yaee privacy policy

1. What this covers

yaee is software that churches use to care for their small groups, members and visitors. This policy covers the app at app.yaee.app and at church addresses (name.yaee.app), and the website yaee.app.

2. Who is responsible

There are two roles at yaee.

• Your church is the controller of the data it keeps about you in yaee: your profile in the church, your groups, attendance, care notes and the requests you send through its forms. It decides what it uses this data for and has its own privacy policy. yaee shows the link to it on the church's public forms and accepts no requests through them until the church has added that link.
• yaee processes this data on your church's behalf and only for its purposes (processor). Questions about this data are best sent to your church. If they reach us, we pass them on.
• yaee is itself the controller of your user account and sign-in, of church registration, of the website yaee.app and of the waitlist.

Controller: NOEVU DIGITAL LTDA, CNPJ 62.891.268/0001-18, Rua General Rondon, 203, Casa 01, São Francisco, Niterói – RJ, 24360-100, Brazil
Representative in Switzerland (Art. 14 Swiss FADP): Noevu GmbH, Zürichstrasse 131, 8600 Dübendorf, Switzerland
Privacy contact: privacy@yaee.app
Data protection officer (Encarregado): Noël Bossart, privacy@yaee.app

3. Data yaee is responsible for

3.1 Visiting yaee.app

The website sets no cookies and uses no analytics or advertising services. Fonts are served from our own server. When you visit, our hosting provider Vercel processes the connection data it needs, including your IP address, and writes server logs. The website loads the Alpine.js library from jsDelivr, which receives your IP address. Links to book a call lead to cal.com; whatever you enter there is processed by cal.com.

3.2 Waitlist

When you join the waitlist, we store your first name, your church's name, your email, phone number, country, the number of small groups if you give it, and the page language. We use this to contact you about a conversation and access to yaee.

The data is stored in yaee's database in Frankfurt and sent by email to the yaee team. Resend delivers the email; the inbox is hosted by Google. We keep it until you ask us to delete it.

3.3 Registering a church

Whoever registers a church provides an email address, the church's name, a phone number with country, and a language. To block automated sign-ups, Cloudflare Turnstile checks the browser and receives your IP address. We also store a hash of the IP address to limit abuse.

3.4 User account and sign-in

For your account we store your email, name, phone number as sign-in identifier, language and, if you add one, a profile photo. Members sign in with a one-time code sent by email and valid for five minutes; administrators sign in with a password. We store codes, passwords and sessions only as hashes. Each time a code is requested we store a hash of your IP address to limit abuse.

Profile photos are kept in an image store from which anyone who has the link can open them. The link contains a random part. On upload we remove metadata such as where the photo was taken.

3.5 Legal bases

• Waitlist: your request, i.e. steps before a possible contract (LGPD Art. 7 V; GDPR Art. 6(1)(b)).
• Registering a church, user account and sign-in: the contract for using yaee (LGPD Art. 7 V; GDPR Art. 6(1)(b)).
• Visiting the website, protection against automated sign-ups and the IP address hash: our legitimate interest in running yaee securely and preventing abuse (LGPD Art. 7 IX; GDPR Art. 6(1)(f)).
• Switzerland: the Swiss Federal Act on Data Protection (FADP) requires no separate legal basis for this processing as long as it follows the Act's principles (Art. 6 and 30 FADP).

4. Data yaee processes on your church's behalf

Your church decides which of this data it uses, on what legal basis, and who in the church sees what. Its policy describes this.

• Personal details: first and last name, date of birth, gender, life stage, neighbourhood, phone, email, WhatsApp number and extra fields the church defines.
• Groups and roles: memberships, leadership roles, who cares for whom.
• Attendance: present, absent with notice, or absent without notice.
• Care: contacts, leaders' notes and the steps of a request to join a group.
• Requests through public forms (visit, join a group, interest in a group): name, WhatsApp number, phone, email, neighbourhood, in a second step date of birth and gender, and answers to the church's forms.
• Consents: for what, when, which text version, and when you withdrew them.
• Device notifications, if your church turns them on and you agree: your browser's delivery address, keys and a device label such as "iPhone · Safari".
• Change log: who changed which record and when, without its content.

5. Service providers

WhatsApp: yaee only creates links. Meta receives nothing until you tap such a link and open WhatsApp.

6. International transfers

Some providers store or process data abroad: seen from Brazil, in Germany, Ireland and the USA; seen from the EU and Switzerland, in the USA (see the table). We base these transfers on the safeguards that the LGPD (Art. 33), the GDPR (Art. 44–49) and the FADP (Art. 16) provide for them.

7. Cookies

The website sets no cookies. The app sets only the cookies it needs to work, none for analytics or advertising:

8. How long we keep data

• If you withdraw consent in your profile: your profile disappears at once, your group memberships and leadership roles end, and you can no longer sign in to that church. Within a set period your church can restore your profile at your request. After that, yaee permanently deletes your data at that church, including contacts, groups, attendance, notes and form answers. Each church sets the period, between 30 and 365 days; the default is 30.
• Your account is anonymised after the period: email, name, phone number and the reference to your photo are removed, provided you no longer belong to another church.
• What remains: the record that and when you consented and withdrew, no longer linked to the deleted person, and the change log, which holds only ID numbers. Both prove that the deletion took place.
• People added by a church who never confirmed their profile: deleted 180 days after being added, unless the church sets a different period.
• Sign-in codes and sessions: deleted after 30 days.
• Device notifications: deleted once your account is deactivated or you no longer belong to any church.
• Waitlist and church registration: until you ask us to delete them.

9. Your rights

Depending on where you live, you have the rights under the LGPD, the GDPR or the Swiss FADP:

• Brazil (LGPD Art. 18): confirmation and access, correction, anonymisation, blocking or deletion of unnecessary or unlawfully processed data, portability, information on who we share data with, and withdrawal of consent with deletion of the data based on it. Complaint to the ANPD (Autoridade Nacional de Proteção de Dados).
• European Union (GDPR Art. 15–21): access, rectification, erasure, restriction of processing, portability, objection to processing based on legitimate interest, and withdrawal of consent for the future (Art. 7(3)). Complaint to the supervisory authority where you live, where you work or where the infringement took place (Art. 77).
• Switzerland (FADP Art. 25, 28 and 32): access, handover or transfer of your data, correction, deletion and objection to processing. Report to the Federal Data Protection and Information Commissioner (FDPIC).

In the app you change your name, date of birth, gender and photo yourself. To delete your data at a church, withdraw consent in your profile; if you are the last person with an admin role, hand that role on first. For anything else, such as a new email address or a copy of your data, write to your church or to privacy@yaee.app. We put the copy together by hand.

10. Security

We store codes, passwords and sessions only as hashes. Each church sees only its own data; this is set in the app's access rules and was attacked and confirmed in an independent review. We store photos without metadata.

11. Changes

If the way yaee processes data changes, we update this policy and the date above.