Privacy policy

This privacy policy applies to the use of personal data when using the website ygo.ai

The basis of effective data protection is comprehensive information about the collection, processing and use of your data ("data processing").

Therefore, we would like to inform you:

• When and for which actions we process data
• Which data we process for which reasons
• Who receives data
• What rights you have regarding data processing by us.

1. Contact Information

The Data Protection Officer and controller within the meaning of the General Data Protection Regulation (GDPR) is:

YGO GmbH
Managing Director: Julian Kögel
Möbelhof 5
14478 Potsdam
Germany

Email: privacy@ygo.ai

2. General Information on Data Processing

2.1 Scope of Processing Personal Data

There is no obligation to provide data, but using this website and our demo form requires the processing of various information. As a user of our digital services, you are not subject to automated decision-making within the meaning of Art. 22 GDPR. We do not conduct profiling activities.

The following personal data may be processed through the digital services:

• Data you enter in our demo form: name, work email, company, company website, number of hotels you sell, hotels you would like to see enriched and how you heard about us
• Contact details you send us by email, such as first name, last name, company and phone number
• Connection data and device information:
  • IP address, date, time of request
  • Time zone difference to GMT, content of the request (specific page), amount of data transferred
  • Operating system and its interface
  • Access status / http status code, browser, language and version of browser software
  • Requesting website

2.2 Purposes of Processing

Personal data is processed for the following purposes with their respective legal bases:

• Pre-contractual measures (Art. 6 Para. 1 lit. b GDPR): To process your demo request and prepare and hold the demo you asked for.
• Contract fulfillment (Art. 6 Para. 1 lit. b GDPR): Provision of customer services, such as processing questions and comments.
• Legitimate interest (Art. 6 Para. 1 lit. f GDPR): Provision of information via email or other forms of electronic notification regarding product usage, requests, technical and other notices about security, privacy and administrative issues related to the use of the services. Our legitimate interest lies in maintaining service quality and security.
• Legitimate interest (Art. 6 Para. 1 lit. f GDPR): To optimally adapt the product to customer needs. Our legitimate interest is improving our services.
• Legitimate interest (Art. 6 Para. 1 lit. f GDPR): Creation of anonymized datasets from personal data to improve services.
• Legal obligation and legitimate interest (Art. 6 Para. 1 lit. c and f GDPR): For protection against fraudulent, unauthorized, unlawful actions, and for the detection and prevention of fraud.

2.3 Recipients of Data

We only pass on your data to third parties if this is legally permissible and necessary for the processing of contractual relationships with you. Categories of recipients may include:

• Hosting provider: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, which hosts this website and processes the connection data listed above
• Email delivery provider: Twilio Inc. (SendGrid), 101 Spear Street, San Francisco, CA 94105, USA, which delivers your demo request to our sales team by email
• Analytics provider: PostHog Inc., USA, which provides our web analytics; our analytics data is stored in PostHog's EU cloud in Frankfurt, Germany (see 3.7)
• IT service providers for maintenance and support
• Legal, tax and business consultants (in case of legal obligations)
• Government authorities (in case of legal obligations)

2.4 Data Retention and Deletion Periods

We delete personal data as soon as the legal basis for its processing no longer applies, unless there is an obligation to continue storing the data to fulfill a legal retention obligation. Specifically:

• Contract data: 6 years after contract termination (according to § 257 HGB)
• Tax-relevant data: 10 years (according to § 147 AO)
• Server log files: Automatically deleted after 30 days
• Contact form inquiries: Deleted after 6 months if no contract is concluded
• Session recordings of this website (only with your consent): Automatically deleted after 30 days

3. Website Usage and Cookies

3.1 SSL/TLS Encryption

This website uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content. You can recognize an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line.

3.2 Server Log Files

The provider of the pages automatically collects and stores information in server log files that your browser automatically transmits to us. These are:

• Browser type and browser version
• Operating system used
• Referrer URL
• Host name of the accessing computer
• Time of the server request
• IP address (anonymized after 7 days)

This data is processed on the basis of Art. 6 Para. 1 lit. f GDPR. Our legitimate interest lies in the technically error-free presentation and optimization of our website.

3.3 Cookies and Local Storage

Our website stores information on your device only where this is technically necessary, or after you have selected "Accept all" in the cookie banner. Specifically:

• ygo-consent (local storage, technically necessary): Stores your choice in the cookie banner ("Necessary only" or "Accept all") so the banner does not appear again. This entry stays until you delete your browser data.
• Cookies and local storage entries beginning with "ph_" (PostHog, only with your consent): Set only after you select "Accept all". They contain a random identifier that lets us recognize your browser on later visits, and information about the current visit. They are stored for up to 12 months.

The legal basis for the technically necessary entry is § 25 Para. 2 No. 2 TDDDG and Art. 6 Para. 1 lit. f GDPR. Our legitimate interest lies in providing a functional website that remembers your cookie choice. The legal basis for the PostHog entries is your consent according to § 25 Para. 1 TDDDG and Art. 6 Para. 1 lit. a GDPR. You can change your choice and withdraw your consent at any time with effect for the future by deleting the cookies and site data for ygo.ai in your browser; the cookie banner will then appear again. You can also configure your browser to inform you about the setting of cookies and only allow cookies in individual cases.

3.4 Contact Forms and Email Contact

If you contact us via our demo form or by email, the data you provide will be stored for processing your inquiry and in case of follow-up questions. The demo form sends your entries by email to our sales team via our email delivery provider (see 2.3). The legal basis is Art. 6 Para. 1 lit. b GDPR (contract initiation) or Art. 6 Para. 1 lit. f GDPR (legitimate interest in customer communication). The contents of the demo form are never passed to our web analytics.

3.5 Job Applications

Our open positions are published via the applicant tracking system of Ashby Inc., USA. When you open a job posting or apply, you are taken to jobs.ashbyhq.com, where Ashby's privacy policy applies. The job list on our Careers page is loaded from Ashby by our server; no personal data of yours is sent to Ashby when you view it.

3.6 Fonts

The fonts on this website are hosted on our own server. No connection to external font providers such as Google Fonts is made.

3.7 Web Analytics with PostHog

To understand how our website is used and to improve it, we use PostHog, a product analytics service of PostHog Inc., USA. Our PostHog data is stored in PostHog's EU cloud in Frankfurt, Germany. The website sends analytics data through its own address (ygo.ai), which forwards it to PostHog.

Without your consent (before you choose in the cookie banner, or if you select "Necessary only"), PostHog runs in cookieless mode: nothing is stored on your device. We collect the pages you visit and how long you stay, the referring website and campaign parameters in the link, browser, operating system, device type, screen size and language, clicks and how far you scroll, page loading times, technical errors, and whether you use the demo booking buttons and form. To count visitors without a cookie, PostHog calculates a pseudonymous identifier on its servers from your IP address, browser information and a value that changes every day, so you cannot be recognized from one day to the next. Your IP address is then discarded; it is not stored and no location is derived from it. The legal basis is Art. 6 Para. 1 lit. f GDPR. Our legitimate interest lies in understanding the use of our website in aggregated form in order to improve its content and usability. You can object to this processing at any time (see 6).

With your consent ("Accept all"), PostHog additionally stores a random identifier on your device (see 3.3), so that later visits from the same browser can be recognized, and records your visit as a session recording of page views, mouse movements, clicks and scrolling. Everything you type into forms is masked in recordings and never transmitted. Your IP address is used to determine an approximate location (country, region and city) and is then discarded; it is not stored. The legal basis is your consent according to Art. 6 Para. 1 lit. a GDPR and § 25 Para. 1 TDDDG. You can withdraw your consent at any time as described in 3.3.

Session recordings are deleted automatically after 30 days. Other analytics data is deleted as soon as it is no longer needed to evaluate the use of our website.

4. Technical and Organizational Measures

We implement appropriate technical and organizational measures according to Art. 32 GDPR to ensure a level of protection appropriate to the risk. These include:

• Encryption of data transmission (SSL/TLS)
• Regular security updates and patches
• Access controls and authentication systems
• Regular data backups
• Employee training on data protection
• Confidentiality agreements with employees and service providers
• Physical security measures for servers
• Logging and monitoring of data access

5. Processing of Minors' Data

Our services are not directed at children under 16 years of age. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that information as soon as possible.

6. Right to Object and Revocation

To the extent that data processing is based on your consent or our legitimate interest, you have the right to object to the processing or revoke your given consent at any time. Your objection or revocation only has effect for the future. You can contact privacy@ygo.ai at any time to exercise your right of objection or revocation. If you object to processing based on our legitimate interest, we may still continue processing if we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or if the processing serves to establish, exercise or defend legal claims.

7. Rights of Data Subjects

To the extent that data relating to you is processed, you have the following rights as a data subject regarding this data. To exercise these rights, you can contact us using the contact details provided above.

Right to Information according to Art. 15 GDPR

You have a right to information about your personal data processed by us. This includes the mandatory information presented in Art. 15 GDPR.

Right to Rectification according to Art. 16 GDPR

You have the right to immediate correction of incorrect and completion of incomplete personal data.

Right to Erasure according to Art. 17 GDPR

You have the right to request the deletion of your personal data if one of the reasons listed in Art. 17 GDPR applies, in particular if there is no longer a legal basis for the processing.

Right to Restriction of Processing according to Art. 18 GDPR

You have the right to request the restriction of processing of your personal data if one of the reasons listed in Art. 18 GDPR applies, in particular at your request instead of deletion of the data.

Right to Data Portability according to Art. 20 GDPR

You have the right to request all personal data stored about you with us in a structured, commonly used and machine-readable format and to transmit this data to another controller without hindrance from the controller to whom the personal data has been provided.

Right to Lodge a Complaint with the Competent Supervisory Authority, Art. 77 GDPR

According to Art. 77 GDPR, you have the right to lodge a complaint with the supervisory authority responsible for you. The competent supervisory authority for YGO GmbH is:

Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg
Stahnsdorfer Damm 77
14532 Kleinmachnow
Germany
Telephone: +49 (0)33203 356-0
Email: poststelle@lda.brandenburg.de

8. Data Transfer to Third Countries

Data transfer to third countries only takes place if you have given your express consent (Art. 6 Para. 1 lit. a GDPR), to fulfill contractual obligations (Art. 6 Para. 1 lit. b GDPR), due to a legal obligation (Art. 6 Para. 1 lit. c GDPR) or based on our legitimate interests (Art. 6 Para. 1 lit. f GDPR).

In addition, we only have your data processed in a third country if the special requirements of Art. 44 ff. GDPR are met. We use the Standard Contractual Clauses (SCC) of the European Commission as adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

Our hosting provider Vercel Inc., our email delivery provider Twilio Inc. (SendGrid) and our analytics provider PostHog Inc. are based in the USA. Data processed by them may therefore be transferred to the USA. Vercel Inc. and Twilio Inc. are certified under the EU-U.S. Data Privacy Framework. Our PostHog data is stored in the EU (Frankfurt, Germany); access from the USA cannot be ruled out.

9. Data Breach Notification

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay in accordance with Art. 34 GDPR, unless an exception applies.

10. Changes to this Privacy Policy

We reserve the right to adapt this privacy policy to ensure it always complies with current legal requirements or to implement changes to our services in the privacy policy. The new privacy policy will then apply to your next visit.

Status: 20.10.2026