Yottar Privacy Policy

Last updated: 25 August 2026

1. Who we are

Yottar Ltd ("Yottar", "we", "us") operates the Yottar platform. We are the data controller for the personal data described in this policy.

Company number: 14941510 (England and Wales)
Registered office: 15 Victoria Road, Exmouth, EX8 1DL
ICO registration reference: ZB856480
Contact for privacy matters: info@yottar.tech

2. The personal data we collect

Account data: your name, email address, password (stored hashed, never in plain text), optional profile picture, and language and timezone preferences.
Billing data: if you subscribe, our payment provider Stripe processes your name, email address, billing address, and payment details. We never see or store your card number — we receive confirmation of payment and your subscription status.
Correspondence: emails you send us, for example support requests, and notes and transcripts of calls and meetings you have with us.
Prospective customer data: if we think Yottar could be useful to your organisation, we may hold your business contact details (name, role, work email) in our CRM, obtained from you directly, from public or professional sources, or from colleagues.
Usage data: how you use the platform, collected via analytics tools only if you consent (see Cookies below).

We do not collect any special-category (sensitive) personal data. Sites and assessments you save belong to your team and describe locations, not people.

3. Why we process it

Providing the platform — creating and operating your account, your team, and your saved sites (lawful basis: contract).
Service emails — sign-in codes, password resets, and team invitations (lawful basis: contract).
Error monitoring and security — keeping the platform working and secure via error tracking (lawful basis: legitimate interests).
Product analytics — understanding how the platform is used so we can improve it (lawful basis: consent, via the cookie banner).
Billing — invoicing and managing subscriptions through our payment provider (lawful basis: contract).
Marketing — contacting prospective customers about Yottar and sending existing users occasional product updates, always with an easy way to opt out (lawful basis: legitimate interests; consent where the law requires it).
Legal obligations — keeping records we are required to keep, such as accounting records (lawful basis: legal obligation).

4. Who we share it with

We never sell personal data. Aside from the disclosures described below, we share it only with these service providers, who process it on our behalf under data processing agreements:

Provider	Purpose	Personal data involved	Location
Render	Application and database hosting	All platform data	Frankfurt, Germany (EU)
Postmark (ActiveCampaign)	Transactional email (sign-in codes, password resets, invitations)	Name, email address	USA
Stripe	Payment processing and subscription billing	Name, email address, billing details (card details are held by Stripe, not us)	Ireland (EU) — Stripe Payments Europe Ltd
Attio	Customer relationship management (sales and marketing contacts)	Business contact details, correspondence history	UK company, data hosted in the EU
Granola (Granola Labs Ltd)	Notes and transcripts of sales and customer calls	Call participants' names and what is said on the call	UK company, data hosted in the USA
Calendly	Scheduling meetings booked from our website	Name, email address, and the details you provide when booking	USA
Google Cloud Storage	Profile picture storage	Profile pictures	Google LLC, USA
Sentry	Error monitoring	IP address, error context	EU data residency (Functional Software, Inc., USA)
Google Analytics	Usage analytics (only with your consent)	Usage and device data	Google LLC, USA
Hotjar	Usage analytics and session replay (only with your consent)	Usage and interaction data	Malta (EU)
Statsig (operated by Amplitude, Inc.)	Usage analytics and session replay (only with your consent)	Usage and interaction data, device identifier	USA
Mapbox	Map rendering	IP address	USA
Gravatar (Automattic)	Fallback profile pictures	Hashed email address	USA

Two of these operate as independent services rather than on our instructions: Mapbox receives your IP address when your browser loads maps, and Gravatar (Automattic) receives a hashed copy of your email address to generate a fallback profile picture if you have not uploaded one.

We may also disclose personal data where the law requires it (for example to regulators or law enforcement), and if Yottar is ever involved in a merger, acquisition, or sale of assets, personal data may transfer to the new owner under the same protections as this policy.

5. International transfers

Our application and database are hosted in the EU (Frankfurt). Where a provider processes personal data outside the UK, the transfer is covered by the UK's adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or by standard data protection clauses in our agreement with that provider.

6. How long we keep it

Account personal data is deleted within 90 days of your organisation's subscription ending.
Team data (including saved sites) is deleted when the team is deleted.
Correspondence is kept only as long as it's relevant to your relationship with Yottar.
Billing and accounting records are kept for as long as UK tax law requires (currently six years).
Prospective-customer contact details are kept until we conclude Yottar is not relevant to you, or you ask us to stop — every marketing email includes an opt-out.
Backups are rotated on our hosting provider's schedule, so deleted data also leaves backups within that cycle.

7. Your rights

You have the right to access, correct, delete, or receive a copy of your personal data, and to restrict or object to our processing of it. To exercise any of these rights, email info@yottar.tech.

If you are unhappy with how we handle your personal data, please complain to us at the same address — we will acknowledge your complaint within 30 days. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

8. Cookies

We set the following cookies:

Cookie	Purpose	Type
sessionid	Keeps you logged in	Essential
csrftoken	Security (request forgery protection)	Essential
messages	Temporary status notices between pages	Essential
cookie_consent	Remembers your cookie choice	Essential
_ga, _ga_*	Google Analytics	Analytics — only with consent
_hj*	Hotjar	Analytics — only with consent

Analytics cookies are set only if you accept them in the cookie banner. You can at any time.

We also use your browser's local storage (not a cookie) to remember interface preferences, such as your chosen base map. This information stays on your device. If you accept analytics, Statsig (one of our analytics providers) also uses local storage, under names beginning with statsig, for a device identifier and queued analytics events; declining or withdrawing consent removes these.

9. Changes to this policy

If we change this policy we will publish the new version here and update the date at the top. See also our Terms of Service and GDPR compliance statement.