Privacy policy

yudochat ("yudochat", "we", "us") is a product of Iverton AI Pvt Ltd, a company incorporated in India. This policy explains what personal data we collect when you use the yudochat mobile application and the website yudochat.com (together, the "Service"), why we collect it, how we protect it, and the rights you have over it. Contact for anything in this policy: [email protected].

1. What we collect

• Account data — your email address and password (stored only as a secure hash), plus subscription tier and settings.
• Connected-platform credentials — when you connect Instagram, Facebook or YouTube, we receive OAuth access tokens from Meta Platforms, Inc. or Google LLC. Tokens are stored encrypted at rest. We never receive or store your social-media passwords.
• Platform content ("Platform Data") — the data needed to run the automations you configure: public comments on your posts, comment metadata (author username, timestamp, post ID), message events for conversations your account participates in, and post/video metadata from your connected accounts.
• Leads — public profile information of people who interact with your content (username, comment text, engagement history with your account), organised into your leads inbox and scored for you.
• Device data — a push-notification token, device type, app version, and basic diagnostic logs (errors, crashes).
• Billing data — subscriptions are processed by Apple App Store or Google Play (managed via RevenueCat). We receive subscription status only. We never receive your card or bank details.
• Marketplace data — if you list yourself in the creator directory or use a business/agency account: your directory profile (display name, niche, city, indicative rate, and the handles and follower or subscriber counts of the accounts you connect — read from those accounts, never typed), post statistics measured from your connected Instagram account (average likes and comments, posting frequency, date of your latest post, and the engagement rate derived from them — all counts Instagram already shows publicly on your posts), the campaigns you post or apply to, collaboration invites you send or receive, and the messages exchanged with the other party. Report and block records you create are also stored.
• AI Studio inputs — when you use the AI generation features (hashtags, scripts, repurposing, captions and similar), the prompts and content you submit are processed by our AI providers to produce the output for you. The app asks for your permission before the first request, and you can withdraw it at any time in Settings → AI features.
• Brand-deal detection — to find real collaboration offers in your inbox, incoming comments and direct messages are first screened on this server for collaboration wording. Only if you have allowed AI features in the app are the messages that match sent to our AI provider, together with the sender’s handle, so it can judge whether the message is a genuine offer; the verdict is cached so the same message is never sent twice. Messages that do not match the screen are never sent, and until you allow AI features (or after you turn them off) offers are matched by keywords on our server and nothing is sent. Your date of birth, your access tokens and your password are never sent to any AI provider.
• Notify-me data — if you ask us on our website to tell you when the iOS app is available: your email address and, optionally, your Instagram handle.

2. Why we collect it (purposes and legal bases)

• To provide the Service (performance of contract): executing the automations you configure — replying to comments, sending direct messages, capturing leads — and showing you your activity feed, leads inbox and analytics.
• To notify you (consent): push notifications for hot leads, sent replies, errors and quota alerts. You can switch these off anytime.
• To bill you (performance of contract): managing your subscription through the app stores.
• To keep the Service safe (legitimate interest): rate limiting, spam filtering, abuse prevention, debugging and security monitoring.
• To email you when you ask us to (consent): for example, telling you the day the iOS app is available. Every email includes a way to opt out.
• To measure our own ads (legitimate interest): the Android app includes the Meta SDK, which tells Meta when the app is installed or opened, when an account is created, when a first social account is connected and when a plan is bought, together with your device's advertising ID. This shows us which of our ads on Instagram and Facebook bring real users. It never includes your content, messages, contacts, handles or Platform Data. You can reset or delete your advertising ID in your phone's settings (Google → Ads, or Privacy → Ads).

We do not sell personal data. Apart from the app events that measure yudochat's own ads (above), we do not use your data for advertising, and we never use your audience's data for advertising. We do not use your content or Platform Data to train artificial-intelligence models.

3. Meta Platform Data

yudochat accesses Instagram and Facebook data through Meta's official APIs, under Meta's Platform Terms and Developer Policies. Platform Data is used solely to provide the features you configure, is never sold, and is never used for advertising or profiling unrelated to the Service. When you disconnect a platform or delete your account, the related Platform Data and tokens are deleted as described in Section 7. You can also revoke yudochat's access at any time from Instagram/Facebook under Settings → Apps and Websites.

4. Google and YouTube API Services

yudochat uses YouTube API Services to read comments on your videos and post the replies you configure. By connecting YouTube, you also agree to the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.

yudochat's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• YouTube data we access: your channel identity, your videos' metadata, and comments on your videos.
• YouTube data we store: comments on your videos that reach your automations (the comment text, the commenter's public name and channel ID, and the comment ID) for your reply log, leads and duplicate-reply protection; your channel's title, picture and subscriber count; and the titles and thumbnails of the videos your automations watch.
• How long we keep it: comment text and commenter details are deleted 30 days after we receive them — after that we keep only anonymous counts, such as how many replies an automation sent. Channel and video titles and pictures are refreshed from YouTube every week, and anything we cannot refresh for 30 days is deleted.
• You can revoke yudochat's access to your Google account at any time via Google security settings. When you disconnect YouTube in yudochat (or delete your yudochat account), we revoke our access with Google and delete the stored YouTube data immediately. If you revoke access from Google's settings instead, it is deleted within 30 days.

Free YouTube comment checker. When you paste a channel or video link into the checker at yudochat.com/youtube-comment-checker, we use YouTube API Services, without signing in to your account, to read that channel's public details, its newest public videos and their newest public comments, and we show you the counts. We keep the channel ID, the channel name and those counts for up to 30 days, to prevent abuse and to see how the tool is used; we never store comment text. To limit how often the checker can be used, we keep a one-way hash of your IP address for up to 2 days, never the address itself. If you leave your email or phone number to ask for setup help, we keep it, with the channel link you entered, until you ask us to delete it, and use it only to contact you about that setup.

5. Who we share data with

We share data only with the processors required to run the Service:

• Meta Platforms, Inc. — Instagram/Facebook API calls needed to run your automations.
• Meta Platforms, Inc. — measuring yudochat's own ads, through the app events and advertising ID described in Section 2.
• Google LLC — YouTube API calls needed to run your automations.
• Cloudflare, Inc. — website hosting, security and notify-me list storage.
• RevenueCat, Inc., Apple Inc., Google LLC — subscription management and billing.
• OpenAI, L.L.C. and Anthropic, PBC — AI features. They process (a) the prompts and content you submit in AI Studio and (b) the incoming comments and direct messages that our own screen flags as possible collaboration offers, together with the sender’s handle, so the offer can be identified for you. Nothing sent to them is used to train their models.
• Resend (Plexo, Inc.) — transactional email delivery (verification codes and account notices).
• Expo (650 Industries, Inc.) — push-notification delivery to your device.
• Jina AI GmbH — fetching the content of a URL you paste into AI Studio for repurposing.
• Infrastructure providers — servers and databases hosting the Service, bound by data-processing agreements.

We may disclose data if required by law, or in a merger/acquisition (in which case this policy continues to apply and you will be notified). No other sharing takes place.

5A. Marketplace visibility and shared data

If you use the creator directory or the campaign marketplace, some data is visible to other users by design:

• Directory profile — a creator profile you publish is visible to businesses and agencies browsing the directory. You choose what it contains and can unlist it at any time. You can also hide individual platforms, your city or your rate card, and show a follower range (for example "5K–10K") instead of your exact count.
• Post statistics — only with your consent — your measured post statistics are shown to businesses only if you switch on "Share my post stats with brands" in your profile. It is off by default. We record when you switched it on and the wording you agreed to. Switching it off removes them from your profile, the directory and campaign applications immediately. Private insights from your account (reach, views, saves, profile visits) are shown only to you, in your own Analytics screen, and never to other users. From YouTube we show only your subscriber count, never a derived metric. Disconnecting an account deletes its statistics from your profile.
• Contact reveal — when a collaboration invite is accepted, your email address is shared with the other party so you can arrange the collaboration. Only accept invites you intend to act on.
• Shared conversations and campaigns — messages, applications and campaign content you exchange with another party are visible to that party. Because they form a record of a dealing between the two of you, a copy may remain with the other party (and with us for dispute and safety purposes) even after you delete your account.
• Reports and blocks — if you report content or block a user, we retain a record of that action to keep the marketplace safe, even after your account is deleted.

6. Security

• All data in transit is encrypted with TLS.
• Platform access tokens are encrypted at rest; decryption happens server-side only.
• Passwords are stored as salted hashes and are never readable by us.
• Access to production systems is restricted and logged. Encrypted backups run nightly.

7. Retention and deletion

• Account data — kept while your account is active; deleted within 30 days of account deletion.
• Platform tokens — revoked and deleted immediately when you disconnect a platform or delete your account.
• Sign in with Apple — if you signed in with Apple, the tokens Apple issued to yudochat are revoked with Apple when you delete your account.
• Automation logs and leads — kept while your account is active so your history works; deleted within 30 days of account deletion.
• YouTube data — comment text and commenter details deleted 30 days after we receive them; everything we hold from YouTube deleted immediately when you disconnect YouTube or delete your account (see Section 4).
• Marketplace records — campaigns, applications and conversations shared with another party may be retained by that party and by us (for dispute resolution and safety) after your account is deleted, as described in Section 5A. Report and block records are retained for safety.
• Diagnostic logs — retained up to 90 days, then deleted.
• Waitlist entries — deleted on request or once launch invitations conclude.

Full step-by-step deletion instructions (in-app, per-platform, and by email) are on our data deletion page.

8. Your rights

Under India's Digital Personal Data Protection Act, 2023 (and the GDPR where it applies), you may request access to, correction of, or erasure of your personal data; withdraw consent; and nominate a representative. Write to [email protected] — we respond within 7 days and resolve verified requests within 30 days.

Grievance Officer — Mustansir, Iverton AI Pvt Ltd, [email protected]. Grievances are acknowledged within 48 hours and resolved within 15 days.

9. International transfers

Our infrastructure is primarily located in the Asia-Pacific region. Where data is processed by processors outside India (Section 5), it is protected by contractual safeguards consistent with applicable law.

10. Minimum age

You must be at least 16 years old to hold a yudochat account. We ask for your date of birth when you sign up and use it only to check that, and to meet the age-restriction requirements of the app stores we distribute through. It is never shown on your profile, never shared with brands and never sent to an AI provider. We ask once and store the date; if you entered it incorrectly, contact us.

You must also meet the minimum age of the platforms you connect (13+ everywhere, higher in some regions) and be legally able to enter a contract to hold a paid subscription. We do not knowingly collect data from anyone under 16; if you believe someone under 16 has provided us data, contact us and we will delete it.

11. Cookies and analytics

The website uses no advertising cookies and no third-party trackers. Essential infrastructure (Cloudflare) may set strictly necessary cookies for security. The Android app uses the Meta SDK only to measure our own ads, as described in Section 2. If we add privacy-preserving analytics later, this policy will be updated first.

12. Changes to this policy

We will post changes on this page and update the date above. For material changes we will notify you in the app or by email before they take effect.

13. Contact

Iverton AI Pvt Ltd — ivertonai.com
Privacy: [email protected] · Support: [email protected]