GDPR: how Yasan protects your data

Protecting data — yours and your customers’ — is our top priority. Here is a plain-language summary of what happens to data inside Yasan, across the chat, AI search and e-mail support. It is based on our Terms of Service, Privacy Policy, and Data Processing Agreement (DPA), which are binding for us. Your shoppers have their own plain-language notice at yasan.ai/ai-assistant-privacy.

Who is responsible for the data#

Under the GDPR, the roles are clearly split:

You are the data controller — you decide what data is processed and for what purpose.
Yasan is the data processor — it processes data on your behalf and only according to your instructions.

This relationship is governed by the Data Processing Agreement (DPA). It is part of our Terms and binds automatically when you accept them or install Yasan through your e-commerce platform. The DPA is built directly on the requirements of Article 28 of the GDPR.

Your data does not train AI models#

This is the most common concern — and the answer is unambiguous: we do not use your data to train general-purpose AI models.

The content of your communication (emails, messages, transcripts, drafts) is not used to train, fine-tune, or improve general-purpose AI models for third parties or the public.
We may use data only to improve the configuration specifically for you — for example, prompt tuning and context retrieval within your workspace.
The same commitments apply to the AI model providers we use (e.g. Anthropic, OpenAI, Google) — data sent through their APIs is not used to train their models.

What data we process and why#

We only process data that is needed to provide the service. The exact scope is described in the appendix (Schedule 1) of our DPA:

Chat — the conversation, the page and language it was started on, an e-mail address only if the visitor gives it, order data looked up after the visitor verifies their e-mail, and the basket as context.
AI search — submitted queries and follow-up messages, the products and answers shown, applied filters, the page address without its query string, and a basket summary (item count, value, currency). With analytics consent, also a random visitor identifier.
E-mail support — e-mails (body, attachments, headers), drafts and replies, and context from your connected systems (orders, invoices, delivery status).
Your e-commerce platform — the product catalogue, and orders with the customer on the order, read on demand to answer a specific question. We do not keep a copy of your customer list.
Authorized users — name, email, role, credentials.

The purpose is a single one: to provide you with a working service for customer support, search and communication. We never sell data to third parties.

What your shoppers see#

The chat and the AI search tell shoppers that answers come from AI.
The privacy link in both widgets opens the shopper notice at yasan.ai/ai-assistant-privacy, in the shopper’s language.
The visitor identifier is created only with the shopper’s analytics consent and deleted when they withdraw it. How to pass consent: What to put on your website.

Sub-processors#

To run the service, we work with carefully selected vendors (e.g. cloud infrastructure and AI model providers). Each of them is contractually bound to the same level of protection that we guarantee.

The current list of sub-processors is available at yasan.ai/subprocessors.
We notify you at least 7 days in advance about any new sub-processors, and you have the right to object.
When data is transferred outside the EU/EEA, we rely on the EU-U.S. Data Privacy Framework or Standard Contractual Clauses.

Security and independent audits#

We protect data with technical and organizational measures under Article 32 of the GDPR:

Encryption — data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
Access control — strict role-based access control (RBAC) and mandatory multi-factor authentication (MFA) for our team.
Minimization — we access data only when necessary for security or your explicit support request.
Independent security audits — to connect with Google accounts, we have successfully passed the Google CASA (Cloud Application Security Assessment) audit.
Backups — encrypted backups in a separate zone and regular security reviews.

You stay in control of your data#

Your customers’ rights (access, rectification, erasure, portability…) — we help you fulfil them with the appropriate technical measures.
Data deletion — you can request permanent deletion of your organization and all data at any time. See Data and Privacy for details.