Privacy Policy

Yabuh Ltd (“Yabuh”, “we”) provides a marketing platform used by small businesses in Canada. This policy explains what information we hold, why we hold it, who we share it with, and how to have it removed. It applies to every address we trade under.

Which sites this covers. Yabuh Ltd is one company operating under several addresses, and this policy applies to all of them: yabuh.com and its subdomains including app.yabuh.com and projects.yabuh.com, together with yabuh.org, yabuh.ca, yabuh.co.uk and yabuh.ae. Wherever you reach us, the same company holds your information under the same terms, and one deletion request covers every one of them.

Who we are

Yabuh Ltd, a federally incorporated Canadian company. For any privacy question, or to ask us to delete your information, write to help@yabuh.org. We answer within five business days.

What we collect

• Account details: your name, business name, email address and phone number.
• Business information you give us: your services, hours, service area, prices where you choose to publish them, photos you upload, and the answers you give our setup assistant.
• Website data: the public pages of your own website, which we read to understand your business and to apply wording changes you approve.
• Search performance data from Google Search Console for your website: the searches your site appeared for, how often, and your position.
• Connected account data, only where you connect an account and only what that connection needs — see the section below.
• Usage records: which changes were approved, by whom and when, kept so both sides can see what happened.

We do not collect payment card numbers. Payments are handled by Stripe, who hold that information under their own terms.

Facebook, Instagram and Meta data

If you connect a Facebook Page, we ask only for what publishing requires: the list of Pages you manage so you can pick one, the identity of the Page and linked Instagram Business account you select, permission to publish posts you have approved, and the ability to read back the posts we published so you can confirm they went live.

• We publish only posts you have read and approved in our app. We never post automatically without that approval.
• We never read your private messages, your friends, or personal profile content beyond your public profile.
• We store the access token for the Page you selected, encrypted, and use it only for your account.
• We do not sell Meta data, and we do not use it for advertising or for any purpose other than operating the service for you.
• You can disconnect at any time from Connect accounts in the app. Disconnecting deletes our stored tokens and revokes our permission on Facebook.

Google data

Where you connect Google Search Console, a Google Business Profile or a calendar, we read only what the feature needs: your search performance figures, your business profile and posts, or your availability for bookings.

Limited Use disclosure. Yabuh's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer this data to others except as needed to provide the service, we do not use it for advertising, and no human reads it except where you ask us for support or where the law requires it.

Google Search Console and Google Business Profile

Where you connect Google Search Console, we read your site's search performance — the searches it appeared for, how often, the pages people landed on and your average position. We use it only to show you those figures and to decide what to write or improve for you. We do not attempt to identify individual searchers, and Google does not give us that information.

Where you connect a Google Business Profile, we read your profile, its posts and its reviews, and — only with your approval — publish posts or reply to reviews on your behalf. We follow the Google Business Profile content policies: we do not create fake reviews, we do not offer incentives for reviews, and we do not post misleading claims about your business.

Meta Platform Terms

Our use of Facebook and Instagram data follows the Meta Platform Terms and Developer Policies. We request the minimum permissions publishing requires, we use Platform Data only to provide this service to the business that granted it, we do not transfer it to data brokers or advertisers, we do not use it to build profiles of anyone, and we delete it when you disconnect or close your account.

How we use what we hold

• To write blog posts, social posts and case studies about your business for you to approve.
• To suggest and, where you approve them, apply wording changes to your website.
• To show you how your business is performing in Google search.
• To answer your calls and messages if you use our assistant, and to pass what was said back to you.
• To bill you, support you, and keep the service secure.

We do not sell your information. We do not use it to train models for anyone else.

Who we share it with

Only the services that make the product work, and only what each one needs: Supabase (database and file storage), OpenAI (writing text and, where you use it, answering calls), Twilio (calls and text messages), Stripe (payments), Meta and Google (only where you have connected them), and Hostinger (hosting). Each processes data under its own agreement with us. We do not share your information with advertisers or data brokers.

Where it is held, and for how long

Data is held on servers operated by our providers, which may be in Canada, the United States or the European Union. We keep your information for as long as your account is open. Call recordings are deleted after 90 days. When you close your account we delete your data within 30 days, except anything we must keep for tax or legal reasons.

Deleting your data

You can remove things yourself at any time: photos and articles from your app, and connected accounts from Connect accounts, which deletes the stored tokens and revokes our access at Facebook or Google.

To delete everything, email help@yabuh.org from the address on your account with the subject “Delete my data”. We confirm within five business days and complete the deletion within 30 days, including anything we hold that came from Facebook, Instagram or Google. If you only want the data from a connected platform removed, say which one and we will delete that alone.

Your rights

Under Canadian privacy law you may ask what we hold about you, ask us to correct it, ask for a copy, or ask us to delete it. Write to help@yabuh.org. If you are unhappy with our answer you may complain to the Office of the Privacy Commissioner of Canada.

Security

Connections are encrypted in transit. Access tokens are encrypted at rest. Access to client data inside Yabuh is limited to staff who need it, and actions taken on your account are recorded in an audit log you can ask to see.

Children

The service is for businesses. It is not intended for anyone under 18.

Changes

If we change this policy we will update the date above and, where the change matters, tell you in the app or by email.