Legal
Privacy Policy
Last updated: September 29, 2026
1. Who we are
This Privacy Policy is issued by Your Personal AI AS ("YPAI", "we", "our", or "us"), a Norwegian private limited company registered with the Brønnøysund Register Centre under organisation number 933 915 778, with its registered office at Lysaker torg 5, 1366 Lysaker, Norway. It explains how we collect, use, disclose, and safeguard personal data when you contact us, use our website, or take part in our work as a contributor.
Where YPAI decides why and how personal data is processed, YPAI is the controller. Where YPAI processes personal data on a customer's instructions as part of a data-collection or annotation engagement, that customer is the controller and YPAI is the processor; the data processing terms govern that relationship. For studies we run ourselves through a recruitment platform, Your Personal AI AS is the controller. Use of the website itself is governed by the Terms & Conditions.
This policy covers four groups of people:
- people who contact us about our services or book a meeting with us, usually on behalf of the company they work for (section 2);
- visitors to ypai.ai (section 3);
- contributors who register to take part in data-collection and annotation work (section 4);
- people who take part in a study through a recruitment platform, without registering with us (section 4a).
2. Business enquiries and meetings
This section applies when you send us an enquiry through a form on ypai.ai, ask to become a partner, or book a meeting.
What we collect
- What you enter: your name, work email address, company, job title, phone number if you give one, country, your message, the service and project details you choose, and your answers to the questions in the form. For a meeting, also the time, your time zone and what you want to discuss. For a partner enquiry, also the kind of partnership, company size, timeline, goals and how you heard about us.
- What is sent with the form: your IP address, your browser and device type, the page you sent the form from, the site that referred you, the first page you visited and any campaign tags in the link (utm_ parameters).
- What we add: an automatic priority score based on the details you give, which we use to sort our follow-up.
Why we use it and our legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Answering your enquiry and following it up, including a confirmation email to you and a notification to our team | What you enter; the page you sent it from | Our legitimate interest in answering business enquiries and developing business relationships (Art. 6(1)(f)). If you enquire on your own behalf about a contract with us: steps you asked for before a contract (Art. 6(1)(b)) |
| Arranging a meeting you book, with a calendar invitation and video link | Name, email, company, job title, topic, time and time zone | As above (Art. 6(1)(f), or Art. 6(1)(b)) |
| Deciding which enquiries to follow up first (priority score) | What you enter | Legitimate interest in handling enquiries efficiently (Art. 6(1)(f)) |
| Protecting our forms against spam, bots and abuse (Cloudflare Turnstile, limits per IP address, spam traps) | IP address, browser, what you enter | Legitimate interest in keeping our forms secure (Art. 6(1)(f)) |
| Knowing which channel or campaign brought an enquiry | Referring site, first page, campaign tags, the page you sent the form from | Legitimate interest in knowing which marketing works (Art. 6(1)(f)) |
| Measuring which Google Ads campaigns lead to enquiries, including enhanced conversions (your email address, hashed before it leaves your browser) | Conversion event; hashed email address on the annotation service pages | Your consent in the cookie banner (Art. 6(1)(a)). Without it, nothing is sent to Google |
| Running, securing and fixing the service: error monitoring, operational logs and backups | IP address, browser, page; error reports carry a shortened one-way hash of your email address, not the form content | Legitimate interest in a working and secure service (Art. 6(1)(f)) |
| Keeping records, handling disputes and meeting legal obligations | What is needed for the purpose | Legal obligation (Art. 6(1)(c)) or our legitimate interest in establishing and defending legal claims (Art. 6(1)(f)) |
Where we rely on legitimate interests, you can object at any time (section 8). You do not have to give us any of this information, but we cannot answer an enquiry without a way to contact you.
Who receives it
Our team handles enquiries. We use the service providers below, which process the data on our behalf and under our instructions.
| Provider | What they do |
|---|---|
| Cloudflare | Hosts and delivers ypai.ai and runs the form service; Turnstile bot checks; operational logs; the database for meeting bookings; short-lived storage for rate limits and a backup copy of an enquiry if our main database is unavailable |
| Turso | Database in which we store enquiries |
| Google (Google Workspace) | Our email accounts; a copy of each enquiry in a Google Sheets spreadsheet; calendar invitations and Google Meet links for meetings you book |
| Resend | Sends the confirmation email to you and the notification to our team |
| Sentry | Error monitoring for the website and the form service (EU region, Germany) |
| Google (Google Ads, Google Analytics) and PostHog | Only if you accepted cookies: conversion measurement and analytics, as described in the Cookie Policy |
We may also disclose data where the law requires it or to protect our rights. We do not sell personal data.
How long we keep it
We keep enquiry records while we handle your enquiry and any business relationship that follows, and afterwards for as long as we need them to document that relationship or to establish or defend legal claims. We have not yet set a fixed deletion period for enquiry records; until we do, you can ask us to delete your enquiry at any time (section 8), and we will do so unless the law requires us to keep it. Meeting bookings are kept the same way. Some technical records are short-lived: rate-limit entries per IP address last up to an hour and the per-email limit for meeting bookings lasts a day, the backup copy used only when our main database is unavailable is kept for 90 days, and form statistics without your name or email address are kept for 90 days.
Transfers
Several of these providers are based in the United States or belong to groups there, so your data may be processed or accessed outside the EEA. Section 9 explains the safeguards.
3. Visiting ypai.ai
- Every visit: Cloudflare processes your IP address and the details of each request to deliver and protect the site. Sentry receives reports of errors in the page and performance timings for a sample of page loads, as described in the Cookie Policy. The document-signing pages also load fonts from Google Fonts, which receives your IP address. Legal basis: our legitimate interest in a working and secure website (Art. 6(1)(f)).
- Only if you accept cookies: Google Ads, Google Analytics 4 and PostHog. None of them loads before you accept, and you can withdraw your consent at any time with the Cookie settings button in the site footer. Legal basis: your consent (Art. 6(1)(a)).
- AI demos: some pages offer demos where you type a question or upload a file. What you enter is sent to Amazon Web Services (Amazon Bedrock, EU region) or to Anthropic (United States) to produce the answer. Please do not enter personal or confidential information in a demo. Legal basis: our legitimate interest in showing what our services do, at your request (Art. 6(1)(f)).
4. Contributors
This section applies when you register with us as a contributor to data-collection or annotation work.
Personal information
When you register or use our services, we may collect:
- Name and contact information (email address, phone number)
- Location information (country, timezone)
- Language proficiencies
- Professional background and skills
- Payment information for compensation
Contributed data
Depending on the tasks you complete, we may collect:
- Voice and audio recordings
- Images and video recordings
- Written content and annotations
- Metadata associated with contributions
Technical information
When you use the contributor platform we automatically collect:
- IP address and device information
- Browser type and settings
- Usage data and interaction patterns
How we use it
- Provide, maintain, and improve our services
- Process your registration and manage your account
- Match you with appropriate tasks based on your skills and languages
- Process payments for completed work
- Communicate with you about tasks, updates, and opportunities
- Ensure quality and prevent fraud
- Comply with legal obligations
Use of contributed data
Data you contribute through tasks (voice recordings, images, etc.) is used for:
- Training and improving artificial intelligence systems
- Development of commercial AI products and services
- Research and development purposes
- Quality assurance and validation
This data may be shared with the clients and partners who commission the data collection projects. Whether an individual contribution can later be retrieved or deleted depends on the engagement, the governing contract, and what is technically feasible for the dataset it became part of. Where data has been delivered under contract, deletion of the delivered copies is governed by that contract; YPAI supports identifying affected records and forwarding requests to the recipient.
4a. Taking part through a recruitment platform
This section also applies when you take part in a study through a recruitment platform such as Prolific, without registering with us. We receive your platform participant ID and the study and session IDs, and use them only to link your recording to your participation and to arrange your payment, which the platform makes. In the study we collect your voice recording, your answers about yourself (your gender and year of birth; and, only if you choose to answer, your city, country and other languages you speak) and a record of your consent. The name you type to sign the consent is stored in a separate consent ledger, apart from the recording. We rely on your explicit consent (Art. 6(1)(a)). Recordings and answers are stored with Cloudflare in the EU. You can withdraw at any time from the link shown on your consent receipt or at contact@ypai.ai; we then delete your recording and take your answers out of use, and copies already delivered to a client are handled as described in section 4.
6. Data security
We implement appropriate technical and organizational measures to protect your information, including encryption, access controls, and secure data storage. However, no method of transmission over the Internet is 100% secure.
7. Data retention
Retention depends on the category of data and the role YPAI has for it. Business enquiries are covered in section 2. Contributor account and contact information is kept for as long as your account is active, or as needed to provide services and meet legal requirements. Contributed data is handled according to the contract that governs the engagement it was collected for: at the end of an engagement it is returned, deleted, or retained on the terms agreed there. Backup, audit, and statutory retention exceptions are handled explicitly in those terms.
8. Your rights
Under the GDPR, as it applies in Norway and the rest of the EEA, you have the right to:
- Access the personal data we hold about you and receive a copy
- Have inaccurate data corrected
- Have your data deleted
- Have our processing restricted
- Object to processing we base on our legitimate interests
- Data portability, for data you gave us under a contract or your consent
- Withdraw consent at any time, without affecting processing before the withdrawal. For cookies, use the Cookie settings button in the site footer
To use these rights, submit a data request or write to contact@ypai.ai. We handle requests by hand and answer within one month, as the GDPR requires.
You also have the right to complain to the Norwegian Data Protection Authority (Datatilsynet), or to the supervisory authority where you live or work.
Note: For contributed data (voice recordings, images, etc.), what a request can achieve depends on YPAI's role for that data and the legal basis it was collected under. Where YPAI processes the data on behalf of a client, your request is routed to that client as the controller, and YPAI assists with identifying the affected records.
9. Transfers outside the EEA
Some of our service providers are based in the United States or belong to groups there, so personal data may be processed in or accessed from countries outside the EEA. Where we know the region, we use EU locations: Sentry's EU region and PostHog's EU Cloud. When personal data is transferred outside the EEA, the transfer relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the recipient is certified under it, or on the European Commission's standard contractual clauses.
11. Children's privacy
Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children.
12. Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on our website and updating the "Last updated" date.
13. Contact us
For questions about this Privacy Policy, use the contact form or write to contact@ypai.ai. To exercise your rights over personal data, you can also submit a data request directly.
Postal address: Your Personal AI AS, Lysaker torg 5, 1366 Lysaker, Norway.