Privacy Policy
In short
- We collect only what we need to run Yemoko: no advertising trackers, no third-party analytics.
- Your clients’, vendors’ and employees’ data belongs to your business; we process it only on your instructions.
- Data is stored in the United States (Oregon), protected by encryption and per-company isolation.
- We share data only with the providers that run the service and the payment providers you choose.
- You can access, correct, export or delete your data by emailing support@yemoko.com.
This summary helps you find your way; the full text below is what applies.
This policy explains how Yemoko LLC collects, uses and protects personal data when you use yemoko.com and the Yemoko app.
1. Who we are and what this policy covers
Yemoko LLC ("Yemoko", "we") is a limited liability company in Texas, USA. For privacy questions, write to support@yemoko.com.
When we are the controller. We decide how to use the personal data of people who visit yemoko.com, sign up, use the app or contact us. This policy covers that data.
When we are the processor. Businesses use Yemoko to keep their books, send invoices, take payments and run payroll. The personal data in those records belongs to the business (our customer): its clients, vendors, employees and contractors. We process it only on the customer's instructions, under our Data Processing Agreement. If you are one of those people, for example you received an invoice or a pay stub through Yemoko, the business that sent it is responsible for your data. Please contact that business first; we will help it answer you.
2. What we collect
We collect only what we need to run Yemoko. We do not use advertising trackers or third-party analytics.
| Category | What it includes | Where it comes from |
|---|---|---|
| Account | Name, email address, password (stored only as a salted bcrypt hash), role, language | You, when you sign up or are invited |
| Sign-in and security | Email-verification and password-reset codes, two-factor settings and recovery codes, session records, IP address, audit log of sensitive actions | Created when you use the app |
| Company profile | Company name, address, phone, website, tax ID, logo; for a sole trader, these may identify you personally | The company owner or admins |
| Yemoko subscription | Plan, billing interval, billing email, Stripe customer and subscription IDs, payment status. Card numbers go to Stripe, never to us | You and Stripe |
| Payment-provider accounts | Whether your Stripe, Flutterwave or CinetPay merchant account is connected and able to accept payments | You and those providers |
| Bank connections | Linked account names, masked numbers, balances and transactions. Bank sign-in details go to Plaid or Stripe, never to us | Plaid or Stripe, after you link a bank |
| Support and communications | Support requests, and a record of the emails Yemoko sends (recipient, type, delivery status) | You, and our email provider Brevo |
| Technical logs | IP address, browser type, page requested, time and errors, kept by our hosting providers to run and secure the service | Your browser |
3. How we use it and our legal bases
Where a law such as the EU or UK GDPR, Nigeria's Data Protection Act or South Africa's POPIA asks for a legal basis, these are ours.
| Purpose | Legal basis |
|---|---|
| Create and run your account and company, and provide the features you use | Performance of our contract with you |
| Bill your subscription and process plan changes and cancellations | Performance of contract |
| Secure the service: verify email addresses, two-factor sign-in, detect fraud and abuse, keep audit logs | Legitimate interest in keeping Yemoko and your data safe; legal obligation where security is required by law |
| Send service emails: verification codes, invitations, receipts, security alerts, changes to our terms | Performance of contract; legal obligation for required notices |
| Answer support requests | Performance of contract; legitimate interest |
| Improve Yemoko using aggregated, de-identified usage figures | Legitimate interest |
| Keep tax and accounting records of our own sales; respond to lawful requests from authorities | Legal obligation |
| Product news by email, if you opt in | Consent, which you can withdraw at any time |
We do not sell personal data, use it for targeted advertising, or make decisions about you based solely on automated processing that have legal or similarly significant effects.
4. Who we share it with
We share personal data only with the people and companies below, and only as much as each needs.
- Our service providers (subprocessors). Supabase (database and storage), Vercel (hosting), Brevo (email), Anthropic (AI drafting of payment reminders), and, when you enable them, TaxJar and vatlayer. They may use the data only to provide their service to us. The current list, with what each receives and where, is our Subprocessor List.
- Payment and banking providers you choose to use. Stripe (subscriptions, card payments, bank linking), Flutterwave and CinetPay (mobile money, cards and bank transfers in Africa) and Plaid (bank linking). When you open a merchant account or link a bank with them, they also act on their own account, for example to verify identity and prevent fraud, under their own privacy policies.
- Other users in your company. People in the same Yemoko company can see your name, email, role and the actions you take there, according to their role.
- Authorities and legal claims. We disclose data when the law, a court order or a valid request from a public authority requires it, or to protect the rights, safety and property of Yemoko, our customers or others. Where allowed, we tell the affected customer first.
- A buyer of our business. If Yemoko LLC is merged, acquired or sells its assets, personal data may transfer to the new owner, who must keep honoring this policy. We will notify you beforehand.
We never sell or rent personal data.
5. International transfers
Yemoko's database and files are stored in the United States (Oregon), and the app runs in the United States. Some providers process data elsewhere: Brevo in the EU, Flutterwave and CinetPay in the African countries where they operate, and Stripe worldwide.
When personal data leaves a country whose law restricts transfers (for example the EEA, the UK, Nigeria, Kenya, South Africa, Cameroon or the Democratic Republic of the Congo), we rely on the safeguards that law recognizes. These include the European Commission's Standard Contractual Clauses (with the UK Addendum for UK data), the equivalent clauses in our providers' data-processing terms, and, where a law allows it, the transfer being necessary to provide the service you asked for. You can ask us for a copy of the relevant safeguards at support@yemoko.com.
6. How long we keep it
| Data | How long |
|---|---|
| Your user account | Until you or your company owner deletes it |
| A company's data, after the subscription is cancelled | 12 months, then deleted after 30 days' notice to the owner |
| A company the owner asks us to delete | 30 days (the owner can still cancel the request), then permanently deleted |
| Email-verification, password-reset and two-factor codes | Until used or expired |
| Audit log and record of emails sent | As long as the company exists, so its owner can review activity |
| Company activity log (who created, changed, deleted or sent what, shown to owners and admins) | 7 days, or less if an owner or admin clears it |
| Records of our own sales to you (invoices, payments) | As long as tax and accounting law requires, typically up to 7 years |
| Technical logs at our hosting providers | A short period set by those providers |
We may keep data longer when the law requires it or to establish or defend legal claims, and only for that purpose.
7. Security
We protect personal data with technical and organizational measures suited to financial records, including:
- encryption in transit (HTTPS) and at rest, by our database and storage provider;
- separation of every company's data at the database level (row-level security), with automated tests that try to cross between companies;
- passwords stored only as salted bcrypt hashes; email verification; optional two-factor sign-in (authenticator app) with single-use recovery codes;
- extra encryption (AES-256-GCM) for Social Security numbers and tax IDs, two-factor secrets and bank-connection tokens;
- card, mobile-money and bank sign-in details handled only by Stripe, Flutterwave, CinetPay and Plaid, never by Yemoko;
- role-based permissions inside each company, and a log of sensitive actions.
No system is perfectly secure. If a breach affects your personal data, we will notify you and the authorities as the law requires.
8. Your rights
Wherever you live, you can ask us to:
- access the personal data we hold about you and get a copy;
- correct data that is wrong or incomplete;
- delete your data, unless we must keep it by law;
- export it in a common machine-readable format;
- object to, or ask us to restrict, processing based on our legitimate interests;
- withdraw consent where we rely on it, such as product-news emails.
How to ask. Email support@yemoko.com from the address on your account. We may need to confirm your identity. We answer within 30 days, or sooner where your law sets a shorter deadline, and we do not charge for reasonable requests. If your data sits in a business's records (section 1), we pass your request to that business and help it respond.
Complaints. You can also complain to your data-protection authority, for example a supervisory authority in the EU, the UK Information Commissioner's Office, the Nigeria Data Protection Commission, Kenya's Office of the Data Protection Commissioner, South Africa's Information Regulator, Ghana's Data Protection Commission, Côte d'Ivoire's ARTCI, Senegal's CDP, Cameroon's Personal Data Protection Authority (APDP), or the authority in charge under the Democratic Republic of the Congo's Digital Code (currently ARPTC, until the Data Protection Authority is set up).
US state privacy laws. Residents of US states with consumer privacy laws, such as California, have the rights those laws give, including to know, delete and correct personal data and not to be discriminated against for using them. We do not sell or share personal data for cross-context behavioral advertising.
9. Cookies and browser storage
Yemoko uses only what it needs to work; there are no advertising or analytics cookies, so we do not show a cookie banner.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| Supabase sign-in cookies (sb-…-auth-token) | Cookie, strictly necessary | Keep you signed in securely | Your sign-in session |
| yemoko_active_org_id, yemoko_authenticated, yemoko_user_profile | Browser storage, necessary | Remember which company you are working in, your sign-in state and your name for display | Until you sign out or clear your browser |
| yemoko_language, yemoko_currency, dashboard view settings | Browser storage, preferences | Remember your language, currency and dashboard choices | Until you clear your browser |
| Session flags (role, sidebar position) | Session storage | Show the right menus during your visit | Until you close the tab |
Payment pages from Stripe, Flutterwave or CinetPay, and Plaid's bank-linking window, set their own cookies under their own policies.
10. AI features, children, changes and contact
AI features. When a user asks Yemoko to draft a payment reminder, we send Anthropic only the facts of that one overdue invoice: the client's name, the company's name, the invoice number, the amount due and the days overdue. The draft comes back to the user to review; nothing is sent automatically. Neither Yemoko nor Anthropic uses this data to train AI models.
Children. Yemoko is a business service for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.
Changes. We will post any update here with a new effective date. For a material change, we will email account owners and show a notice in the app at least 30 days beforehand.
Contact. Yemoko LLC, Texas, USA · support@yemoko.com