Privacy Policy

हिन्दी में पढ़ें

This policy explains what personal information we collect, why, who we share it with, and the choices and rights you have. It applies to this website, to the YOM (Your Own Metrics) service, and to our dealings with customers and prospects.

1. Who we are

YOM is run by three companies in the same group. Which one you deal with depends on where you are. For a business account, that is the country of the business's billing address.

• India: Aapastech Private Limited (CIN U72900DL2022PTC395508; registered office 8/3, 2nd Floor, Roop Nagar, Delhi 110007, India). It is the data fiduciary for your personal data under Indian law.
• European Union and United Kingdom: Aapastech OÜ (registry code 16453146, VAT EE102489493, Tornimäe tn 3 // 5 // 7, 10145 Tallinn, Estonia). It is the controller of your personal data under the GDPR and the UK GDPR.
• Everywhere else: 14818032 Canada Inc. (Burlington, Ontario, Canada). It is the controller of your personal data.

The three companies share engineering, hosting and support, and each processes personal data for the others under a written intra-group agreement. In this document “YOM”, “we” and “us” mean whichever of them you deal with.

Shikha Gupta is our Grievance Officer for India, our Privacy Officer for 14818032 Canada Inc., the person in charge of the protection of personal information for Quebec, and the privacy contact for Aapastech OÜ. Write to her at contact@aapastech.com or call +91 96677 47082 (India) or +1 437 800 0190 (Canada). How we handle complaints, and how fast, is set out on the Grievance Officer page.

2. Our two roles

• As a controller (the organisation that decides why and how information is used) for information about visitors to this website, people who contact us, and the people who hold or use YOM accounts. In India we are the data fiduciary for this information, and in the European Union and the United Kingdom Aapastech OÜ is its controller (section 15). Sections 3, 4 and 6 to 18 describe this.
• As a processor or service provider for the analytics data our customers collect about visitors to their own websites and apps (“End Users”) and send to YOM. The customer decides what is collected and why, and we process it only on the customer’s instructions under our Data Processing Addendum. Section 5 describes this. If you are an End User of one of our customers, please read that customer’s privacy notice and send requests to them; if you contact us, we will pass your request to the customer where we can identify them.

3. Website visitors and enquiries

• Contact form and emails. When you use our contact form or write to us, we collect your name, email, company (optional), the topic, your approximate event volume (optional), your message, the page you sent it from and the time. The form is handled by Tyashin, our own website platform, which stores the enquiry and notifies our team by email.
• Technical information. As with any website, our hosting provider processes your IP address, browser user agent and request details to deliver pages, protect against abuse and keep short-lived logs.
• Cookies. This website sets no cookies of its own and loads no analytics or advertising tags. Our hosts add only strictly necessary items (a Cloudflare security cookie, and session-storage keys used for error reporting). See the Cookie Policy. If we add analytics later, we will use YOM in its default cookieless mode and update that policy first.

4. Account holders

• Identity and sign-in: name, email address, a password stored only as a salted hash, whether your email is verified, multi-factor authentication settings and recovery codes (stored hashed), and your Google account identifier if you sign in with Google.
• Organisation: organisation name, plan, currency, the country inferred from your IP address at sign-up (used for currency, tax and payment-provider selection), your role, and team members you invite.
• Billing: billing contact details, invoices, tax information and payment-provider references. Card and bank details are collected by our payment providers, not by us.
• Usage and security records: when you last signed in, audit records of administrative actions (who did what, when, and from which IP address), API usage and error logs, and messages you send to support.
• Recipients you add: email addresses you enter for scheduled reports, alerts and client-portal logins. Please only add people who expect to receive them.
• Accounts a partner opens for you: if a platform you use opened a YOM account for you, it gave us your business name, the names and web addresses of your sites, and the email address of the person allowed to claim the account, so that we could create the account and let that person claim it.

5. Analytics data we process for customers

What reaches YOM depends on how each customer configures it. With the current YOM browser SDK and ingest API, by default:

• No cookies, and no persistent identifier without consent. Until an End User grants analytics consent, the SDK keeps no persistent id and writes nothing to the browser, and our servers clear any visitor or user id the browser sends. Do Not Track and Global Privacy Control are treated as a refusal by default.
• With consent, the SDK keeps a random visitor id, a 30-minute session and the consent choice in the browser’s local storage (see the Cookie Policy). A customer can also attach their own user id. If a customer turns on the optional cross-site identity feature, the SDK also stores a hash of browser characteristics, for consented End Users only, to recognise the same browser across that customer’s sites.
• Event content: the event name and parameters, the page path (query strings and fragments are removed in the browser), the referring site’s host, campaign tags, whether an ad click id was present, device type, browser and operating system (derived from the user agent, which is then discarded), and approximate location (country, region and city derived from the IP address by our hosting provider).
• IP addresses are not stored in event records. They are used in transit to derive approximate location, to protect the service, and, where a customer turns on the optional cookieless visitor hash or uses our legacy v1 endpoints, to compute a daily-rotating hashed identifier.
• Legacy v1 endpoints: they apply the same Do Not Track, Global Privacy Control, path-only URL and scrubbing rules as the current SDK. They receive no consent signal, though, so an older SDK that still uses them may keep its own visitor id in the browser. We never keep a browser fingerprint from them.
• Scrubbing: parameters that look like emails, phone numbers, names, addresses or card numbers are removed from browser events. Events a customer sends from its own servers are not scrubbed; the customer controls their content.
• Forwarding: a customer can forward events to its own destinations, such as webhooks, Meta, Google Analytics, cloud storage or a data warehouse. Forwarding to advertising platforms happens only with the End User’s explicit marketing consent and no Global Privacy Control signal. In that case, the SDK may read (never set) Meta’s own browser cookies and the Meta click id so Meta can match the conversion.

If a customer turns on YOM Intent, we also build interest profiles for that customer, from its own sites only, and send scrambled email addresses or phone numbers to the customer’s own ad accounts on its instructions. We never combine one customer’s profiles with another’s. YOM Intent is off unless a customer turns it on, and the YOM Intent Addendum sets its rules: a profile is built only with the End User’s consent to personalisation, an audience export includes only people who consented to advertising, and anyone with a Global Privacy Control signal, opt-out or withdrawal on record on any linked device is left out. Profiles are deleted after 180 days without activity by default, and never later than 13 months or the customer’s own retention period. Consent receipts (a record of what a person chose, when and on which page) are kept for the customer’s project retention period, like other events. YOM Intent is not offered to customers in the European Union or the United Kingdom, and it is not available for End Users in the European Economic Area, the United Kingdom, Switzerland or Quebec.

We use Customer Data only to provide, secure and support the service for that customer, as the DPA sets out, and to make aggregated statistics that identify no one, as section 6 of our Terms allows. We do not sell it, use it for our own advertising, or combine it across customers to profile End Users. Optional AI features for customers who enable them run on our hosting provider’s AI service using that customer’s aggregated report data; we do not send Customer Data to other AI model providers.

6. Purposes and legal bases

We use the information in sections 3 and 4 to:

• provide, secure and support the website and the service, and authenticate users (performance of a contract; legitimate interests);
• reply to enquiries and follow up on demos you request (your request; legitimate interests in growing our business);
• bill, collect payment, keep accounting and tax records (performance of a contract; legal obligation);
• send service messages such as verification, password reset, security, billing and policy notices (performance of a contract; legitimate interests);
• detect and prevent fraud, abuse and security incidents, and enforce our terms (legitimate interests; legal obligation);
• improve the service using aggregated or de-identified information (legitimate interests);
• comply with law and respond to lawful requests (legal obligation).

We send marketing email only where the law allows, including Canada’s anti-spam legislation, and every message lets you unsubscribe. We do not sell personal information or share it for cross-context behavioural advertising, and we do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

7. Who we share it with

• Service providers that host and run our systems, send our email and process payments, under contracts that limit their use of the information. They are listed on our sub-processors page.
• Destinations a customer configures, which receive that customer’s data on its instructions.
• Your organisation and its clients. Account owners and admins can see their team’s activity; people you give portal or report access can see those reports.
• Advisers and authorities, where needed to comply with law, a court order or a binding request, or to protect rights, safety and property.
• A buyer or successor in a merger, acquisition, financing or sale of assets, subject to this policy.

8. Where data is processed

Our three companies are based in India, Estonia and Canada. Aapastech Private Limited and 14818032 Canada Inc. run YOM for the whole group, so either can access personal information. Our service runs on Cloudflare’s global network, so personal information may be processed and stored in India, Canada, the European Union, the United States and other countries where our providers or their data centres operate. We do not currently offer a choice of data location or promise that data stays in any country. Data processed outside your province or country may be accessible to courts and authorities there. For data from the European Union or the United Kingdom, transfers to Canada rely on the adequacy decisions of the European Commission (for commercial organisations subject to PIPEDA) and of the United Kingdom, and transfers to India and the United States on the Standard Contractual Clauses with the UK International Data Transfer Addendum, or the Data Privacy Framework where the provider is certified (section 15). Data from Switzerland is covered by the same mechanisms as Swiss law allows, as the DPA describes. Transfers out of India are covered in section 12.

9. How long we keep it

• Enquiries and sales correspondence: up to 24 months after our last exchange, unless you become a customer.
• Account information: while the account is open, then up to 24 months after closure to handle disputes and security matters, unless you ask us to delete it sooner and no exception applies.
• Billing and tax records (invoices, payments and subscription records): kept for 8 years after the account is closed, to meet Canadian and Indian tax and accounting law, then deleted automatically.
• Audit and security records: as long as needed for security and accountability, normally no more than 24 months.
• Short-lived operational logs kept by our hosting provider: days to weeks.
• Customer Data: event records and reports follow the retention period of the customer’s plan and settings. The raw event archive is kept for the life of the project so the customer can export it. When a customer deletes a project or closes its account, its Customer Data is deleted after a 30-day grace period, and in any case within 180 days, as the DPA describes. We back up our databases daily and keep each backup for 30 days, so deleted data leaves the backups within 30 days.

We may keep information longer where the law requires it or to establish or defend legal claims. If you are in India, section 12 explains the sealed copy Indian law will require us to keep after deletion from 13 May 2027.

10. Security

We use technical and organisational safeguards appropriate to the sensitivity of the information, including encryption in transit, hashing of passwords and API keys, encryption of stored destination credentials, secret keys and multi-factor authentication secrets, role-based access, multi-factor authentication available to every account, and isolation of each customer’s data. A summary is in the DPA and on our security page. No system is perfectly secure; if a breach of security safeguards creates a real risk of significant harm, we will notify affected people and regulators as the law requires.

11. Your rights

Depending on where you live, you may have the right to: know what personal information we hold about you and get a copy; correct it; have it deleted; receive it in a portable format; withdraw consent; object to or restrict certain processing; and not be discriminated against for exercising these rights. To make a request, email contact@aapastech.com. We will verify your identity before acting, may ask for more information to do so, and will reply within the time the law allows (generally 30 days). An authorised agent may make a request for you with proof of authority. If we refuse a request, we will explain why and how to complain.

For data we process for a customer (section 5), please contact that customer. If you contact us, we will refer the request to the customer and help it respond.

12. India: the Digital Personal Data Protection Act, 2023

If you are in India, Aapastech Private Limited is the data fiduciary for the personal data in sections 3 and 4, and this section applies to you as well as the rest of this policy.

Your rights. You can ask us for a summary of the personal data we hold about you and what we do with it, ask us to correct, complete, update or delete it, withdraw any consent you gave (as easily as you gave it), and nominate someone to act for you if you die or become unable to act. Email contact@aapastech.com. We answer within one month, and never later than the law allows. We may ask you to confirm your identity, but only with information we already hold.

How long we keep data. We keep personal data while your account is active and as long as we need it for the purpose you gave it for, then delete it. Some records stay longer because the law requires it: invoices and tax records for 8 years. We are extending security log retention to 180 days across all systems by 31 December 2026, as Indian cyber security rules require. From 13 May 2027 Indian law will also require us to keep personal data, related traffic data and processing logs for one year from processing. From then, when we delete your data from our systems we will keep a sealed copy for the rest of that year, which nobody uses except to meet that legal duty, and then destroy it.

Where data goes. We use service providers in other countries, listed on our sub-processors list. Transfers out of India follow section 16 of the Digital Personal Data Protection Act, 2023; we will not transfer data to any country the Government of India restricts.

Security. We keep a documented information security programme: encryption in transit, access limited to staff who need it, logging, and incident response. If a breach affects your personal data we will tell you and the authorities as the law requires.

Complaints. Contact our Grievance Officer (see /grievance). If you are not satisfied, you can complain to the Data Protection Board of India once the relevant provisions apply.

13. Canada: PIPEDA and Quebec Law 25

If you are in Canada. 14818032 Canada Inc. is the controller. Under the Personal Information Protection and Electronic Documents Act (PIPEDA) you can ask for access to the personal information we hold about you and ask us to correct it. You can withdraw your consent at any time, subject to legal or contractual limits and reasonable notice, and we will tell you what that means for the service. You can also challenge how we comply with PIPEDA. Write to our Privacy Officer at contact@aapastech.com. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

If you are in Quebec. Quebec’s Act respecting the protection of personal information in the private sector, as amended by Law 25, gives you the same rights of access and correction. You can also ask us to stop disseminating your personal information, or to de-index a link attached to your name that gives access to it, where the law allows. You can ask to receive the computerized personal information we collected from you in a structured, commonly used technological format. If we make a decision about you based exclusively on automated processing of your personal information, we will tell you, and you can submit your observations to a member of our staff who can review the decision. You can reach the person in charge of the protection of personal information at contact@aapastech.com. You can complain to the Commission d’accès à l’information du Québec (cai.gouv.qc.ca). We assess the privacy risks before we communicate personal information outside Quebec, and you can ask us about it.

14. United States: CCPA/CPRA and other state laws

For data we process for customers, we act as a “service provider” or “processor”: we process it only for the business purposes in our contract, and we do not sell or share it (as those terms are defined in the California Consumer Privacy Act as amended by the CPRA), retain, use or disclose it outside the direct business relationship, or combine it with personal information from other sources except as the law permits. The one exception is a YOM Intent audience export: there the customer makes personal information available to us so we can send it to the customer’s own ad accounts, we act as a “third party”, and the YOM Intent Addendum holds the contract terms the CCPA regulations require.

For our own data, in the last 12 months we have collected the categories described in sections 3 and 4: identifiers (name, email, IP address), commercial information (plans and invoices), internet activity (website and service usage), approximate geolocation, and professional information (company and role). We collect them from you, your organisation, your devices and our service providers, for the purposes in section 6, and disclose them to the recipients in section 7. We do not sell or share personal information, have no actual knowledge of selling or sharing information of anyone under 16, and do not use sensitive personal information to infer characteristics. Residents of California and other states with similar laws may exercise the rights in section 11.

15. European Union, United Kingdom and Switzerland

If you are in the European Union or the United Kingdom. Aapastech OÜ is the controller. We process your account and billing data to perform our contract with you, tax records to meet legal obligations, and security logs, fraud checks and aggregate usage statistics on the basis of our legitimate interest in running a safe and reliable service; you can object to that last use at any time. We send marketing email only with your consent. You can ask for access to your data, correction, deletion, restriction, a portable copy, and you can object or withdraw consent, by emailing contact@aapastech.com. You can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee), to the authority where you live, or in the United Kingdom to the Information Commissioner’s Office (ico.org.uk). Our group companies operate the services for Aapastech OÜ: 14818032 Canada Inc. in Canada, which the European Commission and the United Kingdom recognise as giving adequate protection, and Aapastech Private Limited in India. Some of our service providers are in the United States. Transfers to India and the United States are covered by the European Commission’s Standard Contractual Clauses with the UK Addendum, or by the EU-U.S. and UK-U.S. Data Privacy Framework where the provider is certified. You can ask us for a copy.

For Customer Data, the customer is the controller and we are its processor; for customers in the European Union and the United Kingdom that processor is Aapastech OÜ, under the DPA. Aapastech OÜ is established in the European Union, so it has no separate EU representative. Its representative in the United Kingdom will be named here once appointed; until then, contact us at contact@aapastech.com.

In Switzerland, 14818032 Canada Inc. is the controller. Where Swiss law applies, our legal bases are those in section 6, you may object to processing based on our legitimate interests, and you may complain to the Federal Data Protection and Information Commissioner.

16. Children

Our website and service are for businesses and are not directed to children. We do not knowingly collect personal information from children under 16. Our customers must not use YOM on services directed to children or send us children’s information (see the Acceptable Use Policy). If you believe a child has given us personal information, contact us and we will delete it.

17. Changes

We will post changes here and update the date above. If a change is material, we will tell account owners by email or in the product before it takes effect.

18. Contact and complaints

Shikha Gupta, Grievance Officer (India), Privacy Officer (Canada) and privacy contact for Aapastech OÜ. In India: Aapastech Private Limited, registered office 8/3, 2nd Floor, Roop Nagar, Delhi 110007, India; +91 96677 47082. In the European Union and the United Kingdom: Aapastech OÜ, registry code 16453146, VAT EE102489493, Tornimäe tn 3 // 5 // 7, 10145 Tallinn, Estonia. Everywhere else: 14818032 Canada Inc., Burlington, Ontario, Canada, +1 437 800 0190. Email contact@aapastech.com. Please contact us first so we can try to resolve your concern; the Grievance Officer page explains how we handle complaints and how quickly. You keep the right to complain to the regulators named above.