YAMOYAMO

Privacy Policy

Last updated: 21 May 2026

1. Who We Are

YAMO is operated by Pitch Partnerships Ltd, registered in England and Wales. We are the data controller for the personal data processed through the Service.

Contact: james@pitchpartnerships.com

2. What We Collect

We collect the following personal data:

  • Account information: name, email address, and password (or Google OAuth credentials)
  • Usage data: pages visited, features used, Playbooks run
  • Connection data: third-party service credentials you connect (e.g. Gmail, Calendar) — stored securely and used only to run your Playbooks
  • Technical data: IP address, browser type, device information

3. How We Use Your Data

We use your data to:

  • Provide, maintain, and improve the Service
  • Manage your account
  • Run Playbooks on your behalf using your connected services
  • Send transactional emails (verification, Playbook outputs)
  • Respond to support requests
  • Comply with legal obligations

We do not sell your personal data. We do not use your data for advertising.

4. Legal Basis (GDPR)

We process your data under the following legal bases:

  • Contract: to provide the Service you signed up for
  • Legitimate interest: to improve the Service, prevent fraud, and ensure security
  • Consent: for optional communications (you can withdraw at any time)

5. Data Sharing

We share data only with:

  • Supabase — database and authentication hosting (EU/US)
  • Render — application hosting
  • Mailgun — transactional email delivery (EU region)
  • Stripe — payment processing (when billing is active)
  • AI model providers — to execute Playbook stages (your data is sent to the model only during execution and is not used for training)

We do not share data with any other third parties.

6. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days, except where retention is required by law. Playbook run outputs are retained for 90 days unless you delete them earlier.

7. Your Rights

Under GDPR, you have the right to:

  • Access the personal data we hold about you
  • Rectify inaccurate data
  • Delete your data ("right to be forgotten")
  • Restrict or object to processing
  • Data portability
  • Withdraw consent at any time

To exercise any of these rights, email james@pitchpartnerships.com. We will respond within 30 days.

8. Cookies

We use essential cookies only — authentication session cookies required for the Service to function. We do not use analytics, tracking, or advertising cookies.

9. Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), encryption at rest, row-level security on database tables, and regular access reviews.

10. Children

The Service is not intended for anyone under the age of 18. We do not knowingly collect data from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service. The "Last updated" date at the top reflects the most recent revision.

12. Contact

For privacy-related questions or requests, contact us at james@pitchpartnerships.com.