Privacy Policy
Effective: July 21, 2026 · Last updated: August 31, 2026
This Privacy Policy explains how YEETUM LLC, doing business as Y2 (“Y2,” “we,” “us,” or “our”), collects, uses, discloses, and protects personal information when you visit y2.dev, create an account, or use the Y2 applications, APIs, reports, and related services (the“Services”).
This Policy covers personal information for which Y2 determines the purposes and means of processing, such as account, billing, website, and support data. When Y2 processes personal data in Customer Content solely on behalf of a business customer, that customer is the controller or business, Y2 is its processor or service provider, and our Data Processing Agreement applies. The customer’s privacy notice governs its collection and use.
1. Information we collect
| Category | Examples |
|---|---|
| Account and contact | Name, email, avatar, organization, workspace membership, role, and preferences. |
| Authentication | Email verification records and, if selected, GitHub OAuth identifiers. |
| Billing and commercial | Plan, subscription, transaction, tax, credit, and referral information. Stripe collects payment-card details; Y2 does not store complete card numbers. |
| Customer Content | Prompts, chats, files, projects, topics, monitoring profiles, reports, graphs, instructions, source lists, and customer-specific AI outputs. |
| Integrations and delivery | API keys and scopes, webhook endpoints and delivery logs, email recipients, phone numbers, and SMS consent records. |
| Device, network, and usage | IP address, browser and device attributes, approximate location derived from IP, page and feature activity, timestamps, diagnostics, and security events. |
| Support and feedback | Messages, survey responses, feedback, attachments, and troubleshooting details. |
| Public intelligence data | Publicly available or licensed information about entities, people, organizations, places, events, markets, and sources included in intelligence workflows. |
2. Sources of information
We collect information:
- directly from you, your organization, and other authorized workspace members;
- automatically from your browser or device, subject to your privacy choices;
- from GitHub if you choose GitHub sign-in;
- from Stripe, referral partners, and service providers supporting your account;
- from customer-configured integrations and webhook activity; and
- from public, government, commercial, and open-source intelligence sources.
3. How and why we use information
| Purpose | EEA/UK legal basis, where applicable |
|---|---|
| Provide accounts, intelligence workflows, APIs, reports, and deliveries. | Contract; legitimate interests; consent where required. |
| Authenticate users, prevent abuse, secure systems, and debug failures. | Contract; legitimate interests; legal obligations. |
| Process subscriptions, usage, credits, referrals, invoices, and taxes. | Contract; legal obligations; legitimate interests. |
| Respond to support, administer feedback, and communicate service updates. | Contract; legitimate interests. |
| Measure product usage and reliability and improve features. | Consent for optional browser analytics; legitimate interests otherwise. |
| Attribute referrals and measure advertising. | Consent where required. |
| Comply with law, protect rights, and enforce agreements. | Legal obligations; legitimate interests. |
We do not use Customer Content to train Y2’s own general-purpose AI models unless the customer separately agrees in writing.
4. AI, search, and intelligence processing
When you use AI-assisted features, Y2 sends the content needed for the request to OpenRouter and the model provider selected by you or configured for the workflow. Current workflows may use providers such as Z.ai, Google, MiniMax, or DeepSeek. Y2 configures data-collection restrictions and zero-data-retention routing where supported, but provider capabilities and legal retention requirements may vary. Do not submit sensitive personal data unless your organization has approved the workflow.
Tavily may process research queries and returned web results. Cartesia may process report text to create audio. Public and licensed sources may contain personal information that Y2 indexes, links, summarizes, or cites for intelligence purposes. Source data may be inaccurate or change over time; requests concerning source material may need to be directed to the original publisher.
When knowledge indexing and retrieval are enabled, Turbopuffer processes report and signal content, source links, search queries, and account or workspace identifiers used to enforce access to that content. This includes private workspace research selected for indexing.
5. How we disclose information
We disclose personal information only as reasonably necessary to:
- Infrastructure and security providers: Convex and Netlify.
- AI, search, and audio providers: OpenRouter and its available model providers, Tavily, and Cartesia.
- Knowledge search and indexing: Turbopuffer.
- Payments, affiliate payouts, email, SMS, and authentication: Stripe, Resend, Surge, and GitHub when you select GitHub sign-in.
- Product analytics and feedback: PostHog, subject to applicable choices.
- Advertising and website measurement: Google Analytics, X Ads, and RB2B only when the relevant optional choice is enabled.
- Customer-directed recipients: workspace members, email and SMS recipients, integrations, webhook endpoints, and other destinations configured by Customer.
- Legal and corporate matters: advisers, authorities, counterparties, or a successor in a financing, merger, acquisition, reorganization, or sale, subject to appropriate protections.
Our current processors and their functions are described in the subprocessor schedule in the Data Processing Agreement. Some third parties, such as Stripe, GitHub, advertising partners, and customer-selected destinations, may act as independent controllers for their own purposes under their privacy notices.
6. Cookies and privacy choices
Y2 uses local storage, cookies, pixels, and similar technologies. Strictly necessary technologies support authentication, security, billing, preferences, and service delivery. They cannot be disabled through our preference tool.
- Analytics and product improvement: Google Analytics and PostHog help measure identified product usage, feature performance, session experience, and feedback.
- Referral attribution: Y2 records your referring partner when you follow their link or enter their code during onboarding. Eligible commissions begin only after a qualifying payment. Stripe Connect processes affiliate onboarding and payouts.
- Marketing: X Ads and RB2B measure campaigns and may recognize business visitors. Google advertising features remain denied unless this choice is on.
Optional browser technologies do not load until the relevant choice is enabled. You can change or withdraw a choice at any time by selecting . Disabling referral attribution also clears current and legacy referral identifiers from this browser. It does not delete an account-level referral already submitted at workspace creation, which Y2 retains for commission integrity, fraud review, disputes, and accounting. You may instead type a referral code during workspace setup without enabling browser tracking. Disabling a category reloads the page to stop technologies already active in that page view. Y2 treats a recognized Global Privacy Control signal as an opt-out of marketing and cross-context behavioral advertising.
7. Retention and deletion
We keep personal information only as long as reasonably necessary for the purposes above, including to maintain an active account, provide configured monitoring and deliveries, resolve disputes, secure the Services, and meet legal, tax, accounting, and contractual obligations. Retention depends on the data type, customer configuration, sensitivity, and applicable requirements.
Account deletion initiates cancellation of the billing lifecycle and deletion or anonymization of associated Y2 records and stored files. Some information may remain for a limited period in protected backups, provider systems, security records, or records we must retain by law. Deleting an account does not delete information controlled by third-party recipients or original public sources.
8. Security
We use administrative, technical, and organizational safeguards designed to protect personal information, including encrypted transport, provider-managed encryption at rest, access controls, scoped and hashed API credentials, tenant and workspace authorization, monitoring, and incident-response procedures. No system is completely secure, and we cannot guarantee absolute security.
9. International transfers
Y2 is based in the United States and uses providers operating in the United States and other countries. Where required, we use recognized transfer mechanisms such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, as described in the DPA. Providers may also rely on an adequacy decision or another lawful mechanism.
10. Your privacy rights
Depending on where you live, you may have rights to access, know about, correct, delete, restrict, object to, or obtain a portable copy of personal information; withdraw consent; and opt out of certain sales, sharing, targeted advertising, or profiling. You may also have the right to appeal our response and complain to a data-protection authority.
Submit a request to [email protected]. We may verify your identity and authority, and an authorized agent may submit a request where law permits. We will not discriminate against you for exercising a right. If Y2 processes the information on behalf of your organization, please contact that organization first.
11. United States state privacy disclosures
During the preceding 12 months, Y2 collected the categories described in Section 1 and used and disclosed them for the purposes and to the recipients described in Sections 3–6. We do not sell personal information for money. If you enable marketing technologies, disclosures of identifiers and internet activity to Google, X, or RB2B for advertising or business visitor recognition may be considered a “sale,” “sharing,” or targeted advertising under certain state laws.
You can opt out by rejecting or disabling marketing in Privacy choices or by using a browser that sends Global Privacy Control. We do not knowingly sell or share personal information of people under 16. We do not use or disclose sensitive personal information to infer characteristics about you.
12. Communications
We send transactional messages needed to operate the Services. You may unsubscribe from product or marketing email using the link in the message. Transactional messages may continue while your account is active. SMS messages are sent only to numbers and purposes you configure or authorize; applicable message and data rates may apply.
13. Children
The Services are not directed to people under 18, and we do not knowingly collect their personal information. Contact us if you believe a minor has provided personal information.
14. Changes to this Policy
We may update this Policy to reflect legal, security, or product changes. We will post the new version and update the date above. If a change materially affects how we use information already collected, we will provide additional notice or obtain consent when required.
15. Contact
YEETUM LLC (Y2), 600 Bryan Ave Ste 220, Fort Worth, TX 76104, United States · [email protected]