Privacy Policy

YapRoom is owned and operated by The Agentic Data Company, a Delaware corporation (“the company,” “YapRoom,” “we,” “us”), registered office 131 Continental Dr, Suite 305, Newark, DE 19713, United States. We operate from the United States. Contact: privacy@yap-room.com.

The company is the data controller for everything described here: recordings, transcripts, demographic profiles, account data, the datasets built from them, and the licenses speakers granted under the Terms of Service, including data collected before the effective date of this policy.

For data protection purposes in the EU/EEA and the UK, the controller is The Agentic Data Company, reachable at the email above. We operate from the United States and offer this service to people in the EU/EEA and the UK, so the GDPR and the UK GDPR apply to how we process their data. We handle data requests directly at the email above. You can lodge a complaint with the supervisory authority in your country of residence.

We split the data we hold into two buckets: the dataset bundle (the audio, transcripts, and demographic metadata that may be included in datasets we license out under the Terms of Service) and operational data (the data we use to run your account, which is never shared with licensees, advertisers, or marketing partners — see Section 4).

Dataset bundle

• Audio recordings. Both speakers’ microphones are recorded locally for the full duration of each session.
• Transcripts. Each recording is transcribed using a third-party speech-to-text service (Deepgram — see Section 4).
• Demographic profile from onboarding. Age, gender, country, childhood country, education level, native language. Downstream researchers rely on this metadata to describe the dataset, so we ask you to provide it accurately.

Operational data

• Account details. Email address, password (stored hashed), display name, and login provider identifier (e.g., Apple ID if you sign in with Apple).
• Session metadata. Conversation duration, partner pairing, consent timestamps, upload status, rejection status.
• Device and delivery data. Push notification token (if enabled), device type, IP address at sign-up, browser type.
• Payment data. Detailed in Section 5 below.
• Support and safety records. Emails you send us, abuse reports you file, and our notes from investigating them.

Under GDPR Article 6, we identify a specific lawful basis for every purpose we process data for:

• Recording sessions, transcribing audio, building datasets, and licensing those datasets to train AI voice models — your consent (Art. 6(1)(a)). You give this consent during onboarding, and you can withdraw it at any time from Settings → Withdraw consent.
• Running your account — sign-in, session-joining, support, partner connection — contract (Art. 6(1)(b)). We need to process this data to provide the service you signed up for.
• Payouts and payment records — contract (Art. 6(1)(b)) for the payment itself, and legal obligation (Art. 6(1)(c)) for the multi-year retention of payment records required by the tax law that applies to us, currently US federal tax record-keeping rules.
• Reviewing recordings for quality, screening for abuse, fraud prevention, securing the service, and defending legal claims — legitimate interest (Art. 6(1)(f)). The interest is operating a safe service whose datasets are usable for AI research; we have weighed this against your privacy and consider the impact proportionate.
• Responding to lawful requests from authorities — legal obligation (Art. 6(1)(c)).

Where we rely on consent, you have the right to withdraw it at any time (Art. 7(3)). Withdrawal does not affect the lawfulness of processing that took place before you withdrew, and it does not require licensees to delete data we already delivered to them in good faith — see Section 6.

We do not sell personal data as defined by EU or California law and we do not process personal data for cross-context behavioral advertising. The categories of recipients below are exhaustive.

Infrastructure providers (processors acting on our instructions)

• Supabase — authentication and user database. United States.
• Cloudflare R2 — audio storage. United States / global edge.
• Hetzner — audio processing servers. Germany.
• Vercel — hosting for the YapRoom web app and APIs, and privacy-friendly first-party analytics (see Section 11). United States.
• Resend — transactional email delivery. United States.
• Expo (Push) — push notification delivery for iOS. United States.
• Customer.io — email and push notification delivery. United States.
• Cloudflare — WebRTC relay (TURN) servers that route the live audio between you and your partner during a session. They do not retain audio. United States / global edge.

Payout provider

• Dots — sends your payouts and, where the law requires it, collects your tax form and files tax returns such as Form 1099. United States. Section 5 says what Dots receives; it handles that information under its own privacy policy.

Third-party AI services in the processing pipeline

• Deepgram — raw audio is sent to Deepgram's speech-to-text service in the United States to generate transcripts. Deepgram does not retain the audio for training and deletes it after processing.
• Anthropic — the transcript of a session (text only; never the audio or your demographic profile) is sent to Anthropic's API in the United States for an automated quality check that assists our reviewers. The acceptance decision is made by a person. Under its API terms, Anthropic does not train its models on this data.

Third-party partners we license to

Under the license you grant in Section 6 of the Terms of Service, we may license dataset deliveries to third-party partners (including our successors, assigns, and other parties we contract with) in connection with our and their businesses, and to train, fine-tune, evaluate, and benchmark AI voice and speech models. A dataset delivery contains:

• processed audio recordings,
• their transcripts,
• the demographic profile you provided during onboarding (age as a range, gender, country, education level, native language), and an accent label we derive from your childhood country and native language,
• per-recording metadata: duration, sample rate, loudness and audio-quality measurements, the device type reported by your browser or app, and whether you used headphones,
• a pseudonymous speaker identifier, which pairs your track with your partner’s track within each delivered conversation.

Personal identifiers — your name, email address, IP, account ID, payment information, push token, and device identifiers — are removed before delivery. For commercial reasons we do not publish the identities of, or otherwise disclose, the parties we license to.

What we never share

The following operational data is never licensed, sold, or otherwise shared with any licensee, advertiser, marketing partner, or data broker:

• your email address, password, or display name;
• payout details (bank account, IBAN/BIC, account holder name);
• your IP address, device identifiers, and push notification tokens;
• consent timestamps, upload status, and any session metadata not listed in the dataset delivery above;
• support emails, abuse reports, and our investigation notes.

We disclose this operational data only to the infrastructure processors listed above (to run the service), to our payout provider (to pay you, as Section 5 describes), to authorities when legally compelled, and to professional advisers under a duty of confidence where strictly necessary to defend legal claims.

We pay you for recorded conversations through Dots, a payouts provider in the United States. You choose how you are paid on your earnings page, in a form that Dots runs. What you enter there goes straight to Dots:

• Your phone number, which Dots verifies with a code, and the contact details it asks for.
• Your payout method: your bank account details, or your PayPal, Venmo or Cash App account.
• Tax details, when the law requires a tax form before we can pay you: your legal name, address, date of birth and tax identification number (for example a Social Security number).

Dots also checks the people it pays against sanctions lists and may ask you to verify your identity, as the law requires of it. Dots handles all of this under its own privacy policy.

What passes between us and Dots. We send Dots the amount of each payout and an internal reference for your account. Dots tells us which kind of payout method you chose (for example “PayPal”), whether it is waiting for a tax form or an identity check from you, where that check stands, and whether each payout arrived. We keep those, along with a reference to your Dots account. We do not store your payout account details or your phone number, and we never receive your tax identification number.

Details you gave us directly. Where a payout does not go through Dots, we pay from details you entered in the app, which we store ourselves: the account holder name, the bank country and IBAN (or the account number and routing code), the BIC / SWIFT code and any payout notes, or your PayPal email address.

Why: the sole purpose of this data is to send you money for usable conversations you record on YapRoom, and to meet the tax law that applies to those payments. We do not use it for analytics or marketing, and we share it with no one but Dots.

Lawful basis (GDPR Art. 6(1)(b) and 6(1)(c)): processing is necessary to perform our payout obligation to you under our terms, and to comply with the tax and record-keeping law that applies to us as a US company.

Retention: we keep the payment details we hold, and our reference to your Dots account, for as long as you have an active YapRoom account. If you withdraw consent or ask us to delete your data, we remove them at the same time as your other personal data — with one narrow exception: we keep a record of past payouts (date, amount, transfer reference) for 5 years, which covers the record-keeping periods the tax law that applies to us requires. What Dots holds is kept under its own privacy policy, including the payment and tax records the law requires it to keep; ask us and we will pass a deletion request on to Dots.

Retention by data category. “Account active” means you have not deleted your account and your consent has not been withdrawn.

• Account data: while the account is active.
• Audio recordings and transcripts (accepted sessions): while the account is active and consent is active. Deleted within 30 days of consent withdrawal or account deletion, except paid sessions. If we paid any participant, we retain the full conversation, including every participant's audio, transcripts, and demographic data, for future dataset deliveries (see Section 7, Withdraw consent).
• Audio recordings and transcripts (rejected sessions — see Terms of Service § 7): retained for up to 30 days after rejection for limited internal purposes (improving the processing pipeline and rejection criteria, reviewing appeals, investigating suspected abuse or fraud, defending legal claims). Deleted automatically thereafter and never included in dataset deliveries.
• Demographic profile: retained alongside the audio and transcripts. Deleted on the same schedule.
• Data already delivered to a licensee: we cannot recall a delivery once it has been made. After consent withdrawal or account deletion, unpaid sessions are excluded from future deliveries. Paid sessions remain licensed and may still be delivered.
• Session / operational logs: 12 months.
• Abuse reports and moderation notes: 24 months after the case is closed.
• Support emails: 24 months.
• Payment details: while the account is active, then deleted with the rest of your data (see Section 5).
• Past payout records (date, amount, transfer reference): 5 years, covering the record-keeping periods the tax law that applies to us requires.

You have the following rights, regardless of where you are contacting us from. We respond within 30 days, free of charge in all but the narrowest cases (Art. 12(5)). We may need to verify your identity before fulfilling a request.

• Access (Art. 15) — ask us what we hold about you and receive a copy.
• Rectification (Art. 16) — ask us to correct inaccurate or incomplete data, including your demographic profile.
• Erasure / right to be forgotten (Art. 17) — ask us to delete your data. The fastest route is Settings → Delete account.
• Restriction of processing (Art. 18) — ask us to pause processing while we investigate a dispute.
• Data portability (Art. 20) — ask for a machine-readable export of your account data, demographic profile, transcripts, and audio.
• Object to processing (Art. 21) — object to processing that relies on our legitimate interest. We will stop unless we have compelling overriding grounds.
• Not be subject to solely automated decision-making (Art. 22) — YapRoom does not make decisions that produce legal or similarly significant effects about you using purely automated processing.
• Withdraw consent (Art. 7(3)) — from Settings → Withdraw consent. New sessions will not be recorded. Sessions with no paid participant are removed from future dataset deliveries and deleted within 30 days. If we paid any participant, the full conversation remains licensed under Section 6 of the Terms of Service. We retain every participant's audio, transcripts, and demographic data for future dataset deliveries. The same exception applies when you delete your account. We remove your login and identifying profile details during deletion. Already-delivered data cannot be recalled (see Section 6).
• Lodge a complaint with the supervisory authority in your country.

If you are a California resident under the CCPA / CPRA, you have equivalent rights to know, delete, correct, and limit. We do not sell personal information as defined by the CCPA, and we do not share it for cross-context behavioral advertising. You will not be discriminated against for exercising your rights.

To exercise any of these rights, email privacy@yap-room.com from the address on your account.

YapRoom is for users aged 18 and older. We do not knowingly collect data from anyone under 18, and we apply 18 as a single global floor even where local law would permit a lower age. If you believe a minor has created an account, contact privacy@yap-room.com and we will delete the account.

We use TLS for all data in transit. Audio at rest is stored in Cloudflare R2 with access keys held only by our servers and rotated periodically. Supabase enforces Row-Level Security policies that prevent one user from accessing another user’s data. We monitor for unauthorized access. No system is perfect — if we discover a personal data breach affecting you, we will notify the competent supervisory authority within 72 hours where required by GDPR Art. 33, and notify you directly where the breach is likely to result in a high risk to your rights and freedoms under Art. 34.

Several of our processors operate outside the EU/EEA:

• United States — Supabase, Cloudflare (R2 storage and TURN relay; US / global edge), Vercel, Deepgram, Resend, Expo, Customer.io, Dots. Transfers are made under the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914), and where the processor has certified, under the EU–US Data Privacy Framework adequacy decision.
• Germany (EU) — Hetzner. No transfer outside the EEA.

We are incorporated in and operate from the United States (see Section 1), so the personal data you give us is processed in the United States. Being US-based also means we can be subject to US legal process; we disclose personal data to any authority only where we are legally compelled to, and we tell you when that happens unless the law forbids us from telling you.

You can request a copy of the safeguards in place by emailing privacy@yap-room.com.

YapRoom uses only the storage and telemetry needed to run the service. We do not use advertising cookies, retargeting pixels, or third-party analytics that build cross-site profiles, and we do not sell or share data for advertising.

• Strictly necessary cookies: Supabase authentication cookies and CSRF tokens.
• Local and session storage: in-app session state and consent state.
• Push notification tokens (iOS app only, when you opt in to notifications).
• Vercel Web Analytics — a privacy-friendly, cookieless, first-party analytics product run by our hosting provider Vercel. It collects aggregate pageview data (visited page, referrer, approximate country derived from IP, browser, and operating system) without setting cookies and without building cross-site profiles. The lawful basis is our legitimate interest (GDPR Art. 6(1)(f)) in understanding which pages are used. You can object under Art. 21 by emailing privacy@yap-room.com.

If we ever add additional analytics or marketing technologies, we will update this section first and ask for consent where required.

We send transactional emails (account, payout, safety, consent and policy changes) because they are necessary to operate the service — you cannot opt out of these while your account is active. We will only send marketing emails on an opt-in basis, and every marketing email will contain a one-click unsubscribe link.

We update this policy when our practices change. If a change materially affects how we use your data — a new third-party recipient, a new data type, or a change to the license grant — we will tell you before it applies to you, and where the change needs your consent we will ask for it first. The current version is always at yap-room.com/privacy.

Questions, requests, and complaints: privacy@yap-room.com.