Privacy Policy
Last updated: 24 October 2026 · Applies to getyasi.com, app.getyasi.com, api.getyasi.com and the Yasi mobile apps.
Yasi is operated by yasi as, org. no. 938 261 350, Hjalmar Johansens gate 314, 9007 Tromsø, Norway. This policy explains what personal data we handle, why, and the rights you have under the EU/EEA General Data Protection Regulation (GDPR). Privacy contact: privacy@getyasi.com.
1. Two roles
Yasi is software for restaurants and other hospitality venues. Most personal data in Yasi — reservations, guest profiles, orders, chat messages, staff schedules and hours — is entered by or for the venue you deal with. For that data the venue is the controller and yasi as is the processor, acting only on the venue's instructions under a Data Processing Agreement. If you are a guest or employee of a venue, contact the venue first about your data; we help the venue answer. For our own website visitors, our business customers' accounts, billing, support and security, yasi as is the controller, and this policy explains that processing.
2. Data we process as controller
| Who | Data | Purpose | Legal basis (GDPR art. 6) | Kept |
|---|---|---|---|---|
| Venue owners and dashboard users | Name, email, sign-in credentials (via Clerk), role and permissions, activity log | Provide and secure the account, support, invoicing | Contract (1b); legitimate interest in security (1f) | Account lifetime + 90 days; invoices 5 years (bookkeeping law) |
| Website visitors (getyasi.com) | Technical server logs (IP, browser, time); cookieless page-view statistics (page, referrer, country and city, device type — no IP stored, no cookies, no cross-site identifier); country code of a chat with the Yasi assistant; demo-request form details; advertising measurement by Google Ads (cookies only if you accept them) | Run and secure the site; answer your request; see whether our ads work | Legitimate interest (1f); consent for the form and for advertising cookies (1a) | Logs 30 days; requests 12 months |
| People who email us | Your email and its content | Reply and keep a record | Legitimate interest (1f) | 24 months |
| Mobile app users | Push-notification token for your device | Deliver alerts you switched on | Consent (1a), withdraw in device settings | Until sign-out or the token stops working |
3. Data we process for venues (as processor)
Guests: name, contact details, party size, date and time, notes and dietary information the guest volunteers, visit and order history, messages to the venue's AI concierge or WhatsApp number, marketing consent status. Employees: name, contact details, role, schedules, clock-in and clock-out times, pay rate (visible to authorised managers only), team messages, documents shared by the venue, compliance logs. The venue decides why and how long; its own privacy notice applies. We keep this data while the venue's account is active and delete it within 90 days after the account ends, except what Norwegian law requires the venue to keep (for example sales records, five years).
Guest payments. Where a venue asks for a card to secure a booking, a prepayment, or a fee for a no-show or late cancellation, you pay on a page hosted by Stripe. Yasi never sees or stores card numbers; we keep a Stripe reference, the amount and the outcome so the venue and you can see what happened. A card saved to secure a booking is released at Stripe once the visit is over, normally within a week of the booking date. Prepayments and fees go to the venue's own Stripe account where it has one; otherwise Yasi collects the fee on the venue's behalf and passes it on.
Booking messages. Confirmations, reminders and cancellations go out by email and, where the venue has switched them on and you gave a mobile number, by SMS (through Twilio) or WhatsApp (through Meta's WhatsApp Business Platform). Messages about your own booking need no consent; every marketing message has an unsubscribe link. Venues can base their own notice on our guest privacy notice template.
4. AI features
Venues can turn on an AI concierge that answers guests and takes bookings, and AI tools that draft messages, plan shifts and analyse reviews. Text you send to a venue's concierge is sent to our AI provider (OpenAI) to generate a reply. Our agreement forbids the provider from training models on that data. Yasi's own internal tools, used by Yasi staff and never by guests or venues, use Anthropic's Claude under the same no-training terms. AI output is generated automatically and may be inaccurate; the venue is responsible for what it sends you.
5. Where data is stored and who helps us
Your data is stored in the EU (Frankfurt, Germany), with an encrypted nightly backup copy in Paris, France. We use a small number of suppliers for hosting, authentication, email, SMS and WhatsApp, payments, push notifications, error monitoring, backups and AI, listed with locations at getyasi.com/sub-processors. Suppliers in the USA are covered by the EU–US Data Privacy Framework or Standard Contractual Clauses. We do not share personal data with anyone else, except when the law requires it or to protect the rights and safety of Yasi, our customers or others.
6. Security
All traffic is encrypted (TLS); data is encrypted at rest; every record is tied to one venue and access is checked on every request; venue sign-in uses a dedicated identity provider; staff and devices use signed, revocable codes; the platform is monitored and has been independently audited (most recently October 2026); error reports are stripped of personal data before they leave the platform. No system is perfectly secure; tell us at privacy@getyasi.com if you believe your data is at risk.
7. Your rights
Under GDPR you can ask to see the data we hold about you, correct it, delete it, restrict or object to processing, and receive a copy in a portable format. Where we are processor, we will pass your request to the venue and help it respond. To exercise a right, email privacy@getyasi.com from the address we hold, or use the delete-my-data instructions below; we answer within 30 days. You may complain to Datatilsynet (datatilsynet.no) or your local authority.
8. Deleting your data (Yasi apps and platform)
This applies to all Yasi mobile apps and the Yasi platform (Yasi Staff, Yasi Reservations, Yasi POS, Yasi Kitchen, app.getyasi.com). Venue owners: delete users from Settings → Users; to close the whole venue account, email support@getyasi.com from the owner address and we delete it within 90 days. Staff: ask your venue to remove you; your profile is deactivated at once and personal data not under legal retention is deleted. Guests: ask the venue, or email privacy@getyasi.com with the venue name and the email or phone you booked with.
9. Children
Yasi is a business tool for adults; venue accounts are for people 18 or over. Guests under 16 should book through a parent or guardian.
10. Changes
We update this policy when the service or the law changes and post the new date at the top. Material changes are announced to venue accounts by email or in the dashboard.