Privacy policy

This policy explains what personal data we process when you visit this website, use the YoMorph plugin with YoMorph Cloud, or buy credits, and what rights you have under the EU General Data Protection Regulation (GDPR).

Who is responsible

The controller is YoMorph. Contact: hello@yomorph.com.

This website

• The website sets no cookies and uses no tracking or advertising tools.
• Our hosting provider processes technical data such as your IP address and browser in server logs to deliver the site and keep it secure (legitimate interest, Art. 6(1)(f) GDPR). These logs are kept for a short period.

The plugin and YoMorph Cloud

• Connected sites: the address of each WordPress site that uses the service and when it was last used, so it can use its credits (performance of a contract, Art. 6(1)(b)). We remember which sites received the free trial so it is granted once (legitimate interest in preventing abuse, Art. 6(1)(f)).
• Requests to the AI: your messages and the parts of your site the assistant looks at (theme and plugin files, page HTML, settings, content you ask about, the element you point at, a design picture you attach, a picture of the private preview used to check a proposed change, and error log lines with email addresses and IP addresses removed when you ask for help with a problem) are sent to our service and passed to our AI provider to produce the reply (Art. 6(1)(b)). We do not store them. We keep technical usage figures per request: tokens, credits, duration and model.
• Product statistics: to understand how YoMorph is used and improve it, we record steps such as connecting a site, being shown a preview, applying a change, running out of credits and buying credits. For previews and applied changes we also record their general kind, chosen by the AI from a fixed list (for example "shop" or "design"). These records never contain your messages, your site's content or the change itself (Art. 6(1)(f), our legitimate interest in improving the product).
• Account: if you buy credits or sign in, your email address and sign-in ID (Art. 6(1)(b)).
• Purchases: Stripe processes payments. We keep a reference to your Stripe customer, your purchases and credit history. Invoices are kept as long as tax and accounting law requires, generally up to 10 years (Art. 6(1)(c)).
• Security and error logs: IP addresses and request details, and error reports without request content, kept at most 90 days (Art. 6(1)(f)).
• Conversations and customizations are stored in your own WordPress database, not by us. The plugin collects nothing from your website's visitors and sets no cookies for them; it sets one cookie only for the administrator previewing changes.

If the site content you send contains personal data of other people, we process it on your behalf only to answer your request. Business customers can request a data processing agreement (Art. 28 GDPR).

Service providers

• Anthropic (United States): one of the AI providers that run the assistant and the automatic check of a proposed change from a picture of its preview. It does not use the data to train models and deletes it after a limited period under its commercial terms.
• OpenAI (United States): one of the AI providers that run the assistant and the automatic check of a proposed change from a picture of its preview. It does not use the data to train models and keeps abuse-monitoring logs for up to 30 days.
• Stripe (Ireland): payments and invoices.
• Scaleway (France): sends sign-in emails.
• Render (EU region): hosting of YoMorph Cloud and its database.
• Sentry (EU region): error reports.
• Cloudflare (United States): hosts this website and forwards emails sent to our @yomorph.com addresses.
• Google (Gmail): the mailbox where emails you send us are kept.

Transfers outside the EU rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses (Art. 46 GDPR).

How long we keep data

Account and site data until you delete your account. AI requests are not kept. Credit and usage records are kept without your email as long as accounting law requires. Logs at most 90 days.

Your rights

You can access, correct or delete your data, restrict or object to its processing, and receive it in a portable format. On the credits page you can download your data and delete your account. For anything else, contact us. You can also complain to a data protection authority, in particular in the EU country where you live or work. We do not make decisions about you based solely on automated processing.

Changes

We update this policy when our processing changes and show the date above.