Trust

Security & data handling

What we collect

Business information that companies publish on their own public websites, fetched by EnrichedYakBot within robots.txt. We do not buy contact lists, guess email addresses from name patterns, or verify addresses by probing mail servers.

What we keep, and for how long

• Extracted facts and short verbatim snippets as evidence, for as long as the fact is current or the history is useful for change detection.
• Raw page HTML for 30 days, so improved extractors can re-read recent pages; then it is deleted.
• Suppressions as one-way hashes only — we cannot recover the value someone asked us to forget.

Customer data

What you ask us to enrich and what you watch belong to your account and are never shown to another customer. API keys are stored as SHA-256 hashes; webhook secrets are encrypted at rest. Webhooks are signed with HMAC-SHA256 and can only be delivered to public HTTPS addresses.

Requests from the public

Opt-out, deletion, correction and access requests go through /privacy/request and are completed within 30 days of the requester confirming their email address. Opt-outs and deletions that name an email address take effect as soon as they are confirmed.

Infrastructure

EnrichedYak runs on Yakware's own servers, with TLS on every connection. Report a vulnerability to security@yakware.com.