Privacy Policy

Yet is used by companies. When your company creates your account, it is the controller of the workspace's data — your mail, messages, files and profile — and Yet is the processor: we handle that data on its behalf, only to provide the service, as it instructs.

For the website's data — such as an email left on the waitlist — Yet itself is the controller.

• Account: name, email, photo, job title and the workspace you belong to. Your password is stored only as a hash, which cannot be reversed.
• Content: the mail you send and receive, Hello's messages, reactions and files, and what you keep in the workspace's other apps.
• Calls: audio, video and shared screens travel live between participants and are not recorded. The chat and pictures sent during a call are not kept once it ends.
• Devices: the name and operating system of each device you sign in on, the token that lets us send it notifications, and when it was last used.
• Preferences: your status (active, away, do not disturb) and how you want to be notified. Text size stays on your device only.
• Technical records: IP address, date and time of access, and security events such as sign-ins.
• Waitlist: the email you leave on the website.

• Camera and microphone: used only when you turn them on in a call.
• Photos and files: read only when you pick something to send.
• Notifications: optional; turn them off in the app or in your system settings at any time.
• Screen sharing: only when you start it in a call, with the system's indicator shown while it lasts.

• Providing the service: delivering mail and messages, showing who is online, connecting calls and keeping your devices in sync.
• Notifying you: alerts for new messages and calls, according to your preferences.
• Keeping it safe: authenticating sign-ins, preventing abuse and investigating incidents.
• Complying with the law: keeping access records as Brazil's Internet Civil Framework (Marco Civil) requires, and responding to orders from authorities.

We do not sell data, do not use it for advertising, do not use your workspace’s content to train artificial intelligence, and put no third-party trackers on the website or in the apps.

Only with those needed for the service to work, under contract and sharing as little as possible:

• Amazon Web Services (AWS): hosts the servers and the backups, in the United States.
• Google (Firebase Cloud Messaging), on Android, and Apple (Apple Push Notification service), on iPhone: deliver notifications to your device. They carry the sender's name and photo and the start of the message or the mail's subject.
• The services your company connects to Yet Cloud (such as an AWS or Cloudflare account): receive what is needed to run what your company requests.
• Authorities: when the law or a court order requires it.

People outside your company see only what you send them, such as an email.

The servers are in the United States. The transfer follows Article 33 of the LGPD, with the providers' contractual safeguards and the security measures below.

• The workspace's data is kept while the account exists. When you or your company delete it, it is removed from our live systems immediately.
• Encrypted backups keep copies for up to about 7 months, then are discarded.
• Access records are kept for 6 months, as the Marco Civil requires.
• Signing out of a device deletes its notification token.
• A waitlist email is kept until you ask to leave or your invitation is sent.

All traffic uses HTTPS. Passwords are kept as hashes, the app's sign-in is kept in the device's secure storage, backups are encrypted, and access to the servers is limited to those who run the service. On mail, we check SPF, DKIM and DMARC to flag forged senders.

Under the LGPD, you may ask for: confirmation that we handle your data, access to it, correction, anonymisation or deletion of what is unnecessary, portability, information on whom we share it with, and the withdrawal of consent. You may also complain to Brazil’s National Data Protection Authority (ANPD).

For the workspace's data, the request goes to your company's administrator, who is the controller; we help them answer it. If you write to us, we pass it on to them.

Because your company created your account, the workspace's administrator deletes it, in the company's settings in Yet. Deleting it removes your profile, your devices and your content, within the periods above.

Or write to privacidade@yet.com.br from the account’s email: we’ll confirm with your company and reply within 15 days.

We use only cookies needed for you to sign in and stay signed in, and a few that remember your choices. No third-party advertising or analytics cookies. The full list, with what each does and how long it lasts, is in the Cookie Policy.

Yet is a service for companies and is not meant for anyone under 18.

When it changes, we update the date at the top and, if the change is significant, notify you in Yet before it takes effect.

Yet's Data Protection Officer, as Article 41 of the LGPD provides, receives data subjects' complaints and requests and the ANPD's communications. Reach them at privacidade@yet.com.br; we answer within 15 days.

Questions and requests about privacy: privacidade@yet.com.br.