Privacy Policy

1. Introduction

YerBak LLC ("YerBak," "we," "us," or "our"), a limited liability company incorporated in the State of Delaware, United States, operates the YerBak property intelligence platform at yerbak.com.

This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use our Platform and report generation services. We serve real estate professionals across 45 countries and are committed to complying with applicable data protection laws including the EU General Data Protection Regulation (GDPR), the Turkish Personal Data Protection Law (KVKK, Law No. 6698), the UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), and other regional data protection frameworks.

For the purposes of the GDPR, YerBak LLC is the data controller of your personal data.

2. Information We Collect

2.1 Account Information

• Full name, email address, and phone number
• Company name, country, and business logo
• Authentication credentials (email/password or Google OAuth token)

2.2 Property Data

• Property addresses and geographic coordinates you submit for report generation
• Property details you provide (room layout, property type, pricing, photos, notes)

2.3 Payment Information

• Payment processing is handled entirely by Stripe. We do not store credit card numbers, bank account details, or other sensitive payment information on our servers
• We retain your Stripe customer ID and subscription status for billing management

2.4 Usage & Analytics Data

• Page views, session duration, and feature usage (via Google Analytics 4)
• Report generation events and credit consumption patterns

2.5 Technical Data

• IP address, browser type and version, device type, and operating system
• Referral source and pages visited

2.6 Marketing & Acquisition Data

• UTM parameters (source, medium, campaign) from referring links
• Ad click identifiers (Google Click ID, Meta Click ID, X Click ID)
• These are used solely for measuring advertising effectiveness and are not shared with third parties beyond the originating ad platform

3. How We Use Your Information

• Service delivery: Generate and deliver property intelligence reports based on your submitted locations
• Billing and account management: Process subscription payments, manage credits, and maintain your account
• White-label branding: Apply your company logo and brand colors to generated reports
• Service improvement: Analyze usage patterns to enhance the Platform's features and performance
• Customer support: Respond to your inquiries and resolve support tickets
• Marketing (with consent): Send promotional communications about new features or offers, where you have opted in
• Legal compliance: Meet our obligations under applicable tax, accounting, and data protection laws
• Security: Detect and prevent fraud, abuse, and unauthorized access through rate limiting and access controls

4. Legal Bases for Processing (GDPR)

If you are located in the EU/EEA, UK, or Turkey, we process your personal data on the following legal bases:

• Contract performance (Art. 6(1)(b) GDPR): Processing necessary to provide the Platform services you have subscribed to, including report generation and account management
• Legitimate interest (Art. 6(1)(f) GDPR): Analytics, service improvement, fraud prevention, and ensuring platform security. We balance our interests against your rights and freedoms
• Consent (Art. 6(1)(a) GDPR): Marketing communications, advertising cookies and tracking pixels. You may withdraw consent at any time
• Legal obligation (Art. 6(1)(c) GDPR): Retaining payment records and complying with tax reporting requirements

5. Third-Party Services & Data Sharing

We share your data with the following categories of third-party service providers, solely for the purposes described in this Policy:

We do not sell your personal data to any third party. We do not share your data for purposes unrelated to the operation and improvement of the Platform.

6. International Data Transfers

Your personal data may be transferred to and processed in the United States, where our primary infrastructure is hosted (Vercel, Supabase). For users in the EU/EEA, UK, or other jurisdictions with data transfer restrictions:

• We rely on EU Standard Contractual Clauses (SCCs) or equivalent mechanisms as adopted by our sub-processors
• Stripe, Google, Vercel, and Supabase each maintain their own data protection frameworks and certifications for international transfers
• We ensure that all sub-processors provide adequate safeguards for personal data as required by applicable law

A list of our current sub-processors is available upon request at support@yerbak.com.

7. Data Retention

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

8.1 EU/EEA Residents (GDPR)

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your personal data ("right to be forgotten")
• Right to restriction: Request limitation of processing in certain circumstances
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interest or direct marketing
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent
• Right to lodge a complaint: File a complaint with your local Data Protection Authority (DPA)

8.2 Turkey Residents (KVKK)

Under Article 11 of the Turkish Personal Data Protection Law (KVKK, Law No. 6698), you have the right to: learn whether your data is processed, request information about processing, learn the purpose and whether data is used accordingly, know domestic/international third parties to whom data is transferred, request rectification of incomplete or inaccurate data, request deletion or destruction, request notification of corrections to third parties, object to adverse results arising from automated analysis, and request compensation for damages caused by unlawful processing. Requests may be directed to support@yerbak.com.

8.3 UK Residents (UK GDPR)

You have the same rights as EU/EEA residents under the UK GDPR and Data Protection Act 2018. The supervisory authority is the Information Commissioner's Office (ICO).

8.4 California Residents (CCPA/CPRA)

• Right to know: Request disclosure of the categories and specific pieces of personal information collected
• Right to delete: Request deletion of personal information we have collected
• Right to opt-out of sale: We do not sell personal information. No opt-out action is required
• Right to non-discrimination: We will not discriminate against you for exercising your CCPA rights

8.5 Other Jurisdictions

Users in jurisdictions with data protection laws (including but not limited to UAE PDPL, Singapore PDPA, South Korea PIPA, Thailand PDPA, Australia Privacy Act 1988) may have similar rights. We will respond to all legitimate data subject requests within 30 days. Contact us at support@yerbak.com.

9. Cookies & Tracking Technologies

We use the following categories of cookies and tracking technologies:

You can manage cookie preferences through your browser settings. Disabling essential cookies may affect Platform functionality. Analytics and advertising cookies are loaded only with your consent.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption in transit (TLS/HTTPS) for all data communications
• Row-Level Security (RLS) policies on our database to ensure data isolation between users
• Rate limiting and abuse prevention on all API endpoints
• HMAC-signed tokens for sensitive operations (unsubscribe links, access tokens)
• Admin access controls with multi-layer authentication
• Secure credential management (API keys stored as encrypted environment variables, never in source code)
• Regular security audits and code reviews

While we take data security seriously, no method of transmission or storage is 100% secure. We encourage you to protect your account credentials and notify us immediately of any suspected unauthorized access.

11. Children's Privacy

The Platform is not directed at individuals under the age of 16 (or the applicable age of consent in your jurisdiction). We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly. If you believe a child has provided us with personal data, please contact us at support@yerbak.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. For material changes, we will provide at least 30 days' notice via email. The "Last updated" date at the top of this page indicates when the Policy was last revised. Continued use of the Platform after changes take effect constitutes acceptance of the updated Policy.

13. Contact

For privacy-related inquiries, data subject requests, or to exercise any of your rights described above, contact us at: