Privacy Policy

Last updated 5 November 2026

Ygora is a product of Ygora AS (org. nr 935 830 427), Norway. This policy explains what personal data we collect when you use Ygora, why we collect it, who processes it, and the rights you have. Questions? Email hello@ygora.ai.

What we collect

Account data — your email address (used to sign you in with a magic link), and the name, role, and company you give us during setup.
Company information — the company name and any rough details (size, industry) you provide. We may enrich this from public sources to sharpen the guidance we give you.
Your plans and conversations — your answers, what you type, the conversation you have with Ygora about a plan, and the replies and documents generated for you.
What you do with a suggestion — when Ygora suggests something (a decision, a role, a line in your team charter, an idea for where AI could help) and you confirm it, change it or dismiss it, we keep a short record: the kind of suggestion, what you did, and a little context from your plan (what you lead, roughly how big your team and company are, your timeframe, and where in the tool you were). That record has no wording in it. We never keep your company name, your goal, your notes or the words you type. You can turn the record off in Settings, under “Help improve Ygora”. There, you can also choose to share the wording of the suggestions, so we can find the ones that read wrong. That is off until you turn it on; emails, links and phone numbers are taken out of it, and you can turn it off again whenever you like.
Plan and billing data — which plan you have, its status, your trial and renewal dates, how many advisory hours you have used, and the customer and subscription ids Stripe gives us. We never see or store your card number.
Technical data — essential session cookies and standard server logs (such as IP address and browser type) needed to run and secure the service.

We don't ask for special-category data, and we ask that you do not enter sensitive personal information about your team members into Ygora.

People who answer a team link

A leader can ask their team what steals their time by sending a link. Anyone with the link can answer without an account. We store each answer: the note, the piece of work it is about, whether the person said it steals their time, they would hand it to AI or it should stay with people, an optional role picked from the leader's list, and the time. We do not ask for or store a name, email address, account identifier or IP address with an answer. To count how many people have answered one link, the form keeps a random code on the person's device and stores it with their answers. The code is not linked to a name or an account, and the leader who sent the link never sees it.

The answers are shown to the leader who sent the link, grouped by role, and to no one else. They are deleted when the leader deletes the plan or their account. The team form also has an optional chat. What a person types there is sent to Anthropic to reply and to pick out concrete ideas, which are saved as answers; the conversation itself is not stored. Our hosting provider keeps ordinary server logs, which are not linked to answers. Because people may write about themselves or others even when asked not to, we ask the leader to tell their team why they are asking and to keep to the work.

When a leader makes a team link they can tick a box to be emailed once when three people have answered. If they do, we send that one email to the leader's own address. It says how many people have answered and links to their Home page. It never contains what anyone wrote, and the subject is the same plain line for everyone. It is sent once for that link, and the leader can untick the box before then. The people who answer are never emailed.

Why we use it

To provide the service and your account — performance of a contract.
To answer you in the conversation and draft documents you ask for —performance of a contract, and your consent where you choose to share details.
To find out which kinds of suggestion help and which do not, so we can improve them — legitimate interests of Ygora, and your consent for the wording, if you choose to share it. The record is never used to contact you or to rank or evaluate people, and you can switch it off at any time.
To secure the service and prevent abuse — legitimate interests.
To take payment for a plan, run the free trial and keep the records the law requires — performance of a contract and legal obligation (bookkeeping).
To collect answers from a leader's team and show them to that leader — legitimate interests of the leader and of Ygora in giving them the service they asked for.
To send service emails — sign-in links, a note a few days before a free trial ends, and, only if you tick the box on a team link, a note that your team has answered — performance of a contract.

Ygora and ByeByeApply

Ygora and ByeByeApply are two products operated by the same company, Ygora AS, on shared infrastructure with a single sign-in. If you use both, the same email address is one account across them. We may use your information across both products to operate them — and, in particular, to match leaders with the people they could work with. We remain the controller of your data throughout; this is not sharing with a separate company. We rely on performance of our contract with you to run the products, and on your consent for any cross-product matching.

Who processes your data

We rely on a small set of trusted providers to run Ygora. Your data may be processed by:

Supabase — authentication and database hosting.
Anthropic — when Ygora drafts a document for you, suggests what your goal needs, or answers you in the conversation, what you typed and your plan answers are sent to Anthropic's Claude API to generate it. Anthropic processes this in the United States, and does not use it to train a model.
Stripe — payment for plans. Stripe holds your card and billing details and acts for us as a processor; it is also an independent controller for its own payment and fraud checks. We receive only your plan, its status and dates, and the Stripe customer and subscription ids.
Vercel — application hosting.
Our email provider — delivery of sign-in and service emails.

Some providers are located outside the EU/EEA (notably Anthropic, Stripe and Vercel, in the United States). Where personal data is transferred outside the EU/EEA, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

Sharing

We do not sell your personal data. We share it only with the providers above, or where we are required to by law.

How long we keep it

We keep your account and company data for as long as your account is active. Your plans and your conversations with Ygora are retained so they are still there next time you sign in. Server logs are kept for a limited period for security. The record of what you did with suggestions, and the wording if you shared it, is kept while your account is active and deleted with it. Records of invoices and payments are kept for as long as bookkeeping law requires, even after you delete your account. You can delete everything yourself, at any time, from Settings.

Your rights

Under the GDPR you can access your data, correct it, delete it, export it (portability), restrict or object to processing, and withdraw consent. Access, portability and deletion are self-serve: in Settings you can download a complete copy of your data as a JSON file, or delete your account outright. Deletion is immediate and permanent, and it covers ByeByeApply too — the same email signs you in to both, so it is one account. For anything else, or if you would rather we did it, email hello@ygora.ai. You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no).

Cookies

We use only essential cookies needed to keep you signed in and to secure the service. We do not use advertising or third-party tracking cookies. The one other thing we keep on a device is the random code on the team form described above, used only to count how many people have answered one link.

Changes

We may update this policy. When we do, we'll post the new version here with a revised date.

Ygora AS · Org. nr 935 830 427 · hello@ygora.ai