The data we collect, why, and how to make us delete it

YATE Web Ltd. (“YATE Web”, “we”, “us”) is the data controller for the personal data you share with us through this website, yateweb.com, and through any engagement you have with us. You can reach us at privacy@yateweb.com.

We collect three categories of data:

• Things you tell us. Your name, work email, company, role, project details, and anything else you submit through our audit form, contact form, or methodology subscription.
• Things your browser tells us. IP address (truncated before storage), user agent, referrer URL, and session events (page views, CTA clicks). Used to understand which pages convert and to fix bugs.
• Things our partners tell us. If you book a call via Cal.com or pay an invoice via Stripe, those services share the minimum data needed to complete the action.

We do not buy data, scrape contact lists, or enrich your profile from third-party providers.

We process personal data on these legal bases:

• Contract. To deliver an audit, run a project, or respond to your enquiry.
• Legitimate interest. To keep the site secure, measure aggregate traffic patterns, and improve our services. You can object at any time.
• Consent. For non-essential cookies and the methodology newsletter. You can withdraw consent at any time without affecting prior processing.
• Legal obligation. For tax records, anti-fraud, and statutory accounting periods.

We try to keep our infrastructure boring and well-known. Our current sub-processors are:

• Vercel: site hosting and edge functions (US, EU regions).
• Supabase: application database for audit and contact submissions (EU region).
• Resend: transactional email for confirmations and audit delivery.
• Linear: internal project tracking, where we keep the engineering plan for your build.
• Stripe: payment processing (PCI-DSS Level 1).
• Plausible: privacy-friendly, cookie-less analytics.

Where data is transferred outside the UK or EU, we rely on Standard Contractual Clauses and the UK's International Data Transfer Agreement.

• Audit submissions: 12 months from submission, then anonymized for trend analysis.
• Newsletter subscribers: until you unsubscribe.
• Client project data: for the lifetime of the engagement plus 6 years for tax and accounting purposes.
• Site analytics: 24 months in aggregate, then discarded.

Under UK GDPR and equivalent laws, you can ask us to:

• Confirm what personal data we hold about you and give you a copy.
• Correct anything that's inaccurate.
• Delete your data, where it isn't needed for a contract or a legal obligation.
• Restrict or object to specific processing.
• Receive your data in a portable format.
• Withdraw consent for processing based on consent.

Email privacy@yateweb.com and we'll respond within 30 days. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk.

We don't use your project materials, source code, or business data to train external AI models. When we use AI tools as part of delivery, we route through enterprise plans with zero-retention or no-training settings enabled. The full breakdown is in our AI Usage Policy.

See our Cookie Policy for the specifics on what cookies we set and how to opt out.

Our services are aimed at businesses, not consumers, and certainly not children. We don't knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, email us and we will delete it.

When we update this policy we'll change the “last updated” date at the top. Material changes will be announced on the homepage banner and, if you're an active client or subscriber, by email.