YumaOS
How it worksSolarFind installersPricingAboutSign inSign up
Legal

Privacy policy

1. Data Controller

The data controller for personal data under Regulation (EU) 2016/679 (GDPR) is Pro Business S.r.l., VAT IT04009250921, registered office at Via Sigmund Freud 4, 09126 Cagliari (CA), Italy. For any inquiry about data processing, contact us at support@yumaos.com.

2. Categories of Data Collected

YumaOS collects and processes the following categories of personal data:

  • Registration data: first name, last name, email, (encrypted) password, company name, VAT number.
  • Usage data: access logs, IP address, browser type, device, pages visited, actions performed in the platform.
  • Business data entered: customer records, leads, quotes, projects, uploaded documents, customer communications.
  • WhatsApp conversations: if the company enables the YumaOS WhatsApp assistant, the messages exchanged between its business number and its customers (phone number, profile name, message text, date and time) are received, stored and processed by YumaOS to reply and to record the outcome in the company's CRM.
  • Connected Meta account data: if the company connects a Facebook, Instagram or WhatsApp Business account to YumaOS, we process the account identifiers, the leads collected by campaigns and the registered WhatsApp numbers, within the permissions granted.
  • Connected advertising account data (Google Ads and OpenAI Ads): if the company administrator connects the company's Google Ads or OpenAI Ads account to YumaOS, YumaOS reads, read-only, the account identifier and name and the campaign performance data (spend, impressions, clicks, conversions and campaign settings). Credentials provided by the company are stored encrypted with keys managed by Google Cloud KMS and are deleted when the company disconnects the account. The company can disconnect it at any time from the “Connections” page of the app, or remove access from its own Google Ads account. This data is used only to show the campaign results to the company that owns them and to suggest improvements: it is not sold, not used for advertising and not shared with other companies.
  • Payment data: handled directly by our payment processor (Stripe). We do not store credit card data on our servers.

YumaOS's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3. Purposes of Processing

Personal data is processed for the following purposes:

  • Delivery of the YumaOS service (contract performance)
  • Invoicing and accounting/tax compliance (legal obligation)
  • Service improvement and aggregated statistical analysis (legitimate interest)
  • Service communications (updates, maintenance, contractual changes)
  • Marketing communications, only with explicit consent, revocable at any time

4. Legal Basis

Processing is based on: contract performance (art. 6.1.b GDPR), compliance with legal obligations (art. 6.1.c), controller's legitimate interest (art. 6.1.f), explicit consent (art. 6.1.a) for marketing communications and non-essential cookies.

5. Retention Period

Data is retained for the time necessary for the purposes for which it was collected. In particular:

  • Account data: for the contract duration + 24 months
  • Accounting/tax data: 10 years as required by tax law
  • Access technical logs: 6 months
  • Backups: 8 weeks (point-in-time recovery)

6. Data Subject Rights

As a data subject, you have the right to exercise the following GDPR rights at any time:

  • Access to your personal data (art. 15)
  • Rectification of inaccurate data (art. 16)
  • Erasure ("right to be forgotten", art. 17)
  • Restriction of processing (art. 18)
  • Data portability (art. 20)
  • Objection to processing (art. 21)
  • Complaint to the Italian Data Protection Authority (garanteprivacy.it)

To exercise any of these rights, write to support@yumaos.com.

7. Data Recipients

Data may be processed, as Data Processors, by the following technical service providers:

  • Google Cloud / Firebase (infrastructure hosting, backup, authentication) — servers in Europe (Belgium, Netherlands)
  • Stripe Payments (payment processing) — servers in Europe (Ireland)
  • Transactional email services (notifications, confirmations, service communications)
  • Meta Platforms Ireland Ltd. (WhatsApp Business, Facebook and Instagram platforms): delivery of WhatsApp messages and access to the accounts connected by the company. Meta also processes data under its own privacy policy.
  • Twilio Inc. (technical channel to WhatsApp Business): routes messages between business numbers and the WhatsApp platform.
  • Anthropic PBC (artificial intelligence models): processes the text of conversations and documents to generate the assistant's replies, and the company's advertising campaign numbers to prepare the analyses and suggestions the assistant offers it. Data sent is not used to train the models.

All providers are GDPR-compliant and operate under Data Processor agreements compliant with art. 28 GDPR.

Only if you accept marketing cookies on the yumaos.com website, LinkedIn Ireland Unlimited Company receives browsing data on the site from your browser, to measure our LinkedIn campaigns and show our ads to people who have visited the site. LinkedIn also processes it under its own privacy policy. Details and withdrawal of consent in the Cookie policy.

8. Transfer Outside the EU

YumaOS servers and backups are located within EU territory. Meta, Twilio, Anthropic and LinkedIn may also process data in the United States: transfers take place with the safeguards provided by Chapter V GDPR (EU-US Data Privacy Framework adequacy decision, where applicable, and Standard Contractual Clauses approved by the European Commission).

9. YumaOS Waiting List

YumaOS will be available to everyone from March 2027. Until then you can join the waiting list from the page yumaos.com/en/waiting-list.

Data collected. Your answers to the form questions (what your company sells, the tools you are interested in, how many people would use YumaOS, what you use today, when you would like to start and, if you write it, the problem you would like to solve); email, full name, role and company name; your phone number, if you leave it; where you came to the page from (for example LinkedIn) and the page language. To protect the form from automated submissions we also use a fingerprint of your network address, never stored in clear and used only for this check.

Why we process them. (a) To let you know when YumaOS is available: this is what you ask for by signing up. (b) To understand, in aggregate form, which parts of YumaOS are of most interest and to prepare the launch. (c) Only if you asked for it by ticking the dedicated box and confirmed it from the link in the email we send you right after signing up: to send you updates on YumaOS before launch, by email and, if you left your phone number, on WhatsApp.

Legal basis. For (a) your request (pre-contractual measures, art. 6.1.b GDPR); for (b) our legitimate interest in preparing the product (art. 6.1.f); for (c) your consent (art. 6.1.a). Consent is optional: without it you remain on the waiting list and we only write to you about the launch.

Retention. We keep waiting list data for up to 12 months after YumaOS is launched. Data for updates is kept until you withdraw your consent, and in any case for no longer than 24 months from our last contact with you.

Your rights. In addition to the rights in section 6, you can leave the waiting list and withdraw your consent at any time from the “Leave the waiting list” link in every email we send, or by writing to support@yumaos.com. Only Pro Business S.r.l. and the providers in section 7 that are needed to store the data and send the emails can see it.

10. Cookies

The use of cookies on the YumaOS site is governed by our separate Cookie Policy, also available in integrated mode on the platform.

11. Data Security

YumaOS adopts appropriate technical and organizational security measures to protect personal data from unauthorized access, loss, alteration or disclosure: encryption in transit (TLS 1.3) and at rest (AES-256), optional two-factor authentication, access audit logs, encrypted daily backups.

12. Changes to This Policy

This policy may be updated. The last revision date is indicated at the bottom. Substantive changes will be communicated via email to all registered users with at least 30 days' notice.

13. Contacts

For any question about the processing of your personal data, you can contact us at support@yumaos.com or via the Privacy form in your account area.

Last revision: October 21, 2026