Privacy Policy

This policy is published by Youda Ltd ("Youda", "we", "us"). It explains how we handle personal data in the course of providing our services to our customers.

For the personal data we process on behalf of our customers, Youda acts as a data processor. Our customers are the data controllers — they determine the purposes and means of processing their employees' data.

This relationship is formalised in a Data Processing Addendum within each customer subscription agreement, consistent with the UK GDPR and the Data Protection Act 2018. We process customer data solely on the customer's documented instructions.

• We process personal data only on the customer's written instructions, or where we are required to by law — in which case we notify the customer first, unless the law prohibits it.
• Processing is limited to the categories of data subjects and data described in the relevant subscription agreement.
• Everyone we authorise to process personal data is bound by a duty of confidentiality.

Depending on the customer's configuration, the personal data we process on a customer's behalf may include:

• Employee records, including names and contact details.
• Employment information.
• Data passed through HR and scheduling integrations connected by the customer.
• Where the customer enables it, special category and sensitive data (such as health information, ethnicity, immigration status, bank details and National Insurance numbers) processed through our backend, our Agent and our onboarding assistant.

Integrations we may receive data from

We implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. We are working towards ISO 27001 certification.

All personnel authorised to process personal data are under a binding duty of confidentiality.

• We engage sub-processors to help deliver the service.
• We maintain and publish a current list of sub-processors and notify customers of any intended changes.
• Customers have 30 days to raise an objection to a sub-processor change. If an objection cannot be resolved within that period, either party may terminate.
• Every sub-processor is engaged on terms no less protective than those in our Data Processing Addendum.

On becoming aware of a personal data breach affecting a customer's data, we notify the affected customer in writing without undue delay. Our notification includes, so far as we are able:

• The nature of the breach.
• The categories and approximate number of data subjects affected.
• The categories and approximate number of records affected.
• The likely consequences of the breach.
• The measures taken or proposed to address the breach and mitigate its effects.

We assist the customer's investigation, make relevant records, logs and files available, take prompt steps to mitigate, and bear the reasonable expenses of meeting these obligations — except where the cause of the breach is attributable to the customer.

If we receive a request from an individual relating to a customer's employee data — for example, a request to access, correct or delete data — we do not respond directly. Instead:

• We notify the relevant customer promptly so that they, as the controller, can respond.
• We do not respond to the individual without the customer's consent.
• We also promptly notify the customer of any complaint, regulator notice, or third-party claim relating to their data.

Some personal data may be transferred outside the UK and EEA — for example, to certain technology vendors based overseas. Where this happens, we rely on appropriate safeguards:

• Standard Contractual Clauses under Article 46 of the UK GDPR; or
• An adequacy decision for the destination country, where one is in place — in which case Standard Contractual Clauses are not required.

We maintain an appropriate transfer mechanism for every sub-processor located outside the UK and EEA.

On termination of a customer's subscription:

• We delete or return all personal data, at the customer's election.
• We may retain data where we are required to by applicable law.

• Customers may audit our compliance with our data protection obligations, on reasonable notice.
• Audits are limited to once per year, unless a breach has occurred.
• Where reasonable, we may satisfy an audit by providing a current third-party audit report or certification.

Our Agent relies on third-party AI providers. We reserve the right to change the underlying large language model provider(s) at any time; we will notify customers of such a change.

We may apply reasonable usage limits to prevent abuse, and may rate-limit or temporarily suspend access in cases of excessive use, assessed relative to the customer's contracted employee count.

Youda can show a person’s Google Calendar inside Youda. It reaches that calendar in one of two ways: a customer’s Google Workspace administrator grants Youda read-only calendar access for their company’s domain, or a person signs in with their own Google account and allows it. Either way, Youda asks for read-only access (calendar.events.readonly), plus the account’s email address when a person signs in themselves. Youda never creates, changes or deletes anything in Google Calendar.

• What we read. Events on the person’s main calendar from two weeks ago to four months ahead: each event’s start and end time, title, whether it shows as busy, and whether the person has declined it. We do not read event descriptions, attendee lists, attachments or meeting links, and we only read calendars of people who use Youda.
• How we use it. Only to show the person their own events in their Youda calendar, and to show them as busy, without the event title, when a colleague books a meeting with them. Event titles are shown to no one but that person.
• What we don’t do. We do not sell Google user data, use it for advertising, pass it to AI providers, or use it to train any AI model. Our staff do not read it, except with the person’s permission, to investigate a security issue, or to comply with the law. It is stored and processed only by our hosting sub-processors (section 6).
• Storage and deletion. Sign-in tokens are encrypted. Events are deleted once they are more than two weeks old. When a person disconnects, their stored events and token are deleted at once and the token is revoked with Google. When an organisation switches calendar sync off, stored events are deleted within an hour.
• Removing access. Disconnect in Youda, remove Youda at myaccount.google.com/permissions, or, for a company-wide connection, ask your Google Workspace administrator to remove Youda’s access.

Youda’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We are committed to acting ethically across our operations and supply chain.

• Modern slavery. We comply with the Modern Slavery Act 2015, conduct due diligence on our supply chain to identify and mitigate the risk of modern slavery and human trafficking, and notify customers if we become aware of any modern slavery in our supply chain.
• Anti-bribery. We comply with the Bribery Act 2010 and applicable anti-corruption laws, maintain procedures to prevent bribery and corruption, and notify customers of any breach or suspected breach.

We may update this policy from time to time. When we make material changes we will update the "last updated" date at the top of this page.