YeboYebo
Request a pilot

Privacy Policy

Last updated: April 6, 2026

Yebo Inc. (“Yebo”, “we”, “our”, “us”) operates yebo.dev, the Yebo iOS application, and associated developer services. This Privacy Policy explains how we collect, use, and protect your information.

1. Information We Collect

  • Account information: name, email, company, role
  • Usage data: API requests, authorization events, audit logs
  • Technical data: IP addresses, browser/device info, session identifiers
  • Payment data: processed by Stripe; we never store raw card numbers
  • Device identity data: device identity ID and public key (generated on your device during setup)
  • Mandate data: capability type, amount, counterparty, policy references, and authorization session identifiers

2. How We Use Your Information

  • To provide and operate the Yebo platform
  • To evaluate, authorize, and verify mandates against your enterprise policies
  • To maintain a hash-chained, tamper-evident audit trail for compliance and dispute resolution
  • To enable third-party AI agent plugins to propose, evaluate, and execute authorized mandates when you grant AI data sharing permission
  • To process subscription billing through Stripe (payment execution for your own transactions runs in dry-run mode today, so no money moves; live execution is coming soon)
  • To send transactional emails (receipts, alerts, invoices)
  • To send product updates (you can opt out at any time)
  • To detect and prevent fraud and abuse
  • To comply with legal obligations

3. Data Retention

  • Authorization mandates: retention period to be confirmed
  • Account data: retained while your account is active; retention period after deletion to be confirmed
  • Audit logs: retention period to be confirmed
  • How deletion works today: automatic deletion is not yet in place, so records are kept until they are deleted on request. Nightly database backups are kept 7 days, so a record deleted on request can remain in those backups until they expire. You can ask us to delete your data at any time at privacy@yebo.dev.
  • Third-party AI service data: processed in real-time only. Yebo does not instruct AI providers to store your data beyond the request lifecycle. See each provider's privacy policy for their retention practices.

4. Your Rights

You may request access, correction, or deletion of your data by emailing privacy@yebo.dev. EU/UK residents have additional rights under GDPR/UK GDPR. You may revoke AI data sharing consent at any time in the Yebo iOS app under Settings → Privacy.

5. Third Parties

We use the following service providers to operate the Yebo platform. We do not sell your data to any third party.

  • Stripe (payments processing and billing)
  • Vercel (website and dashboard hosting)
  • Railway (gateway and policy service hosting, Postgres and Redis)
  • Neon (website database)
  • Upstash (Redis)
  • Resend (transactional email delivery)
  • Sentry (error monitoring)
  • GitHub (source code and database backup storage)

5a. Third-Party AI Services

When you install an AI agent plugin in the Yebo iOS app and explicitly grant AI data sharing consent, the following third-party AI services may receive limited data to enable plugin functionality:

Who receives data

  • OpenAI, L.L.C. (api.openai.com)
  • Anthropic, PBC (api.anthropic.com)

What data is sent

  • Agent name and agent ID (not your personal name or email)
  • Mandate proposals: capability type, amount limit, and counterparty name
  • Authorization session ID (a randomized identifier, not linked to your real identity)
  • Plugin-specific data, only when you individually grant each permission:
    • read_identity: your display name and handle
    • read_audit: anonymized audit event summaries
    • receive_receipt: mandate execution receipts (amount, status, timestamp)

What is NOT sent to third-party AI services

  • Email address
  • Phone number
  • Biometric data (Face ID / Touch ID data never leaves your device)
  • Payment card numbers or bank account details
  • Raw cryptographic key material

How this data is collected and shared

Data is shared with third-party AI services only when all of the following conditions are met:

  1. You install an AI agent plugin in the Yebo iOS app
  2. You explicitly grant AI data sharing consent via the in-app toggle (Settings → Privacy)
  3. You individually grant the specific permissions each plugin requests

No data is shared with any third-party AI service before you grant explicit permission. You can revoke AI data sharing consent at any time in Settings → Privacy, which immediately stops all data sharing with AI services. Uninstalling a plugin also stops all data sharing with that service.

Purpose

To enable AI agent plugins to propose actions to the Yebo gateway on your behalf. Plugins cannot approve their own actions: each one is decided by your policy, and by you where your policy requires approval. Execution is a dry run today.

6. Cookies

We use only essential cookies required for site functionality and security. No advertising or tracking cookies.

7. Security

Traffic to yebo.dev and our gateway uses HTTPS. Our services reach the production database over a private network, and database backups travel over TLS. Execution receipts are cryptographically signed and tamper-evident. Passkey checks, including any biometric step, happen on your device, and Yebo never receives biometric data. On the /intent API path the gateway currently signs authorization proofs with a server-side key.

8. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes via email or a notice on our site at least 30 days before changes take effect.

9. Contact

Questions about this policy? Email us at privacy@yebo.dev.