Yoatu

Privacy Policy

Effective date: October 15, 2026. Last updated: October 18, 2026.

This Privacy Policy explains how AltoTech USA LLC d.b.a. Yoatu.com ("Yoatu", "we", "us" or "our") collects, uses and shares information when you use yoatu.com and the related services (the "Service"). Yoatu gives local businesses a public profile that customers reach by scanning a QR code.

This policy covers two groups of people: visitors, who scan a code or open a business profile, and owners, who create an account to manage a business profile. If you are a visitor, section 2 applies to you. If you are an owner, sections 2 and 3 apply to you.

1. Who we are

The Service is operated by AltoTech USA LLC d.b.a. Yoatu.com, a Florida limited liability company, 1691 Forum Pl Ste B-1068, West Palm Beach, FL 33401, United States. AltoTech USA LLC d.b.a. Yoatu.com is the controller of the personal information described in this policy. For anything related to this policy, write to privacy@yoatu.com.

2. Visitors: scanning a code or opening a profile

We designed the public side of the Service to collect as little as possible. This section describes exactly what happens when you scan a code or open a profile.

2.1 What we do not do

2.2 What we record

When a code is scanned or a profile is opened, and when a button on a profile is tapped (such as Call, Get directions, Email, WhatsApp, Website, Book, Save contact, Share or a social link), we record an event with:

2.3 IP addresses

2.4 What owners can see

Owners see daily totals only: for each day, how many opens and how many taps of each button there were, broken down by location, by code and by whether the visit came from a code, a shared link or directly. Owners can download the same daily totals as a spreadsheet. Owners cannot see individual visits, the time of day of any visit, the device, the pseudonymous value, or any visitor's precise location. Reports also show the approximate places (city and region, or country) that opens and taps came from, as totals for the period the owner selects. A place can appear even when only one visit came from it during that period, so an owner may be able to tell that someone opened their page from a particular city, but not who it was or exactly where.

2.5 Retention

Individual event records, including the pseudonymous value, are deleted 30 days after the day they belong to has been summarised into daily totals, which normally happens within a day. Daily totals contain no per-visit information and are kept for 12 months.

2.6 Other things to know

2.7 Our website: analytics and cookie choices

Our own website pages (the home page, pricing, how it works, for businesses, about, contact, these policies and the cookie settings page) ask before using Google Analytics. Nothing from Google loads, and no analytics cookie is set, until you press Accept in the banner or on the [Cookie settings](/cookies) page. If you accept, Google Analytics sets first-party cookies (`_ga` and `_ga_…`, kept for up to 2 years) and Google receives your IP address, browser and device details and the pages you view, which we use only to understand how people find and use our website. We keep Google Signals and advertising features off, and we do not use Google Analytics on business profiles, the directory, sign-in or the owner workspace. We remember your choice in a cookie (`yoatu_consent`, 1 year). You can change your mind at any time on the [Cookie settings](/cookies) page: declining again stops the analytics and removes its cookies. If your browser sends a Global Privacy Control signal, we treat it as a no and don't ask.

3. Owners: your account and business

3.1 What we collect

We do not collect precise geolocation, your contacts, or photos other than the logo you upload. Please do not put sensitive information, such as health, financial or government identification details, into your profile, your setup requests or your emails to us; the Service does not need it and your profile is public.

3.2 How we use it, and on what legal basis

Where data protection law requires us to have a legal basis for processing, we rely on the bases listed in italics.

Visitor events (section 2) are processed on the basis of our legitimate interest, and that of the businesses using Yoatu, in knowing whether their codes are being used, which we balance by collecting no identifiers and showing owners daily totals only. Yoatu decides what visitor information is collected and how it is processed, and is the controller for it.

We do not send marketing email, do not sell or rent your information to anyone, do not use your information to build advertising profiles, and do not use automated decision-making that produces legal or similarly significant effects.

3.3 Cookies

The owner workspace uses one cookie: a signed session cookie that keeps you signed in for up to 30 days or until you sign out. It is marked HttpOnly and Secure and is not used for tracking. Forms in the workspace carry a security token derived from your session; it is not a cookie. The workspace and sign-in pages use no analytics cookies and no third-party scripts. We use no advertising cookies anywhere on the Service. The only analytics cookies are on our website's own pages, and only if you accept them (section 2.7). All cookies and browser storage are listed on the [Cookie settings](/cookies) page.

3.4 Your choices

4. Who we share information with

We share information only with the providers we need to run the Service, and only what each one needs:

When a business is transferred. The new owner receives the business with everything in it: its profile, codes, locations, Handle and reports (including past visitor reports). In the invitation they see your email address partly hidden; you see theirs in full. Your account email, payment method, invoices and coupons are not passed to them, and their new subscription is set up with Stripe in their own name.

Each of these providers processes information on our behalf under a written agreement and its own security commitments. We may also disclose information if required by law, to protect the rights, property or safety of Yoatu, our customers or others, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply until you are told otherwise.

We do not sell personal information and have not done so in the preceding 12 months. We do not share personal information for cross-context behavioral advertising.

5. Retention and deletion

5.1 How long we keep things

5.2 If your subscription ends

If your subscription ends and is not resumed, your profile goes offline at the end of the period you paid for. We keep your account and business data for 12 months after that so that you can come back, and then delete it as described in 5.3. You can ask us to delete it sooner at any time.

5.3 If you ask us to delete a business or your account

When you delete a business in Settings, its profile and codes go offline at once, any subscription is cancelled, and we email you. For 7 days you can restore it from your dashboard, in case the request was a mistake or not yours. After that we erase it automatically. Deleting your account does the same for every business on it and then removes your sign-in. For a request by email, we act within 30 days of verifying it. In both cases we delete the account (when it has no other business), profile, codes, locations, logo, setup requests, sessions, event records, daily totals and coupon records from our active systems. Copies in backups expire within a further 35 days. Billing records and audit records are kept for the periods in 5.1. Your codes and profile addresses are retired permanently and are never reassigned to another business; anyone who scans a retired code sees a not-found page instead of your profile.

5.4 Deleting a single code

If you delete one of your codes while keeping your account, its daily totals stay in your reports, labelled "Deleted code", until they expire under 5.1.

6. Security

We protect information with measures appropriate to the Service, including encryption in transit (HTTPS everywhere), signed and HttpOnly session cookies, passwordless sign-in with short-lived single-use codes, isolation of each business's data on every request, signature-verified payment webhooks, rate limits, and audit logging of administrative actions. Administrators can view, but not act as, an owner's account. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Your rights

Depending on where you live, you may have rights to access, correct, delete or receive a copy of your personal information, to restrict or object to certain processing, to withdraw consent where processing is based on it, and to not be discriminated against for exercising those rights. You can exercise most of these rights directly in your workspace. For anything else, write to privacy@yoatu.com. We will verify your request using your account email and respond within the time the law requires, normally 30 days. If we cannot act on a request we will tell you why. If you are in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with your local supervisory authority.

Visitors: we store no name, address or identifier for a visit, so we have no way to find the event records that belong to you, and nothing we could retrieve or correct. Every event record is deleted on the schedule in section 2.5.

8. Children

Owner accounts are for businesses, and you must be at least 18 years old to create one. We do not knowingly allow anyone under 18 to open an owner account; if you believe someone under 18 has done so, write to privacy@yoatu.com and we will close the account and delete its information.

Public profiles can be opened by anyone, including children, in the same way as any public web page. A visit records only the information in section 2 and nothing that identifies the visitor or their age, and it is deleted on the schedule in section 2.5. We do not collect any personal information from visitors, of any age, beyond what section 2 describes.

9. International users

We are based in the United States and the Service is hosted on infrastructure operated by Cloudflare, which may process information in data centers around the world. If you use the Service from outside the United States, your information is transferred to, stored and processed in the United States and other countries, where privacy laws may differ from those where you live.

Where the law requires a safeguard for transfers out of the European Economic Area, the United Kingdom or Switzerland, we rely on the EU-U.S. Data Privacy Framework and its UK and Swiss extensions where a provider is certified under it, and otherwise on standard contractual clauses approved by the European Commission (and the UK Addendum where applicable) included in our agreements with providers. Write to privacy@yoatu.com for more information about these safeguards.

10. Changes to this policy

We may update this policy from time to time. If a change is material, we will tell owners by email or by a notice in the workspace at least 14 days before it takes effect. The date at the top shows when the policy was last updated.

11. Contact

AltoTech USA LLC d.b.a. Yoatu.com

1691 Forum Pl Ste B-1068, West Palm Beach, FL 33401, United States

privacy@yoatu.com

We use cookies to make our website work well and to understand how it's used, so we can keep improving it. Optional analytics cookies are only set if you accept. Cookie settings