Privacy Policy
Version 2026-08-28
Privacy Policy — Yamo
Version 1.0 — effective as of 27 August 2026 LANGUAGE NOTICE. This English version is a courtesy translation provided for convenience only. The binding version of this policy is the French original (« Politique de confidentialité »). In the event of any discrepancy or difficulty of interpretation, the French version prevails, without depriving users of the mandatory protections of the law of their country of habitual residence. In short: Yamo sends each question to the most suitable AI model to answer it. Your messages are used for two things: (1) answering you, (2) producing anonymous trend statistics (which you can turn off at any time in the settings). We never sell your conversations and we never use them for targeted advertising. Sensitive subjects (health, opinions, sex life…) are excluded from all statistics. You stay in control: access, deletion, objection, in one message. Data controller: YOMA STUDIO, a French simplified joint-stock company (société par actions simplifiée) with a share capital of EUR 1,245.50, registered with the Évry Trade and Companies Register (RCS) under number 939 664 660, with its registered office at 3 Rue Jules Guesde, 91130 Ris-Orangis, France. Privacy contact: privacy@yamochat.com. This policy supplements the Terms of Use and Terms of Sale of the Yamo application. Capitalised terms ("Input", "Output", "Model Providers") have the meaning given to them in those Terms.
1. The data we process
In short: The minimum: an account identifier (email or phone), your conversations, and some technical data. Account: an email address or a phone number (your choice), verified by a one-time code. No name, no other document required. Conversations: your messages ("Inputs") and the generated answers ("Outputs"), including generated images where you ask for one. Technical data: device type, operating system, language, store country, technical identifiers necessary for operation and security, diagnostic data. Subscription: subscriber status and management information transmitted by the App Store or Google Play (we do not receive your card number, which is handled by the store). We do not seek to collect sensitive data. See Section 3 for how it is handled.
2. Why we process your data, and on what legal basis
In short: Answering you = performance of the contract. Anonymous statistics = our legitimate interest, with a button to turn them off. Nothing else is hiding behind this. • Providing the Service: chat, routing to the right model, account, history, subscription — Performance of the contract (Art. 6(1)(b)). • Producing aggregated and anonymised statistics on the trends in needs expressed to AIs (by country and by language) — Legitimate interest (Art. 6(1)(f)), with a permanent right to object (opt-out in the settings). • Security, prevention of abuse and fraud, moderation of reports — Legitimate interest (Art. 6(1)(f)) and legal obligations. • Non-targeted advertising in the free version (never based on the content of your conversations or on a profile) — Legitimate interest (Art. 6(1)(f)). • Responding to your requests (support, exercise of rights) and complying with our legal obligations — Legitimate interest or legal obligation, as applicable. You can turn off your conversations' contribution to the statistics at any time: Settings → Privacy. This does not affect your use of the Service.
3. Sensitive subjects (special categories of data)
In short: A conversation touching on health, opinions, religion or sex life never enters any statistic: it is filtered out before any statistical processing. Automatic filtering detects, upstream of any statistics, conversations falling under sensitive categories (Article 9 GDPR) and excludes them entirely: they generate no statistical event, not even a counter. This filtering operates for the sole purpose of exclusion; no sensitive marker is retained. Your conversation itself is answered normally.
4. Who receives your data
In short: The model providers (to answer you) and our technical service providers. No one else. No conversation is ever sold. Model providers (to generate the Outputs): the models are open-weight models that we run ourselves on Amazon Bedrock, within our own AWS account. The companies that created those models — named on the "Our models" page (https://yamochat.com/models) — never receive your Inputs and never use them to train their models. Inference is performed by Amazon Web Services in the United States; generated images and conversations are stored in the European Union (eu-west-1 region, Ireland). Technical service providers: hosting, including storage of generated images (Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg — data hosted in the European Union (eu-west-1 region, Ireland)), sending of verification codes (email or SMS), audience measurement and diagnostic tools, acting on our behalf and on our instructions. Stores: Apple and Google, for subscription management. Subscription management: RevenueCat, Inc. (United States), which receives your Yamo account identifier and the status of your subscription in order to validate purchases made through the Stores and to keep your Premium access in step across your devices. It never receives your conversations, and it never receives your payment details, which are handled by the Store alone. Trend analyses: they are carried out by YOMA STUDIO exclusively from anonymous aggregates (containing no personal data). No personal data and no individual message feeds these analyses. These anonymous aggregates may be used in our analyses, shared with partners or published; they contain no personal data and cannot re-identify you. We do not sell your data and we do not share it for targeted advertising purposes. We may have to disclose data to the competent authorities where required by law.
5. Transfers outside the European Union
In short: Most of the processing takes place in the EU. Where a provider is in the United States, it operates under safeguards, and in "zero retention" mode wherever possible. We favour processing within the European Union. Where Model Providers or service providers are located outside the EU (in particular in the United States), transfers are governed by appropriate safeguards (the European Commission's standard contractual clauses and/or the Data Privacy Framework) and, for the APIs concerned, a zero-retention policy is sought. The "Our models" page specifies the providers concerned.
6. How long we keep your data
In short: Your account for as long as you use it; your conversations for 24 months; the intermediate statistical data, pseudonymised, is deleted after 24 months at the latest, leaving only anonymous aggregates. Account: until you delete it, then erasure. Conversations: kept to provide you with your history, for twenty-four (24) months; deleted when you delete a conversation or your account. Generated images follow exactly the same period and are deleted with the conversation they belong to. Statistical pipeline: intermediate data (pseudonymised, after removal of identifiers and exclusion of sensitive subjects) is kept for a maximum of twenty-four (24) months, to allow retrospective trend analyses over that period, then deleted; only anonymous aggregates that cannot re-identify you remain. Legal obligations and evidence: specific retention periods imposed by law (invoicing, security) where applicable.
7. How we produce genuinely anonymous statistics
In short: We remove what identifies you, we only count what is expressed at scale, and we check that no real user sentence ever comes out. Before any statistic: removal of identifying data (names, emails, numbers…); grouping into families of questions; a "typical phrasing" is only produced if a minimum threshold of distinct users has expressed it; phrasings are regenerated synthetically (never real extracts), with an anti-copy check; counting is done without any individual identifier. The end result is anonymous and falls outside the scope of personal data.
8. Advertising (free version)
In short: Ads, yes; targeted using your conversations, never. The free version displays non-targeted advertising: it is never selected based on the content of your conversations or on an individual advertising profile. It may take into account generic elements (language, store country). We do not use advertising trackers requiring your consent; should this change, your prior consent would be collected.
9. Your rights
In short: You can see, correct or delete everything, or object, by writing to us or from the settings. You have the rights of access, rectification, erasure, restriction, portability and objection (including the statistics opt-out, directly in Settings → Privacy), as well as the right to set directives regarding your data after your death, under French law. To exercise them: privacy@yamochat.com. You may also lodge a complaint with the CNIL, the French data protection authority (cnil.fr). We respond within one month.
10. Security
We implement appropriate technical and organisational measures (encryption in transit, access control, minimisation, pseudonymisation of the statistical pipeline) to protect your data. In the event of a breach likely to result in a high risk to your rights, we will inform you in accordance with the regulations.
11. Minors
The Service is restricted to adults (see the Terms of Use and Terms of Sale) and is not intended for minors. We do not knowingly collect data from minors; if we become aware of it, we delete the account and the associated data.
12. Changes
We may update this policy. In the event of a substantial change, you will be informed in the Application or by email. The current version is always available in the Application and at https://yamochat.com/privacy.
13. Contact
Questions or requests about your data: privacy@yamochat.com, or by post to YOMA STUDIO, 3 Rue Jules Guesde, 91130 Ris-Orangis, France.