Privacy Policy

Last updated: October 2026

1. Who we are

This Privacy Notice is issued by MyAiON Inc. (“MyAiON”, “we”, “us”, “our”), a corporation incorporated under the laws of the State of Delaware, with registered office at 257 Old Churchmans Road, New Castle, DE 19720, USA, and principal office at 21 S 11th Street, Floor 2, Philadelphia, PA 19107, USA.

MyAiON is the Data Controller of your personal data within the meaning of Article 1 of the UAE Federal Decree by Law No. (45) of 2021 (UAE PDPL) and, where applicable, Article 4(7) GDPR. This means we are responsible for deciding how and why your personal data is processed and for ensuring that it is handled in accordance with applicable data protection law.

MyAiON has designated a representative in the European Union under Article 27 GDPR, whose details are set out above. You may contact the representative, in addition to or instead of MyAiON, on any matter relating to the processing of your personal data.

For questions or requests regarding your personal data, or to exercise any of the rights described in Section 9, please contact us at compliance@yasi.one.

2. Scope of this notice

This Privacy Notice applies to all users who access the Yasi One application or visit the website yasi.one, regardless of their country or state of residence. Depending on your jurisdiction, additional rights or disclosure requirements may apply under applicable local law, as set out in the Appendix.

This Notice applies to:

• Users who register for and use the Yasi One application, available as a web app and as a mobile application for iOS and Android devices;

• Visitors to the institutional website yasi.one , including individuals who submit enquiries through the contact form.

This Notice does not apply to third-party websites or services accessible via external links from Yasi One. We encourage you to read the privacy policies of any third-party services you access.

Use of Yasi One is reserved exclusively for adults who have reached the age of majority under the law applicable to them and who have the legal capacity to enter into binding contracts. If we become aware that an Account is being used by a minor, we may suspend or deactivate it.

3. Personal data we process

The following sections describe the categories of personal data we collect, the purposes for which we use it, the legal basis for processing under the UAE PDPL and, where applicable, the GDPR, and the applicable retention approach.

3.1 Categories of personal data

Depending on how you interact with Yasi One, we process the following categories of personal data:

• Account and identity data: full name, email address, username, password (hashed), country of residence, date of birth, gender, language preferences, and — where applicable for invoicing purposes — billing address and tax identification details.

• Authentication and security data: IP address, device type and identifier, operating system version, session token, and access logs generated during login and use of the platform.

• Search queries and conversation history: text queries submitted to the AI search, audio and video files you attach (transcribed to text and kept with their conversation), search history and blacklisted sources.

• User-uploaded content: files and documents (PDF, DOCX, PPTX, XLSX, TXT, code files), images, and audio files uploaded to My Files or submitted for processing via Quick Actions (Summarise, Translate, Transcribe, Describe). Quick Actions may be activated on: (a) content directly uploaded by the User within Yasi One — this content is stored within the User's account; and (b) content shared from third-party applications (such as voice messages from WhatsApp or Telegram) directly into Yasi One via the device's native sharing functionality — this content is processed solely to generate the requested output and is not stored within the User's account. Also includes text prompts and reference images submitted for Image Mode, and prompts and style inputs submitted for Music Mode.

• Generated outputs: AI-generated search summaries, Quick Action outputs (transcriptions, translations, summaries, image descriptions), images stored in My Gallery, and musical compositions stored in My Music.

• Payment and transaction data: subscription plan, Yasi Credits balance, transaction history, transaction date and amount. Yasi One does not take payments in the application: no payment card data is processed or stored by MyAiON.

• Support and communications data: email address, name and content of support requests, and communication preferences (marketing opt-in/opt-out).

• Website contact form data: name, email address and message content submitted through the contact form on yasi.one

• Usage and technical metadata: session duration, type of service used, volume of requests, error logs and operational metrics generated by normal use of the platform.

3.2 Special categories of personal data

Yasi One is a general-purpose AI tool. We do not intentionally collect special categories of personal data (such as health information, religious or political beliefs, racial or ethnic origin, or sexual orientation). However, because some features involve user-generated content, such data could appear incidentally in content you enter or upload. Where this occurs, we process it solely to provide the service you have requested and do not use it for any other purpose.

You are expressly prohibited from uploading or sharing criminal conviction data or judicial data relating to identified or identifiable third parties.

Note on audio and video files: an audio or video file you attach is transcribed to text by a technical subcontractor that processes requests on our behalf. The file and its transcript are kept with their conversation and erased with it.

3.3 Purposes, legal bases and retention

The table below sets out the purposes for which we process personal data, the legal basis under the UAE PDPL and, where applicable, the GDPR, and the applicable retention approach.

Automated decision-making

You have the right not to be subject to a decision based solely on automated processing that produces legal effects or significantly affects you (Art. 18 UAE PDPL; Art. 22 GDPR). MyAiON does not make decisions of this nature. The automated mechanisms used by Yasi One (algorithmic source selection, content filtering, speech-to-text transcription) are functional processes necessary for service delivery and do not produce such effects.

When your Account is closed, we apply a structured deletion process: immediate pseudonymisation of directly identifying fields upon account closure request; permanent deletion of all data without a legal retention basis 30 days after the closure request; and erasure of residual copies in our database backups within 15 days of that deletion. You can delete specific content (conversations, files) at any time from within the application: depending on its type, it is erased at once, within 30 days, or when the trash period you have chosen ends, and residual copies in our database backups are erased within 15 days of that erasure.

4. We do not train AI models on your data

MyAiON does not use your personal data, your queries, your files or any other content you generate within Yasi One to train, fine-tune or improve any AI model, whether its own or anyone else's.

The technical subcontractors that process your requests receive your data to carry out those requests. Some of them may keep a copy of what they receive, for the period and purposes set out in their own terms, including security and abuse prevention.

AI-generated outputs are produced by AI systems and may not be accurate, complete or representative of the original content or source material. MyAiON does not guarantee the accuracy, reliability or uniqueness of any AI-generated output. You are responsible for verifying information before relying on it.

5. Who has access to your data

5.1 Within MyAiON and its group

Access to personal data within MyAiON is restricted on a need-to-know basis. We apply role-based access controls on our administration console, and changes our team makes from it are recorded in a journal in which any alteration shows.

Synapsia S.r.l., a company of the same group as MyAiON, develops the Yasi One platform. It holds no account or access key of its own on our production systems.

Members of our team may access data relating to how the platform is used, in the performance of functions relating to technical support, service quality improvement, abuse prevention and platform security.

This access is subject to internal authorisation controls and is limited to what is necessary for the specific purpose; changes made from our administration console are journaled. This access is necessary to protect the security and integrity of the service and the interests of our users (Art. 4(7) UAE PDPL — necessary to protect the interests of the Data Subject; Art. 6(1)(f) GDPR — legitimate interests of the Controller).

5.2 Third-Party service providers (Processors)

We share your personal data with technical subcontractors who process it on our behalf, for the purposes described in this Notice. Those that act as our processors under data processing terms are bound to process your data only as we direct, to maintain appropriate security measures, and not to use it for their own purposes. Others, such as the external icon service listed below, operate under their own terms.

5.4 Authorities and legal obligations

We may disclose personal data to competent authorities, regulatory bodies or courts where required to do so by applicable law, by a binding court order, or by a lawful request from a public authority. In such cases, we will disclose only what is strictly required and, where permitted by law, we will notify the affected user.

6. International transfers of personal data

The servers of Yasi One are located in Canada, where your personal data is stored and processed by our hosting subcontractor. The European Commission recognises Canada as providing an adequate level of protection for personal data processed by commercial organisations (Decision 2002/2/EC); no additional safeguard is required for these transfers.

Your personal data is also processed in the United States, by MyAiON Inc. and by technical subcontractors located there, named here by function only (processing of your requests, sending and receiving of e-mails), and by the external icon service that displays the icons of cited websites. Some of these recipients may in turn process data in other countries where they or their own subcontractors operate, under their own terms.

You can obtain information on the safeguards that apply to these transfers by writing to compliance@yasi.one.

7. How long we keep your data

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required or permitted by applicable law. When you close your Account, we apply a structured deletion process:

• Immediate pseudonymisation of directly identifying fields upon account closure request.

• Permanent deletion of all data without a legal retention basis 30 days after the closure request.

• Erasure of residual copies in our database backups within 15 days of the deletion date.

Certain data is kept after the Account is deleted: billing lines (amount, date, action code, opaque reference), as required by accounting law; connection identifiers (account identifier, IP address, time), for 12 months; the internal journal of our team, with your identifying details removed; safety flags, which never contain the text of your messages; and, where the law requires it, records needed for legal proceedings. Access to this data is restricted to those with a legitimate need.

You can delete specific content (such as your conversations or your files) at any time from within the application. Depending on its type, deleted content is erased at once, within 30 days, or when the trash period you have chosen ends (30 days at most); residual copies in our database backups are erased within 15 days of that erasure.

8. How we protect your data

We apply technical and organisational security measures appropriate to the nature of the data we process. These include:

• Encryption of data in transit.

• Role-based access controls on our administration console, where changes made by our team are recorded in a journal in which any alteration shows.

• Administrative access to our servers by key only, never by password.

• Separation of production and development environments.

• Health checks of our services and service logs kept on our own servers.

• Daily backups of our database, each kept for no more than 15 days.

9. Your Rights

Under the UAE PDPL (Articles 13–18) and, where applicable, the GDPR (Articles 15–22), you have the following rights in relation to your personal data:

To exercise any of these rights, please contact us at compliance@yasi.one. We may need to verify your identity before processing your request. We will respond within the timeframe required by applicable law. We do not charge a fee for requests unless they are manifestly unfounded or excessive.

In addition to the rights above, you can manage your data directly within the application, including deleting your conversations, deleting your files, and closing your Account.

10. Data breaches

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the UAE Data Bureau in accordance with Article 9 of the UAE PDPL, and where applicable the competent EU supervisory authority (Art. 33 GDPR). Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly (Art. 9(2) UAE PDPL; Art. 34 GDPR).

11. Cookies and similar technologies

The Yasi One web application uses cookies, and both the application and the website yasi.one keep some preferences, such as the theme and the language, in your browser's local storage. The website yasi.one sets no cookies.

Strictly necessary cookies are used to enable the core functionality of the application, including authentication and session management, and to remember the language you have chosen. They are set without requiring your consent. We set no other cookies: neither the application nor the website uses advertising, analytics or tracking cookies. The external icon service described in Section 5.2 operates under its own terms.

12. Changes to this notice

We may update this Privacy Notice from time to time to reflect changes in our practices, in the services we offer, or in applicable law. Where changes are material, we will notify you in advance through the application or by email to the address associated with your Account, in accordance with the General Terms and Conditions.

The date of the last update is shown at the top of this Notice. We encourage you to review it periodically.

13. Contact and complaints

For any questions or concerns regarding this Privacy Notice, or to exercise your data subject rights, please contact us:

You also have the right to lodge a complaint with the UAE Data Bureau (uaedataoffice.ae). EU-based users may lodge complaints with the supervisory authority of their country of residence or place of work within the EU; a list of EU supervisory authorities is available at edpb.europa.eu.

Users in the UAE may lodge complaints with the UAE Data Bureau. Information on how to do so is available on the UAE Data Office website at uaedataoffice.ae.

Appendix — Jurisdiction-Specific Provisions

Additional rights and disclosures applicable in specific regions

A. United Arab Emirates (UAE Federal Decree by Law No. 45/2021 — UAE PDPL)

The primary applicable data protection framework is the UAE Federal Decree by Law No. (45) of 2021 on the Protection of Personal Data (UAE PDPL). This Notice is designed to satisfy the transparency requirements of the UAE PDPL. The GDPR applies in addition for users located in the European Economic Area, by virtue of its extra-territorial scope (Art. 3 GDPR).

Users in the UAE may lodge complaints with the UAE Data Bureau (UAE Data Office). Information on how to do so is available on the UAE Data Office website at uaedataoffice.ae.

International transfers of personal data of individuals in the UAE to countries outside the UAE are governed by Articles 22–23 of the UAE PDPL and the safeguards described in Section 6 of this Notice. Transfers of EEA-user data are additionally subject to Chapter V GDPR requirements as described in Section 6.

B. United Kingdom (UK GDPR)

Where Yasi One is accessed by users located in the United Kingdom, the UK GDPR and the Data Protection Act 2018 apply. The rights and obligations described in this Notice apply equally to UK users, with references to the GDPR to be read as references to the UK GDPR where the context requires.

Users in the UK may lodge complaints with the Information Commissioner’s Office (ICO) at ico.org.uk.

International transfers from the UK to Canada rely on UK adequacy regulations; transfers to the United States are described in Section 6.

D. United States

There is currently no single federal privacy law of general application in the United States. Privacy rights for US residents are governed at the state level and vary depending on the state of residence. Certain states — including California, Virginia, Colorado, Connecticut, and Texas — have enacted comprehensive privacy laws that may grant residents additional rights with respect to their personal data, such as the right to know, the right to delete, the right to correct, the right to opt out of the sale or sharing of personal data, and the right to non-discrimination for exercising privacy rights.

MyAiON applies the UAE PDPL and GDPR as its baseline standards, which provide a level of protection consistent with or exceeding the requirements of applicable US state privacy laws for all users, regardless of their state of residence. To the extent that specific US state privacy laws apply to MyAiON's processing activities, MyAiON will comply with those requirements. Users located in the United States who wish to exercise rights under applicable state law, or who have questions about how their data is handled, may contact us at compliance@yasi.one indicating their state of residence.

D. Other Jurisdictions

Users in other jurisdictions may have additional rights under applicable local law. For jurisdiction-specific enquiries, please contact us at compliance@yasi.one indicating your country of residence. We will assess applicable requirements and respond accordingly.