Privacy Policy

1. Introduction

1.1. This Privacy Policy (hereinafter, the "Policy") explains how Limited Liability Company "YEDUCODERS", EDRPOU code 45491912, registered address: 58023, Ukraine, Chernivtsi Oblast, Chernivtsi, 229B Ruska St., Apt. 127 (hereinafter, "YeDuCoders", "we", "us") processes personal data in connection with the website, subdomains, web interface, messenger channels, integrations and other services of the SaaS/AI service "DigiSpec Taras" (collectively, the "Service").

1.2. This Policy applies to website visitors, representatives of Clients, Account administrators, Users, contact persons, payers, recipients of mailings, persons contacting support, and other natural persons whose data are processed in connection with the Service.

1.3. This Policy shall be read together with the [Terms of Use / Public Offer].

1.4. Personal data means information relating to an identified or identifiable natural person. Client Data means information that the Client or a User transmits, uploads, connects or creates in the Service.

2. Categories of personal data, purposes and legal bases

2.1. Depending on how you interact with the Service, we may process the following categories of data:

2.2. Data may be received directly from the individual, from the Client or another authorised person, through a connected integration with the Client's permission, automatically during use of the Service, or from other lawful sources.

2.3. YeDuCoders does not sell personal data and does not share them for cross-context behavioural advertising. We do not use Client Data, prompts or outputs to train publicly available or cross-client AI models without the Client's separate express consent, except for properly anonymised information to the extent permitted by law and the contract.

2.4. When AI features are used, the data included in a prompt may be processed automatically to provide the Output.

2.5. Do not upload to the Service special categories of personal data that you are not prepared to disclose to the AI provider that will process the request: health data, biometric data, children's data, payment card details, passwords, private keys, state secrets or other data subject to a special regime.

3. Retention period of personal data or the criteria for determining it

3.1. We retain personal data for no longer than is necessary for the purposes described in this Policy, the performance of the contract, compliance with legal requirements, the protection of legal claims, or the period agreed with the Client.

3.2. Client Data are retained for the duration of the subscription and the period available for restoring the account. After termination of the contract, the Client may restore the operation of its account with all information within 90 calendar days. Thereafter, Client Data are deleted or anonymised from active systems within 5 days.

3.3. Data in backup copies may be retained until the regular overwrite cycle. Until deletion, they remain protected and are not used for new purposes.

3.4. Contractual, tax, accounting, security and dispute-related data may be retained longer if required by law or reasonably necessary for the protection of rights.

4. Rights regarding the processing of personal data

4.1. Within the limits of applicable law, you may have the right to information, access, rectification, erasure, restriction of processing, objection, data portability, withdrawal of consent, and to lodge a complaint with a competent data protection authority.

4.2. To exercise your rights in respect of data that YeDuCoders processes as an independent controller/owner, write to [email protected] with the subject "Data Privacy Request". We may request reasonable confirmation of identity or authority.

4.3. AI Outputs are probabilistic: they may be inaccurate, incomplete, outdated or contain fabricated information. Do not rely on them as the sole basis for a material decision or as professional advice. A request to rectify or erase personal data in an Output is considered in accordance with the role of YeDuCoders and applicable law.

5. Marketing and informational communications

5.1. We may send service messages that are necessary for the operation of the Account, performance of the contract, payment, security, support, incident response or compliance with a legal obligation.

5.2. Marketing and informational emails are sent on the basis of consent or on another lawful basis where permitted by law. You may opt out of them via the link in the email or by writing to [email protected].

5.3. Opting out of marketing does not stop service or legally required messages.

6. Cookies and automatically collected data

6.1. The website and the Service may use cookies, local storage, web beacons, server logs and similar technologies to maintain sessions, for security, for the correct operation of the interface, for diagnostics, for measuring usage and, where necessary, for analytics.

6.2. The following may be collected automatically: browser type, language, device type, IP address, user-agent, session identifier, timestamps, pages and actions, referral source, technical connection parameters and error logs.

6.3. Mandatory cookies and security logs are used to provide the Service and to protect the Account. Optional analytics/cookies are used through a consent mechanism where required by law.

6.4. Cookie settings can be changed in the browser. Refusing technically necessary cookies may limit the functionality of the Service.

7. Transfer and disclosure of personal data

7.1. We may transfer personal data, to the extent necessary for the provision, support, protection and lawful administration of the Service, to the following categories of recipients:

• cloud providers, AI providers, communication, payment, analytics, support and monitoring services, and other sub-processors;
• professional advisers, auditors, banks and payment partners;
• affiliates or legal successors in the event of a reorganisation or disposal of the business, subject to appropriate data protection;
• public authorities, courts or other authorised persons, on a lawful basis and to the minimum extent necessary;
• other persons, on the instruction or with the consent of the Client/data subject, where applicable.

7.2. If the Client connects a third-party integration, it instructs the transfer of the data necessary for its operation. Such third party processes the data in accordance with its own terms and privacy policy.

8. Security and other measures

8.1. We apply administrative, technical and organisational measures commensurate with the risk to protect data against loss, unauthorised access, destruction, alteration or disclosure. No system is completely secure; therefore, we cannot guarantee absolute invulnerability.

8.2. Data are transmitted between the browser/client and the Service over HTTPS with TLS 1.2 or a later version, with certificate validation and, where appropriate, HSTS.

8.3. Administrative access to servers is carried out via SSH with cryptographic keys. The target configuration includes disabled password authentication, prohibition of direct root login, individual access accounts, modern keys such as Ed25519, protection of private keys, firewall/VPN/allowlist, the principle of least privilege, access reviews and session logging.

8.4. We use remote cloud infrastructure in Europe and the USA. The exact regions, dependencies and sub-processors depend on the configuration of the Service, the plan and the integrations.

8.5. The runtime environment used supports isolation at the operating system or container level, access control, confirmation of potentially dangerous operations, masking of secret-like values in diagnostic output, an authenticated API, an SSH backend, TLS verification and mTLS support for certain integrations. This is defence in depth, not a guarantee of complete isolation.

8.6. In the event of a confirmed security incident affecting Client Data, we notify the Client without undue delay after obtaining sufficient information and provide reasonably available information.

9. Third-party links, websites and services

9.1. The Service may contain links to, or integrations with, messengers, email systems, calendars, cloud storage, CRM systems, payment systems, AI models and other third-party services.

9.2. After you navigate to such a service or grant an integration permission, it may collect and process data independently. Please review its terms and privacy policy.

9.3. We do not control and are not responsible for the independent practices of third parties, except for YeDuCoders' own obligations regarding the proper selection and contractual oversight of sub-processors within the limits of applicable law.

10. International transfers

10.1. Data may be processed outside the Client's country, including in the EEA and the USA.

10.2. Where the GDPR, the UK GDPR or similar regimes apply and the country of destination does not have a recognised adequate level of protection, we use an appropriate legal mechanism: an adequacy decision, the EU Standard Contractual Clauses 2021/914, the UK International Data Transfer Addendum or another mechanism permitted by law; where necessary, with supplementary technical and organisational measures.

11. Contacts and requests

11.1. Send requests regarding this Policy and data protection to:

LLC "YEDUCODERS"

Email: [email protected]

Privacy/legal email: [email protected]

Address: 58023, Ukraine, Chernivtsi Oblast, Chernivtsi, 229B Ruska St., Apt. 127

11.2. In your request, state your name, company, contact email, the substance of the request and, if possible, the Account ID. We may ask you to confirm your identity or authority.

12. Confidentiality and dissemination of information by the Client

12.1. The Client controls its Users, access rights, credentials, export, copying, publication, sending and integrations. The Client is responsible for the actions of its employees, contractors, representatives and authorised persons as for its own.

12.2. YeDuCoders shall not be liable for the disclosure, loss, copying, publication, forwarding or other dissemination of information from DigiSpec Taras made, accidentally or intentionally, by the Client, its Users, employees, contractors, representatives or other authorised persons. This includes erroneous sending, publication, export, screenshots, transfer of credentials, errors in configuring access rights and the use of an unprotected device.

12.3. This provision does not release YeDuCoders from liability to the extent that the disclosure or loss is directly caused by a proven breach by YeDuCoders of the contract, applicable law or agreed security measures.

13. Privacy of minors

13.1. The Service is intended for business users aged 18 and over. We do not knowingly collect personal data of persons under the age of 18 through the Service, unless otherwise provided by a separate written agreement and lawful safeguards.

13.2. If you believe that a minor has provided us with data in breach of this Policy, please notify us at the address in Section 11.

14. Governing law and dispute resolution

14.1. This Policy and the contractual matters related to it are governed by the law of Ukraine, unless the mandatory law of another jurisdiction requires otherwise.

14.2. The terms of resolution of disputes regarding the use of the Service are determined by the Terms of Use / Public Offer. This does not limit the right of a data subject to apply to a competent data protection authority where such right is provided by law.

15. Changes to the Policy

15.1. We may update the Policy due to changes in legislation, the Service, data processing or security measures. The current version contains the date of the last update.

15.2. We notify of material changes through the Service, by email or by other reasonable means before they take effect, where practicable. We recommend reviewing the Policy periodically.

16. Data received through Google APIs

16.1. The Client may, at its own discretion, connect a Google account to its AI agent: Google Calendar, Gmail, Google Drive (together with Docs, Sheets and Slides) and Google Analytics. The connection takes place only after the Client's express consent on the Google screen; each service is connected separately. The general rules of Section 17 apply to Google data, and this Section adds to them the requirements specific to Google.

16.2. What data we receive and why:

• the email address of the Google account, to show the Client which account is connected;
• Google Calendar, to display events, and to create and modify them, at the Client's request;
• Gmail, to find and read emails and to send an email on behalf of the Client, at the Client's request; an email is sent only after the Client has confirmed its text;
• Google Drive, to find and read files, create new ones and add to existing ones, at the Client's request; complete replacement of a file's content or moving it to the trash takes place only after the Client's confirmation;
• Google Analytics, to display reports at the Client's request; we only read Analytics data and never modify it.

16.3. Access to email and Drive is available only to the person who connected them, and only in that person's private chat with their agent.

16.4. Google access tokens are stored in our database in encrypted form. We do not store the content of emails, files, calendar events or Analytics reports in the database: it is retrieved from Google at the moment of the Client's request and passed to the Client's AI agent in order to provide a response.

16.5. We do not use data received from Google APIs to develop, train or improve generalised artificial intelligence or machine learning models. Our staff do not read this data.

16.6. The Client may disconnect a Google service at any time in its agent's app, in which case we revoke the access at Google and delete the stored tokens. Access may also be revoked at https://myaccount.google.com/permissions.

16.7. DigiSpec's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

17. Data received from connected third-party services

17.1. The Client may connect a third-party service to the Service (including Google, Microsoft, Meta (Facebook, Instagram, WhatsApp), HubSpot, Jira, KeyCRM, BAS, Telegram, email systems, calendars, CRM, accounting, messaging and other systems) by providing YeDuCoders with an API key, access token or other credentials of that service, or by granting access through authorisation (OAuth) on the side of such service. By granting such access, the Client instructs YeDuCoders to access the relevant service on behalf of the Client within the scope of the rights granted.

17.2. We receive from a connected service only the data needed to provide the Client or a User, at their request, with information from that service. Depending on the service and the access granted, this may include:

• the identifier and name of the account or workspace in the service, to show the Client which account is connected;
• a list of the service's objects and records (for example, tasks, projects, sprints, customers, orders, deals, contacts, messages, events, documents) and their attributes (name, status, assignee, dates, amounts, comments), to respond to the Client's request concerning those data;
• service data on permissions, scope of access and connection status, to verify that the connection works and to show the Client its status.

17.3. We use data received from a connected service only to provide the Client with the information it has requested and to carry out its instructions in the Service. We do not sell these data, do not share them for advertising, do not make them available to other clients of the Service, and do not use them to train publicly available or cross-client AI models.

17.4. API keys, tokens and other credentials of a connected service are used only to access that service and are protected by the measures described in Section 8. They are not displayed in plain form in the interface of the Service or in its responses.

17.5. The scope of data we may receive is determined by the rights of the key or permission granted by the Client. We recommend granting the minimum necessary rights. The Client may revoke access at any time: by deleting the connection in the Service, and also by revoking or replacing the key or token in the third-party service itself. After revocation, we cease accessing the service with those credentials. To have previously received data deleted, the Client may contact us at the address in Section 11.

17.6. The Client confirms that it has the right to grant such access and that doing so does not violate the terms of the third-party service or the rights of other persons whose personal data may be contained in the connected service. The third-party service processes data under its own terms and privacy policy (see also clauses 7.2 and 9.2).

17.7. Messages from messengers and social networks. Instagram, WhatsApp Business and the Telegram chats to which the Client has granted access deliver to us new messages addressed to the Client only once and do not allow them to be retrieved later. Therefore, we store in our database the text of such messages, the name and identifier of the interlocutor and the time of the message, and, for Instagram, upon connection, also the messages from the last 14 days. These messages are used only to notify the Client, to propose a reply and, at the Client's request, to show an overview of the correspondence or a daily summary. A reply on behalf of the Client is sent only after the Client's confirmation. Messages are kept for 3 months and are then deleted automatically.

17.8. How to delete the data of a connected service:

• open your agent's app in Telegram (the "Open" button) and tap "Disconnect" next to the relevant service; we will immediately delete the stored credentials and, for Instagram, WhatsApp and Telegram, also all stored messages of that channel;
• if you wish, also revoke the permission in the settings of the service itself;
• to delete all other data associated with the account, write to us using the contacts in Section 11.