Privacy Policy

Last updated: 20 October 2026

This policy explains what personal data Yotei collects, why, who receives it, how long we keep it, and the choices and rights you have. It is written to meet the EU General Data Protection Regulation (GDPR) and the personal data protection laws of other countries where Yotei is used.

The controller is KD Digital, Salomonszegel 57, 7322 ER Apeldoorn, the Netherlands (Chamber of Commerce number 42190103, VAT number NL004770008B67). Privacy contact (and data protection officer, if one is required): privacy@yotei.win

1. What we collect

• Account data: your email address, your name if you give one, and a password stored only as a salted hash.
• Screenshots you capture: only the area you select, which may contain personal data about you or other people (for example names, places or meeting details). We use it only to find the event.
• Text extracted from a screenshot and the event proposals made from it, shown to you for review.
• Events you confirm: title, date, time, time zone, location, notes and people, plus whether and where they were written to your calendar.
• Calendar connection data: when you connect a calendar we store the access token the provider gives us (encrypted), or for CalDAV the server address, username and app password you enter (encrypted). We do not read your other events.
• Billing data: subscription status and identifiers from our payment provider Paddle. We never see or store your card details.
• Technical and security data: IP address, device and request details in server logs and sign-in records, error reports, and an activity log of account actions, used to run and protect the Service.
• Usage counters: how many automatic readings you used, to apply free limits and prevent abuse.
• Your consent record: when you agreed to automatic reading of screenshots and to which wording.

We do not collect sensitive categories of data on purpose. A screenshot could contain such data by chance; please do not capture it.

2. Why we use it, and on what legal basis

• Providing the Service you asked for (contract): account, events, calendar writing.
• Sending your selected screenshots to an AI service, which may be outside your country (your explicit consent, see section 3).
• Security, abuse prevention and fixing problems (legitimate interests).
• Taking payments and meeting tax and accounting duties through Paddle (contract, legal obligation).
• Emails about your account, such as verification and password reset (contract).

We do not sell personal data and we do not use your screenshots for advertising or to train AI models.

3. Your consent to AI reading, and how to withdraw it

Before your first capture, Yotei asks you to agree to your selected screenshot areas being sent to an AI service to find the event in them, and tells you that this service and our servers may be outside your country. Nothing is captured or sent until you agree. We record when you agreed and to which wording, and we ask again if the wording changes materially.

You can withdraw consent at any time in the app under Settings, "Stop automatic reading", or by email. Withdrawing is as easy as agreeing, takes effect immediately, and does not affect processing done before. Without consent you can still enter events by hand.

4. AI processing of screenshots

To read a screenshot we send the image to an AI model provider through an AI gateway and receive proposed event details back. This is the only purpose. We ask the gateway to use only providers that do not store requests or use them for training. The provider processes the image on our behalf and may keep technical records for security as described in its own terms. The AI only proposes details; you review and confirm every event, so no decision with legal or similar effects is made automatically.

5. Who receives data (service providers)

• OpenRouter, an AI gateway, and the AI model provider it routes to (currently Google, with its Gemini model), to read screenshots. We ask for providers that do not store requests or use them for training.
• Paddle.com, our reseller and Merchant of Record, for payment and tax handling.
• Hetzner Online GmbH, which runs our servers in Germany, and Cloudflare, which provides our domain name system, our file storage for screenshots and backups, and email forwarding.
• Resend, to send verification, security and reset emails.
• A breached-password service (Have I Been Pwned), which receives only the first five characters of a one-way hash of a new password, never the password or your email, so we can refuse passwords that have appeared in known breaches.
• Sentry, to find and fix faults. Only error details are sent, never screenshots or event contents.
• The calendar provider you choose (Google, Microsoft, or your CalDAV provider), which receives the events you confirm.

Google user data

If you connect Google Calendar, Yotei asks for one permission: to add and change events that Yotei itself created in your calendar. We do not read your other events. Yotei's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use this access only to put the events you confirm into your calendar and keep them in sync when you edit them in Yotei. We do not sell it, use it for advertising, or use it to train AI models. You can disconnect at any time in Yotei or in your Google account.

We only use providers that commit to protecting personal data and we have, or are putting in place, written data processing terms with each of them.

6. Transfers outside your country

Our servers and providers may be located outside your country and outside the European Economic Area, including in countries whose data protection rules differ from yours. For screenshots, we transfer data only after you have given the explicit consent described in section 3, once you have been told that the destination may not offer the same level of protection. For other data we rely on contracts with our providers that require equivalent protection, such as the EU Standard Contractual Clauses where they apply.

7. How long we keep data

• Screenshots are deleted as soon as you confirm the event, or within 48 hours if you do not. The extracted text is deleted when you confirm.
• Events you confirm are kept until you delete your account.
• Calendar connection data is deleted when you disconnect or delete your account.
• Your consent record is deleted with your account.
• Logs and activity records are kept for a limited period for security and troubleshooting. Billing records are kept by Paddle as long as tax law requires.

8. Security

Traffic is encrypted in transit. Calendar tokens and passwords you give us for calendars are encrypted at rest. Access to your data is restricted to your account, and requests are rate-limited. Screenshots are kept only as long as needed. No system is perfectly secure. If a personal data breach is likely to affect you, we will tell you without undue delay and, within any shorter deadline that the law where you live sets, and we will notify the competent data protection authorities within the time the law requires.

9. Your rights

Under the GDPR and comparable data protection laws you have the right to: know what data we hold and how it is used; access it and receive a copy; correct inaccurate or incomplete data; withdraw consent at any time; ask us to limit how we use it; object to excessive or unnecessary processing or profiling; have it deleted or anonymised; move it to another service; and be told about a breach affecting you.

• Get a copy of your data: in the app (Settings) or on your account page, choose "Request my data". We send the file to your account's email address within 30 days. It is sent by email, and not offered as a direct download, so that someone who briefly has access to your signed-in device cannot take everything.
• Delete your account and data: in the app, Settings, "Delete my account". You confirm with your password and an emailed code. Everything is erased, including any calendar connection.
• Correct your data: edit your events in the app at any time. For your name or email, contact us.
• Withdraw consent: Settings, "Stop automatic reading".
• Anything else: we answer within 30 days if you email privacy@yotei.win

You can complain to a data protection authority: in the EU, the authority in your country of residence, work or where you think your rights were infringed; elsewhere, the authority responsible for data protection in your country. Our lead authority is the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

10. Cookies and similar technologies

Our website uses only what is needed to keep you signed in on the account pages. We do not use advertising trackers, so there is no cookie banner. We count visits to our public pages with Cloudflare Web Analytics, which sets no cookies and does not track individual visitors. The checkout page loads Paddle's code, which Paddle uses to run the payment securely.

11. Children

The Service is not meant for people under 16, and we do not knowingly collect their data. If you think a child has given us data, contact us and we will delete it.

12. Changes

We will update this page when our practices change and show the date above. For material changes we will tell you in the app or by email, and ask for your consent again where the law requires it.

13. Language

The English version of this Privacy Policy is the original and the only legally binding text. Versions in other languages are provided as courtesy translations only, to help you read it. If a translation differs from the English version, or if its meaning is unclear, the English version prevails.