Not yet reviewed by a lawyer.
This document describes how YieldOS actually works today and is
published so it can be checked. It is not legal advice. Every passage states a
decision that has been made and a behaviour the system actually has — there are no
blanks left in it — but a lawyer has not been through it yet, and this notice stays
until one has.
The short version
- Your shop's records — including your customers' details — belong to you. We hold
them to run the service and for nothing else.
- We do not sell personal information, and we do not use your customers' data to
advertise anything.
- Each shop's data is isolated from every other shop's in the database itself, not
only in application code.
- The assistant sends what it retrieves to an AI provider in order to answer. That is
described in full below, because it is the part people are most likely to be
surprised by.
1. The two different roles we play
This distinction decides who you should ask about what, so it comes first.
- For your shop's own account — the business name, your staff's names
and email addresses, your subscription — we are the controller. We decide
how that information is used, and you can ask us about it directly.
- For your customers' information — the homeowners you quote and
invoice — we are a processor acting on your instructions. You decide what is
collected and why. A homeowner asking to see or delete their record should ask the
shop that holds it; we will help that shop respond, but we will not act on their
records without them.
2. What we hold
About your shop and its staff
- Business name, address, time zone, trade.
- Each user's name, email address, role, and sign-in identity.
- Subscription status and, when card payments are enabled, an identifier issued by the
payment processor. We never see or store card numbers.
- An audit trail of who changed what and when, which is retained even after a person
leaves so that the history stays attributable.
About your customers, entered by you
- Name, service address, phone number, email address.
- Quotes, invoices, payment records, job and appointment history.
- Equipment installed at the property, and notes your staff record about the work.
- Messages sent to them through the service.
Technical
- Server logs, including IP address and the requests made. Recipient addresses and
phone numbers are masked in logs rather than written in full.
- A sign-in session cookie, and small amounts of browser storage for your own
preferences (theme, sidebar). No advertising or cross-site tracking cookies.
3. Why we hold it
To provide the service you are paying for, to keep it secure, to bill you, and to meet
legal obligations such as retaining financial records. We do not profile your customers
and we do not sell data to anyone.
4. Who else it reaches
Only the providers needed to run the service:
| Who | What they do for us | What reaches them |
|---|
| Oracle Cloud Infrastructure | Runs the application server and the database | All of it |
| Cloudflare | Serves the web app, terminates TLS, stores encrypted database backups | Web traffic; encrypted backups |
| Zitadel (self-hosted) | Sign-in and account identity | Staff names, email addresses |
| MailStack | Sends email on a shop's behalf | Recipient address and message contents |
| OpenRouter and its routed model providers | Run the assistant and scheduled background analysis (weekly summaries, catalogue enrichment) | The question asked; records retrieved to answer it; catalogue and job-history text |
| Stripe | Processes YieldOS subscription payments on their hosted checkout — card numbers never touch our servers | The shop's name, its billing email, and its subscription status |
Not currently enabled, and listed so the table stays honest as it is:
text messaging (Twilio). This page will be updated before it is switched on.
We may also disclose information where the law requires it. If we are ever compelled to
hand over a shop's data, we will tell that shop unless we are legally prohibited from
doing so.
5. The assistant and other AI features
Stated separately because it is the least obvious thing this product does with data.
- When someone at your shop asks the assistant a question, the question and the
records it retrieves in order to answer are sent to an AI provider (see the table
above). Those records can include customer names, addresses and job history.
- Scheduled background analysis — weekly summaries, catalogue enrichment — sends
catalogue and job-history text to an AI provider.
- The assistant can only reach data the person asking could already reach. It re-checks
that person's permissions on every step; it does not have privileges of its own.
- We do not permit these providers to train models on your content. Every request we
send is restricted to zero-data-retention routes and instructed to deny provider
data collection, and both instructions travel inside the request rather
than sitting in an account setting someone could later change. A route that will
not accept them is not used. This is checked two ways: an automated test refuses to
let any new part of the product ask a model anything without both instructions
attached, and a separate check sends a synthetic prompt to the live provider and
fails unless the route actually running accepts them.
6. Where it lives
Data is stored in the United States. If you or your customers are elsewhere, using the
service involves transferring information there.
7. Keeping it separate, and keeping it safe
- Every tenant's rows are separated by database-level row security, so isolation does
not depend on application code getting a filter right. It is tested continuously.
- Traffic is encrypted in transit. Where we hold a third-party access token on
your behalf, it is encrypted at rest with a key held separately.
- Access is by named account with role-based permissions, and administrative access to
the servers is restricted.
- Every change to a record is written to an audit trail.
No system is perfectly secure. If a breach affects your data we will notify you without
undue delay and tell you what we know.
8. How long we keep it
- Live data: for as long as your account is open. Records are
deactivated rather than destroyed when you remove them, so that history and audit
trails remain intact.
- Backups: taken nightly and transferred over an encrypted connection
to object storage that encrypts them at rest. Offsite copies are configured to
expire 14 days after upload; the storage provider processes deletion asynchronously,
so removal is not immediate at the 14-day boundary. Local copies are rotated on
the daily backup schedule using whole-day age checks. Data you delete can remain
in these copies until their scheduled removal.
- After you close your account: ask us to delete your data and we
will, and we will tell you when it is done. If you do not ask, we keep it. A closed
account is switched off rather than emptied, so your history and audit trail stay
intact and you can reopen or export them later; while it is closed we do not use
that data for anything. We would rather you be able to get your records back than
destroy them on a clock you did not set — so deletion is yours to ask for, at any
time, and you can export everything first.
9. Your rights
Depending on where you live you may have the right to access, correct, export or delete
personal information, and to object to some processing. To exercise them:
- If you are a shop using YieldOS, contact us.
- If you are a homeowner whose details are in a shop's account,
contact that shop. They control the record; we act on their instructions. If you
cannot reach them, contact us and we will try to help.
We will not discriminate against you for exercising any of these rights.
10. Children
The service is for businesses and is not directed at children. We do not knowingly
collect information from anyone under 16.
11. Changes
We will post changes here and update the date at the top. Material changes will be
notified in the app or by email before they take effect.
12. Contact
rob@norfbay.com