Privacy Notice
What this notice covers
This notice explains what YourZone does with personal data when it decides why and how that data is used. It covers three situations:
- you use the chat on our home page without an account;
- you have a YourZone account;
- you browse this website.
It does not cover chat widgets on other companies' websites. See “Chat widgets on other websites” below.
Who is responsible for your data
The controller for the processing described in this notice is:
- Company
- Yourzone Italy
- Registered address
- Viale Buozzi 6/A-3, 63074 San Benedetto del Tronto (AP), Italy
- Company number
- VAT IT02225750443
- Privacy contact
- hello@yourzone.chat
- Data protection officer
- No data protection officer is appointed. For privacy matters write to hello@yourzone.chat.
Chat widgets on other websites
Businesses use YourZone to put an AI chat on their own websites. When you chat there, that business (the site owner) is the controller of your data and YourZone only processes it on their behalf. The widget itself shows who they are under “Privacy & your data”, with the retention period and your options for that site. For questions or requests about such a chat, contact that site's owner and read that site's own privacy notice.
Websites hosted by YourZone
If you build a website with YourZone, we host its pages and files and serve them to its visitors. If you add a form, we receive what visitors send through it and pass it to you by email and in your dashboard; we process it on your behalf, keep it for 12 months unless you delete it sooner, and delete it with the website. To protect forms and reports from abuse we use Cloudflare Turnstile and keep a daily-changing, one-way code derived from the visitor's IP address, never the address itself. Anyone can report a hosted website; a report and the reporter's email, if given, go to our support team.
We count visits to each website we host so that its owner can see them in the dashboard; we do this on the owner's behalf. No cookies are set and no scripts are added for it. For each day we keep the number of page views and of visitors, which pages were viewed, the visitors' countries (worked out by Cloudflare from the IP address), their type of device (computer, tablet or phone) and the name of the website they came from, without the rest of its address. To count each visitor only once a day, we combine the IP address and the browser's description of itself with a random value that changes every day and turn them into a one-way code. That code is deleted after two days, and the IP address and browser details are not stored. The daily counts are kept for 13 months and deleted with the website.
If you use the chat on our home page
The home page lets you ask the YourZone assistant up to 5 questions a day without an account.
- What we collect
- The messages you type and the assistant's answers. The conversation is not linked to a name, an email address or an account, because we do not ask for one. Please do not type sensitive personal details into the chat.
- Your network address
- To apply the daily limit we turn your network (IP) address into a one-way hash, using a secret value that changes every day, and count messages against that hash. We do not store the address itself, and the hash is not stored with your conversation.
- Usage record
- For each answer we record which AI model was used, how much text was processed, what it cost us, and the conversation's internal number. This record does not contain your messages.
- Why we use it
- To answer your questions, to keep the conversation going while the page is open, to limit abuse of a free service, and to know what the service costs us.
- Legal basis
- Answering you: steps taken at your request (GDPR Art. 6(1)(b)). The daily limit and cost records: our legitimate interests in keeping a free service available and protected from abuse (Art. 6(1)(f)).
- How long we keep it
- The conversation is deleted automatically 30 days after it starts. The hashed address is deleted by a nightly job once its 24-hour window has been over for a day, so within about three days. Usage records are deleted after three full calendar months; monthly totals, which hold no personal data, are kept.
- Who receives it
- Your messages are sent to Anthropic, whose AI model writes the answers, and search phrases taken from your question are sent to OpenAI to look up our help articles. Everything is stored with our hosting provider. See “Who receives your data”.
Your browser does not keep the conversation: reloading the page starts a new one, and the chat saves nothing in cookies or browser storage. Because the conversation is not linked to you, we will usually be unable to find it again if you ask us for it later.
If you have a YourZone account
- Account details
- Your email address, your name if one was given, and your password, which is stored only in hashed form. We also keep your sign-in sessions, the short-lived codes we email you to verify your address or reset your password (each expires after 15 minutes), and, if an account was created for you with a hosted website, the link we email you to set your password (it expires after 24 hours). An email address is required to create an account; without one we cannot provide the service.
- What you put into the service
- The websites you connect and their connection details, the pages we read from those websites at your request, the documents you upload, the assistants and instructions you create, and your conversations in the dashboard chat.
- Billing
- Payments are handled by Stripe. You enter your card details on Stripe's pages and we never receive them. We send Stripe your email address and an account reference, and we keep your plan, your Stripe customer and subscription references, the subscription's status, and a ledger of credits bought and used.
- Usage records
- For each AI answer produced for your account: the model, the amount of text processed, the cost, the credits charged and the conversation it belonged to. These records do not contain message text. We use them to apply your plan's allowance and to bill correctly.
- Security records
- When a website you connected calls our service, we log the time, the address (IP) and software identifier of the caller, and whether its key was accepted, and we count requests per calling address to limit abuse. We also keep a log of actions our own staff take on customer accounts.
- Feedback when you remove a website
- When you disconnect or delete a website we ask why. We keep the reason you pick, any comment you write and, only if you ask us to follow up, your email address and name. We use this to improve the service and, where you asked, to contact you.
- The Help page and support requests
- The support assistant on the Help page is given your account reference, your email address, your plan, how many websites and assistants you have, and whether you have saved payment keys (never the keys themselves), so that it can answer for your account. Your conversation with it is kept like your other dashboard conversations. When you send a support request, or ask the assistant to send one for you, we keep the request: its subject and description, with your account reference, email address and plan. We email it to our support team through our email provider, Resend, together with your recent messages to the assistant if you chose to include them, so that a person can read it and reply to your email address.
- Emails we send you
- Service emails only: verification and password-reset codes, confirmation of a changed email address, a welcome message, a notice when a website is connected to your account, and warnings when you approach your plan's allowance. They are sent through our email provider, Resend.
- Why we use it
- To create and secure your account, to provide the service you signed up for, to take payment, to apply plan limits, to prevent abuse, to improve the service, and to meet our accounting obligations.
- Legal basis
- Providing the service and taking payment: performance of our contract with you (GDPR Art. 6(1)(b)). Security records, abuse limits and feedback when you remove a website: our legitimate interests in keeping the service secure and improving it (Art. 6(1)(f)). Billing and accounting records: legal obligation (Art. 6(1)(c)).
- How long we keep it
- Your account and what you put into it are kept for as long as the account exists; we do not currently delete accounts automatically, including inactive ones, so to close your account and have its data erased, contact us. Conversations in the dashboard chat are deleted automatically 30 days after they start. The exception is conversations of hosted-website accounts and of websites we host: these currently have no automatic deletion, also after the hosting subscription ends, and stay until you delete them. You can delete a conversation, a document or a connected website yourself at any time; deleting a website also deletes its content, its keys and its security log. Detailed usage records are deleted after three full calendar months. Monthly usage totals, the credit ledger, the staff action log, the security log of a website that is still connected, the feedback you gave when removing a website, your support requests, and the record of a used or expired set-password link have no automatic deletion.
- Who receives it
- Our hosting, payment and email providers, and the AI providers that answer your dashboard chats and process the documents and website pages you add. See “Who receives your data”.
Cookies and browser storage
This website does not use analytics, advertising or tracking cookies, and loads no third-party tracking scripts.
- Sign-in cookies
- When you sign in we set two cookies that keep you signed in (“__convexAuthJWT” and “__convexAuthRefreshToken”, prefixed “__Host-” on the live site). They are strictly necessary for the account area to work, cannot be read by scripts on the page, and are removed when you sign out. No cookie is set if you only browse or use the home-page chat.
- Browser storage
- Our sign-in software keeps a few technical values in your browser's local storage. On every visit it records the time it last checked whether you are signed in; this holds no identifier. While you are signed in it also keeps a copy of your session token, so that all your open tabs stay signed in together; it is removed when you sign out. Nothing else is stored in your browser, and the home-page chat stores nothing there.
- Technical data
- As with any website, our hosting providers necessarily process your network (IP) address and basic request details (such as browser type and the page requested) to deliver pages to you and to protect the service.
Who receives your data
We do not sell personal data. We share it only with the providers that run the service for us:
- Convex
- Our database and the servers that run the service. Holds everything described in this notice. Convex privacy policy
- Vercel
- Hosts this website and the account area. Vercel privacy policy
- Anthropic
- AI models that write answers in the home-page chat and the dashboard chat. Receives the conversation it is answering and, for the support assistant on the Help page, the account details that assistant is given. Anthropic privacy policy
- OpenAI
- AI models for dashboard chats where an OpenAI model is selected, the search index over help articles, uploaded documents and website pages, and reading text out of uploaded files. Receives that content. OpenAI privacy policy
- AI models for dashboard chats, only where a Google model is selected. Receives the conversation it is answering. Google privacy policy
- Stripe
- Payments and invoices. Receives your email address, an account reference and your payment details. Stripe privacy policy
- Resend
- Sends our service emails. Receives your email address and the content of the email. Resend privacy policy
- Cloudflare
- Delivers the chat widget's script file. Where our outbound proxy is switched on, it also carries the requests we make when reading the pages of a website you connect. It serves the websites we host at yourzone.page and, with Turnstile, checks that their forms and reports are sent by a person. Cloudflare privacy policy
- Sentry
- Error reports. When something fails on this website or in the service, Sentry receives the technical details of the failure: what failed and where, the page, your browser type and your network (IP) address. We have set it up not to send account details or the content of conversations, and not to record your screen. Reports are stored in Germany. Sentry privacy policy
We may also disclose data where the law requires it.
Transfers outside the European Economic Area
Some of the providers above are based, or process data, outside the European Economic Area.
- Transfers outside the EEA
- Our providers Convex, Vercel, Anthropic, OpenAI, Google, Stripe, Resend and Cloudflare process data in the United States and, for some of them, in other countries outside the European Economic Area. Under our agreement with each provider, these transfers are covered by the European Commission's standard contractual clauses or by an adequacy decision, which includes the EU-US Data Privacy Framework for providers certified under it. Our error-reporting provider Sentry stores error reports in Germany; access to them by its parent company in the United States is covered by the same safeguards. To obtain a copy of these safeguards, write to hello@yourzone.chat.
AI and automated decisions
The chats on this website are answered by an AI system, and say so where you type: “You're chatting with an AI assistant, not a human.” No person reads or writes the replies as you chat. AI answers can be wrong or incomplete, so check anything important before relying on it.
We do not use your conversations to make decisions about you that have legal or similarly significant effects, and we do not build a profile of people who use the home-page chat.
Your rights
Under the GDPR you can ask us to:
- give you a copy of the personal data we hold about you;
- correct data that is wrong or incomplete;
- erase your data;
- restrict how we use it;
- hand it to you in a portable format;
- stop using it, where we rely on our legitimate interests.
To make a request, write to the privacy contact below. There is no charge. If you have an account, write from the email address the account uses so we can confirm it is you. If you only used the home-page chat, we hold nothing that identifies you and will usually be unable to find your conversation; it is deleted automatically after 30 days.
- Privacy contact
- hello@yourzone.chat
You also have the right to complain to a data protection authority, in particular in the country where you live or work, or to ours:
- Supervisory authority
- Garante per la protezione dei dati personali (https://www.garanteprivacy.it)
Changes to this notice
When this notice changes, the version and date at the top of the page change with it.