At YesMeta.com, we value your privacy and are committed to protecting your personal information. This Privacy Policy outlines how we collect, use, disclose, and safeguard your data when you visit our website or use our tools and services (collectively, the "Service").

1. Information We Collect

Personal Information

When you create an account, subscribe to updates, contact support, or subscribe to our Premium plan, we may collect personal details including your:

Full name
Email address
Account password (stored as a one-way cryptographic hash — we never see the plain text)
Billing address and payment token (processed and stored by Polar, our payment processor — we never see your full card number or CVC on YesMeta servers)
Support-ticket correspondence and any information you choose to provide when you email us.

Usage Data

Information about how you interact with the Service, including:

IP address (anonymized after 30 days for analytics), browser type, device type, and operating system
Referring URL, pages visited, and approximate geographic location (country level, derived from IP)
Tool-history records (URLs/domains submitted for analysis, tool type used, date/time, outcome) — associated with your logged-in account if authenticated, otherwise associated with an IP-based identity

Cookies & Similar Technologies

We use cookies (small text files stored on your device) and localStorage for essential functionality (for example, keeping you logged in, remembering your session, and enforcing rate limits). We may also use limited analytics cookies to understand aggregate usage patterns. You can adjust your browser settings to block or delete cookies at any time; doing so may reduce the functionality of the Service. See our Cookie Policy for granular details and a consent mechanism.

2. How We Use Your Information

To provide, operate, maintain, and improve our diagnostic tools and services (including running analyses you request).
To authenticate you, create your account, and recover it if you lose access.
To communicate with you regarding account updates, password resets, billing receipts, renewal reminders, replies to support inquiries, and (where you have opted in) product newsletters.
For billing, invoicing, and payment processing via Polar.
For security purposes: to prevent fraud, brute-force attacks, abusive scraping, and other unauthorized or unlawful activity.
To enforce our Terms of Service and Acceptable Use Policy.
To comply with legal obligations (for example, tax reporting or lawful government requests).

3. Legal Basis for Processing (Where Applicable)

To the extent the General Data Protection Regulation (GDPR) or similar laws apply, we process personal data on one or more of the following legal bases: (a) your consent (for newsletters and non-essential cookies); (b) performance of a contract (to deliver the Service you signed up for); (c) our legitimate interests (security, anti-abuse, and improvement of the Service, where not overridden by your rights); or (d) compliance with a legal obligation.

4. Data Retention Periods

Account data (name, email, password hash): Retained for the lifetime of your account plus 12 months after deletion (to comply with tax/audit requirements and to prevent re-registration abuse).
Tool-history records: Free tier — 90 days from creation; Premium tier — 12 months from creation. Guest (IP) records: 30 days.
IP address + raw request logs (nginx/access): 14 days; after that only aggregate counters survive.
Billing records: Retained for 7 years from the date of the transaction per applicable tax and accounting rules (stored by Polar; mirrored in our `premium_orders` ledger).
Newsletter subscriber list: Retained until unsubscribed or account closure.
Support correspondence: 24 months after resolution, or longer if required by law.

5. How We Share & Disclose Data

We do not sell your personal information. We share data only in these limited scenarios:

Service providers: Trusted third parties that help us operate (for example, Polar for payments, SMTP providers for email delivery, hosting providers for infrastructure). Each is bound by contract to use data solely for the purpose we instruct.
Legal & safety: When we believe in good faith that disclosure is required to comply with law, regulation, court order, or government request; to protect the rights, property, or safety of YesMeta, our users, or the public; or to detect, prevent, or address fraud, security, or technical issues.
Business transfers: In the event of a merger, acquisition, or asset sale, your data may transfer as part of the due diligence and/or transaction under equivalent confidentiality protections.
With your consent: Where you have explicitly agreed to a specific disclosure.

6. Data Subject Rights

Depending on your jurisdiction, you may have the right to:

Access — request a copy of the personal data we hold about you.
Correction — request correction of inaccurate or incomplete data.
Erasure ("right to be forgotten") — request deletion of your data, subject to retention obligations above.
Restriction of processing — request that we limit how we process your data.
Data portability — receive your account and tool-history data in a machine-readable format.
Objection — object to processing based on legitimate interests.
Withdraw consent — at any time where processing was based on consent (for example, unsubscribe from marketing emails via the link in each email).
Lodge a complaint with your local data-protection supervisory authority.

To exercise any of these rights, email support@yesmeta.com with the subject "Data Rights Request". We will respond within 30 calendar days (extended by a further 60 days where permitted for complex requests). Identity verification may be required before we disclose or modify any data.

7. International Transfers

Your information may be processed outside your country of residence, including on servers operated by our cloud and infrastructure providers. Whenever we transfer personal data internationally, we use appropriate safeguards — including Standard Contractual Clauses (SCCs) as approved by the European Commission, or equivalent mechanisms recognized by applicable law — to ensure your rights and protections travel with the data.

8. Security

We use industry-standard technical and organizational security measures, including TLS/HTTPS for all data in transit, one-way password hashing (bcrypt/Argon2), database-at-rest encryption where supported, role-based access for administrators, network segmentation, and regular security reviews. No transmission over the Internet or electronic storage method is 100% secure; we cannot guarantee absolute security, but we work continuously to protect your data.

9. Children's Privacy

The Service is not directed to children under 16 years of age. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, contact us at support@yesmeta.com and we will delete it promptly.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be flagged with a new effective date and (where appropriate) notified via email or an in-product banner. Your continued use of the Service after the effective date constitutes acceptance of the revised policy.

11. Contact

For privacy questions, data requests, or complaints, email support@yesmeta.com.