CRM and workspace content: deletion or return per customer instructions and after contract end under the DPA
• Google Analytics cookies (_ga, _ga_*): up to 24 months or until withdrawal; withdrawal deletes them in the browser
• First-party tracking cookie (yowo7_vid): up to 13 months or until withdrawal; withdrawal deletes it in the browser
• Support chat session in the browser: until you clear site data

13. Security

We implement technical and organisational measures under Art. 32 GDPR, including TLS in transit, encryption at rest, EU hosting of core systems, malware scanning on uploads, role-based access control, and audit logs. More information: https://www.yowo7.com/en/security.

14. Your rights

Subject to the legal basis and statutory requirements, you have the rights listed below. For data we process on behalf of your employer or a YOWO7 customer, please contact that controller (the customer) first. We support them under the DPA.

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
• Complaint with a supervisory authority (Art. 77 GDPR), in particular the Austrian Data Protection Authority

15. Children and automated decisions

YOWO7 is aimed at businesses and professional users. We do not knowingly offer services to children under 16.

We do not make solely automated decisions that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

16. Changes

We update this privacy policy when services, law, or processing change. The version published on this page with the stated date prevails. We will notify material changes appropriately (e.g. email to workspace owners or an in-app notice).

17. Contact

Privacy questions: hello@yowo7.com. We respond to requests to exercise your rights under Art. 15 to 22 GDPR without undue delay and in any event within one month of receipt. Where this is not possible because of the complexity or number of requests, the period may be extended by two further months; we will inform you of any such extension, with reasons, within the first month (Art. 12(3) GDPR). Where we have reasonable doubts about your identity, we may request additional information to confirm it (Art. 12(6) GDPR). If your request concerns data we process on behalf of a customer, we forward it to that customer without undue delay (see section 14).

This privacy policy is available in German and English. In case of discrepancies, the German version prevails.