This Privacy Policy explains how YottaBot Inc. ("YottaBot," "we," "us," or "our") collects, uses, discloses, and protects personal data in connection with YottaBot websites, products, services, the YottaBot cloud service ("Cloud Service"), self-hosted YottaBot software ("Self-hosted Software"), support, sales, and business operations.
This Privacy Policy should be read with the YottaBot Customer Terms and any written agreement that applies to your organization.
1. Scope
YottaBot has two deployment modes:
- Cloud Service. YottaBot hosts and operates the platform for a customer. Customer Content may be processed in YottaBot-managed infrastructure as part of the service.
- Self-hosted Software. The customer runs YottaBot in the customer's own Kubernetes cluster, cloud account, VPC, data center, or other approved environment.
The standard Self-hosted Software does not send Customer Content, prompts, files, outputs, connector payloads, user directory data, or logs to YottaBot servers merely because it is installed. It may communicate with YottaBot solely to verify license status, entitlement, version compatibility, renewal status, or revocation status, unless the customer separately enables remote support, hosted features, optional telemetry, model-provider routing, or sends support materials to YottaBot.
If a self-hosted customer sends support bundles, logs, screenshots, account information, billing information, security reports, or other materials to YottaBot, we process that information under this Privacy Policy and the applicable written agreement.
2. Our Role
For Customer Content processed in the Cloud Service, YottaBot generally acts as a service provider or processor for the customer. The customer decides what data enters prompts, agents, workflows, connectors, logs, tools, model routes, and outputs.
For account administration, sales, billing, support, security, identity, authentication, license verification, service telemetry, website visits, and business operations, YottaBot generally acts as a business or controller.
For self-hosted runtime Customer Content that remains in the customer's environment, YottaBot is not a controller or processor merely because the customer uses the Self-hosted Software.
3. Personal Data We Collect
The personal data we collect depends on how you interact with YottaBot.
Account, identity, and access data. We may collect names, work email addresses, company names, roles, usernames, user IDs, account IDs, group membership, SSO and SCIM metadata, authentication events, authorization events, IP addresses, device and browser information, session metadata, and security logs.
Customer Content. Customer Content may include prompts, instructions, files, attachments, records, logs, artifacts, tool payloads, model inputs, model outputs, connector data, credential references, resource metadata, audit events, workflow definitions, agent definitions, and other information the customer chooses to submit or process through the Services. Customer Content may include personal data if the customer or its users include it.
License verification data. For self-hosted deployments, we may collect limited metadata needed to verify license status and entitlements, such as license ID, customer or account identifier, product version, deployment or instance identifier, entitlement status, verification timestamp, source IP address, and request metadata. License verification is not designed to transmit Customer Content, user account lists, prompts, files, logs, tool payloads, outputs, secrets, or credentials.
Usage, activity, and telemetry. For the Cloud Service and for any self-hosted telemetry a customer separately enables, we may collect product usage, agent and workflow activity, request metadata, model-route metadata, token and cost metadata, performance metrics, error reports, log records, audit records, resource IDs, timestamps, source IP addresses, and other operational data needed to provide, secure, debug, support, and improve the Services.
Support and communications. We may collect messages, support tickets, Slack messages in customer support channels, screenshots, recordings, diagnostic materials, security reports, feedback, meeting notes, and other information you provide to us.
Commercial and payment data. We may collect deal information, ordering documents, statements of work, billing contacts, invoices, payment status, plan information, usage allocation, tax information, and related business records.
Website and browser data. We may collect information from websites and browser storage, including pages visited, referral information, device and browser details, IP address, user agent, authentication state, session state, preferences, and product-operation metadata.
4. How We Use Personal Data
We use personal data to:
- provide, operate, maintain, secure, and support the Services;
- authenticate users, authorize access, enforce policies, and administer tenants, agents, workflows, credentials, and integrations;
- process Customer Content according to customer instructions;
- route model requests and tool calls configured by the customer;
- verify licenses, entitlements, version compatibility, renewal status, and license compliance;
- troubleshoot issues, investigate security events, prevent abuse, and maintain platform integrity;
- generate audit, usage, activity, and telemetry records for support, debugging, reliability, billing, compliance, and customer reporting;
- communicate with customers, users, investors, prospects, and partners;
- process orders, invoices, payments, renewals, and commercial records;
- improve reliability, usability, security, performance, and product fit;
- develop feature updates, bug fixes, diagnostics, documentation, templates, and other improvements based on feedback and support learnings; and
- comply with law, enforce agreements, and protect rights, safety, and property.
5. Customer Content and Agent Data
Customers control what data enters YottaBot. A customer may include personal data in prompts, attachments, agent instructions, workflow inputs, logs, documents, connector payloads, model outputs, or other Customer Content. The customer is responsible for deciding what personal data is appropriate to use with the Services and for having the necessary rights, notices, consents, and legal bases.
YottaBot does not inventory or mine personal data inside Customer Content for cross-customer analytics, advertising, or model training. YottaBot may process Customer Content to provide the Services, follow customer instructions, support the customer, maintain security, troubleshoot issues, comply with law, and enforce agreements.
YottaBot does not use Customer Content to train or fine-tune models for other customers unless the customer separately instructs YottaBot to do so in writing.
Customer-configured agents and workflows may read customer resources and write logs or outputs inside the customer's tenant or environment. That access is part of the customer's instruction to the platform, not independent YottaBot staff access to Customer Content.
6. Self-hosted Data Handling
For the standard self-hosted deployment, YottaBot does not collect user data, Customer Content, prompts, files, logs, workflow payloads, tool payloads, connector data, model inputs, model outputs, secrets, or credentials from the customer's runtime environment.
The self-hosted deployment may contact YottaBot for license verification. That verification is limited to license and deployment metadata needed to confirm that the installation is authorized. A customer may also choose to share support materials, enable optional telemetry, grant remote access, or connect the self-hosted deployment to third-party model providers or hosted features. Those customer choices may cause additional data to be processed outside the customer's environment.
Customers should not send passwords, private keys, API keys, access tokens, production secrets, payment-card data, protected health information, or other highly sensitive information through email, Slack, screenshots, support tickets, or recordings unless the parties agree to a secure handling method.
7. Cloud Isolation and Security Design
For the Cloud Service, YottaBot's target operating model is a dedicated customer cloud account and Kubernetes cluster for each cloud customer, rather than a shared cloud account or shared cluster between customers. The platform is designed around split human, machine, and agent authentication planes, short-lived credentials, credential brokering, audit records, and gateway enforcement for agent and tool activity.
Security controls can vary by deployment, plan, configuration, and written agreement. Customers are responsible for configuring their users, identity provider, SCIM, agents, workflows, approvals, resources, integrations, and self-hosted environments appropriately.
No system is perfectly secure. If you believe you have found a security issue, contact support@yotta.bot.
8. Model Providers and AI Processing
When a customer uses AI features, prompts, context, tool payloads, metadata, and outputs may be transmitted to model providers or cloud services enabled for the customer. For the Cloud Service, the current primary managed model path uses Amazon Bedrock. Self-hosted customers may configure provider routes according to their deployment and written agreement.
Model-provider training, retention, abuse-monitoring, residency, and deletion terms depend on the provider, account configuration, data-retention mode, and customer agreement. Customers should not assume zero provider retention unless their written agreement and provider configuration expressly provide it.
9. Staff, Support, and Operational Access
YottaBot personnel may access Customer Content or personal data only as needed to provide and support the Services, respond to customer requests, debug incidents, investigate abuse or security events, maintain service integrity, comply with law, or enforce agreements.
We restrict operational access based on role and business need. Some support, security, administrative, log, database, cloud, and break-glass access paths may allow access to Customer Content or related metadata. We do not describe those paths as "no visibility"; instead, they are treated as restricted operational access that must be purpose-bound and reviewable.
For self-hosted customers, YottaBot personnel do not have access to the customer's cluster or Customer Content unless the customer provides access, sends materials to YottaBot, or enables a support path that permits access.
10. How We Disclose Personal Data
We may disclose personal data to:
- service providers and subprocessors that host, secure, monitor, support, or operate the Services;
- model providers and cloud services used to process customer-configured model requests;
- third-party integrations the customer enables, such as identity providers, source-code hosts, messaging tools, ticketing systems, observability platforms, or cloud accounts;
- professional advisors, auditors, insurers, banks, and legal counsel;
- authorities, courts, regulators, or other parties when required by law or to protect rights, safety, security, license compliance, and service integrity; and
- parties involved in a merger, acquisition, financing, reorganization, sale of assets, or similar corporate transaction.
As of the Last Updated date, YottaBot does not sell personal data and does not share personal data for cross-context behavioral advertising as those terms are used in California privacy law.
11. Browser Storage, Cookies, Analytics, and Third-party Assets
YottaBot websites and product surfaces may use local storage, session storage, cookies, and similar technologies for authentication, session management, security, routing, preferences, diagnostics, and product operation.
As of the Last Updated date, YottaBot does not use third-party advertising cookies in the Services. If YottaBot later uses analytics, advertising cookies, or other tracking technologies that require additional notice or choice, we will update this Privacy Policy or provide the required notice.
Some YottaBot websites or portals may load fonts, scripts, libraries, or other assets from third-party hosts. Those third parties may receive technical data such as IP address, user agent, request URL, and timestamp when the browser requests the asset.
12. Data Retention
We retain personal data for as long as needed to provide the Services, follow customer instructions, maintain security, comply with legal and accounting obligations, resolve disputes, enforce agreements, and support business operations.
Retention periods vary by data type, deployment mode, customer configuration, plan, agreement, and legal obligation. Some logs and telemetry may be retained until the customer, configuration, or written agreement sets a deletion horizon. Self-hosted customers control retention inside their own environments except for materials they choose to send to YottaBot and license verification metadata processed by YottaBot.
13. Privacy Choices and Rights
Depending on where you live and how you interact with YottaBot, you may have rights to know, access, correct, delete, port, restrict, object to, or opt out of certain processing of personal data. California residents may also have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, including rights to know, delete, correct, opt out of sale or sharing, limit certain use of sensitive personal information, and receive non-discriminatory treatment for exercising rights.
To make a privacy request, contact support@yotta.bot. We may need to verify your identity and authority before responding. If your request concerns Customer Content controlled by your employer or organization, we may direct the request to that customer or respond according to the customer's instructions.
Authorized agents may submit requests where applicable law allows, subject to verification.
14. Children
The Services are intended for business use and are not directed to children under 13. We do not knowingly collect personal data from children under 13. If we learn that we have collected personal data from a child under 13 without required consent, we will take appropriate steps to delete it.
15. International Data Transfers
YottaBot is based in the United States. Personal data may be processed in the United States and other countries where YottaBot, its service providers, subprocessors, or customer-configured providers operate. Where required, we use appropriate transfer mechanisms and contractual protections.
16. Changes to this Policy
We may update this Privacy Policy from time to time. The Last Updated date shows when the policy was most recently revised. Material changes will be handled as required by law or the applicable written agreement.
17. Contact Us
For privacy questions or requests, contact YottaBot at support@yotta.bot.