Terms

Effective date: October 27, 2026

These Terms are an agreement between YAYCE LLC, a Missouri limited liability company based in Morrison, Missouri 65061, USA ("YAYCE LLC", "we", "us"), and the business that creates an account ("you", "the Customer"). They cover yayce: the website yayce.com, the yayce platform and everything we provide with it (together, "the Service").

By creating an account, starting a trial, or using the Service, you agree to these Terms. If you accept them for a company, you confirm you have the authority to bind it.

1. What yayce is

yayce is a white-label platform for agencies. You run your own branded app on a yayce address ({your-name}.yayce.com) or your own domain, and create a workspace for each of your clients. Each workspace can include a website, contacts and pipelines, forms, an inbox, email campaigns, automations, bookings, a voice agent, payments and a store, a customer portal, reviews, HR tools, monthly reports, and AI teammates that draft work for a person to approve.

The Service is for businesses only. It is not for personal, family or household use. You must be at least 18 to create an account.

2. Who is who

• You are the agency. Your clients are the businesses you give workspaces to. Their end customers are the people your clients serve (for example, a gym's members).

• You may brand the Service as your own and resell access to your clients at prices you set. We are not a party to your agreements with your clients, and your clients do not have a contract with us.

• You are responsible for your clients' and your team's use of the Service as if it were your own, including their compliance with these Terms.

• You must give your clients terms and a privacy notice of your own that are consistent with these Terms and the law, and that cover how you and your clients use the Service.

3. Your account

• Give accurate information and keep it up to date.

• Keep sign-in details safe. You are responsible for everything done under your account. Tell us at once at support@yayce.com if you think someone has accessed it without permission.

• Two-factor sign-in is available; we recommend you require it for your team.

• Some features stay locked until you confirm your email address.

4. Plans, trials and billing

• Plans. Plans are sold monthly, in US dollars, and differ by the number of client workspaces, the included AI allowance and file storage. Current plans and prices are at yayce.com/pricing. Your own agency's workspace does not count toward your plan's limit.

• Billing. Plans are billed monthly in advance and renew automatically until you cancel. Payments are processed by Polar (polar.sh), which acts as merchant of record and may also apply its own buyer terms. Prices exclude taxes, which are calculated and collected at checkout.

• Free trial. New agencies that sign up themselves can start a 14-day free trial on the Starter plan. A card is taken at checkout and charged when the trial ends, unless you cancel first. We remind you before the first charge.

• Set-up-for-you trial. If we set up your platform for you, you get a 14-day trial of the Growth plan without a card. AI use during this trial is limited to a small included amount. To keep using the Service after it, you choose a plan and add a payment method; until you do, your account shows only the plan choice and your workspaces pause (see section 12).

• Founding and promotional offers. Founding-agency terms (for example, free months or a discount for a set period) apply only as stated in writing when we accept you, and only for the period stated. After it, the plan renews at the standard price unless you cancel.

• Changing plans. You can move to a bigger plan at any time. If you move to a smaller plan, you must first bring your number of client workspaces within its limit.

• Price changes. We may change prices for future billing periods. We will tell you at least 30 days before a change affects you.

• Failed payments. If a payment fails and is not fixed, we may pause your account until it is.

• Refunds are covered by our Refund Policy (below), which is part of these Terms.

5. Your outside accounts

Some features run on accounts you or your clients hold with other companies, under those companies' terms. For example: Stripe (client billing, invoices, a store), Twilio (texts, WhatsApp, business phone numbers), Vapi (the voice agent, on each client's own account), Google (Business Profile and reviews), and your own AI provider key if you use one. Those companies bill you or your clients directly. We are not responsible for their services, prices, outages or decisions, such as refusing or suspending an account.

6. AI features

• yayce's AI teammates and assistant draft work, such as page text, follow-up messages and review replies. Every change a teammate proposes waits for a person to approve it. The exception is a feature you choose to switch on, such as a website chat assistant that answers visitors from a business's public information.

• AI output can be wrong, incomplete or unsuitable. Check it before you approve or use it. You are responsible for what you approve, publish or send, and for switching on features that reply automatically.

• Paid plans include an AI allowance each month as shown on the pricing page. When it is used up, AI features stop until the next month unless you add your own AI provider key, in which case that provider bills you directly under its terms.

• We send the information an AI task needs to the AI provider that runs it (see our Privacy Policy at yayce.com/privacy and the Data Processing Addendum below). Some providers, such as DeepSeek, stay off until you opt in after a notice.

• We do not use your data or your clients' data to train AI models.

7. Your data

• You own your data. "Customer Data" means everything you, your team, your clients and their end customers put into the Service or collect through it. You keep all rights to it.

• You give us permission to host, copy, process, transmit and display Customer Data only as needed to provide, secure and support the Service, and as you instruct.

• Our Data Processing Addendum (below) applies when we process personal data for you, and is part of these Terms.

• You are responsible for having the right to collect and use Customer Data, including any notices and consents the law requires.

• We may use aggregated, de-identified information about how the Service is used to run and improve it. It will not identify you, your clients or any person.

• Support access. Our staff look inside your account only when your account owner grants access from within the app, for the time and scope you choose. Access can be revoked at any time, and every request made under it is shown in your account's access log.

8. Rules for using yayce

You must not use the Service, or let your team or clients use it, to:

1. break the law or anyone's rights, including privacy, consumer protection, intellectual property and advertising laws;

2. send messages, make calls or send texts without the consent the law requires, including the rules on autodialed, prerecorded and artificial-voice calls (such as the US Telephone Consumer Protection Act), anti-spam laws (such as CAN-SPAM, Canada's CASL, the UK's PECR and Australia's Spam Act), US texting registration, and the messaging rules of carriers and of WhatsApp;

3. record calls without giving the notice, and getting the consent, the law requires where the caller is;

4. post or ask for fake reviews, review only happy customers, or otherwise break the rules of Google or consumer-protection authorities on reviews;

5. store or process protected health information under HIPAA, or any medical or patient records. yayce is not HIPAA compliant and does not sign Business Associate Agreements, so it must not be used for healthcare providers' patient data (for example, clinics, dentists or medical spas);

6. store payment card numbers outside the payment features, government ID numbers, or other highly sensitive data, unless we have agreed to it in a signed writing;

7. collect personal information from children under 13, or target them;

8. send malware, phish, or attack, probe or overload the Service or any system;

9. get around plan limits, security, or the approval step for AI changes;

10. copy, resell or rebuild the Service other than as a white-label reseller under these Terms, or reverse engineer it except where the law allows;

11. host content that is illegal, hateful, harassing, sexually exploitative or deceptive, or impersonate anyone.

We may remove content or pause a workspace that breaks these rules, and will tell you why unless the law or safety prevents it.

9. Our responsibilities

• We provide the Service as described on yayce.com and in the app, and keep it secure using measures appropriate to the risk (described in the Data Processing Addendum).

• We back up data and test our restores. Backups are for recovering the Service, not a guarantee that any single item can be restored.

• Support. Email support@yayce.com or use the Help button in the app. We aim to reply within 24 hours on weekdays. This is a goal, not a guaranteed service level. We do not offer an uptime guarantee.

• We may change or retire features. If a change materially reduces what your plan includes, we will tell you at least 30 days ahead.

• Features we label beta, preview or early access may change or stop at any time and are provided as they are.

10. Intellectual property

We own the Service, its software, design and documentation. These Terms give you a right to use and resell access to the Service while your subscription is active; they do not transfer ownership. Your brand, logo and content stay yours. If you send us feedback, we may use it without obligation to you.

11. Suspension

We may suspend all or part of the Service, with notice where reasonable, if: payment is overdue; you or your clients break section 8; your use creates a security risk or legal exposure for us or others; or the law requires it. We will restore access when the cause is fixed.

12. Canceling and ending the agreement

• You can cancel at any time from Billing in your app. Your plan runs to the end of the period you have paid for. After that, your client workspaces pause until you choose a plan again.

• We can end these Terms with 30 days' notice for any reason, or at once if you seriously or repeatedly break them.

• Your data after cancellation. We keep Customer Data while your subscription is active. When it ends (at the end of the last period you paid for, or when a trial ends without a plan), you have 30 days to ask for an export.

• Exports are on request by email to support@yayce.com, delivered within 30 days as CSV files. They aren't self-serve. You can also ask for one while your subscription is active. Exports don't include passwords, security codes, keys or uploaded files; ask us if you need the files.

• Deletion. After the 30-day export window we delete Customer Data within 30 days, when you ask or at our monthly clean-up, whichever comes first. Copies in backups are purged within 90 days, and logs are kept for 30 days. You can also ask us to delete your data sooner.

• Billing records (your yayce subscriptions and their invoices) are kept as long as tax law requires, even after your other data is deleted.

• Sections that by their nature should survive (fees owed, data, IP, disclaimers, liability, indemnity, disputes) survive the end of these Terms.

• Where data is kept. Customer Data is stored and processed in India, with uploaded files and encrypted backups in Cloudflare's storage (see the Privacy Policy and the Data Processing Addendum).

13. Disclaimers

Except as these Terms say, the Service is provided "as is" and "as available". To the extent the law allows, we disclaim all implied warranties, including merchantability, fitness for a particular purpose and non-infringement. We do not promise that the Service will be uninterrupted or error-free, that AI output will be accurate, or that using the Service will bring you or your clients any particular result.

14. Limits on liability

To the extent the law allows:

• Neither party is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue or data, even if told they were possible.

• Each party's total liability under these Terms is limited to the amount you paid us for the Service in the 12 months before the event that caused the claim, or $100 if that's more.

• These limits do not apply to your payment obligations, a party's indemnity obligations, or liability that cannot be limited by law.

15. Indemnity

You will defend and indemnify YAYCE LLC against claims by third parties (including your clients and their end customers) that arise from Customer Data, your or your clients' use of the Service, your agreements with your clients, or a breach of section 8.

16. Disputes

These Terms are governed by the laws of the State of Missouri, USA, without regard to its conflict-of-law rules. Any dispute will be heard only in the state courts of Gasconade County, Missouri, USA (which serve Morrison, Missouri 65061), or the United States federal court for the district that includes it, and both parties agree to those courts' jurisdiction. Before filing a claim, each party will try to resolve the dispute informally for 30 days after written notice.

17. General

• Changes to these Terms. We may update these Terms. For material changes we will give at least 30 days' notice by email or in the app. Continuing to use the Service after the change takes effect means you accept it.

• Notices to us go to support@yayce.com. Notices to you go to your account owner's email.

• Assignment. You may not transfer these Terms without our written consent. We may transfer them as part of a merger, acquisition or sale of assets.

• Export and sanctions. You may not use the Service where, or for anyone to whom, US export or sanctions laws forbid it.

• Entire agreement. These Terms, the Refund Policy, the Privacy Policy and the Data Processing Addendum are the whole agreement about the Service. If they conflict, the Data Processing Addendum wins on personal data, then these Terms.

• If a part of these Terms cannot be enforced, the rest still applies. Not enforcing a right is not a waiver of it.

Contact: YAYCE LLC · 507 Ash St, Morrison, Missouri 65061-3002, USA · support@yayce.com

Refund Policy

Effective date: October 27, 2026

This policy is part of the yayce Terms of Service between YAYCE LLC and the agency that holds a yayce account.

Refunds: Cancel anytime

You can cancel your plan at any time from Billing in your app. Your plan keeps working until the end of the period you have paid for, and you won't be charged again. After that, your client workspaces pause until you choose a plan again. For 30 days after your plan ends you can ask for an export of your data by email to support@yayce.com (we send it within 30 days, as CSV files); it is then deleted within the following 30 days, except billing records, which tax law makes us keep (Terms of Service, section 12).

Refunds: 30-day money-back guarantee on your first payment

If yayce isn't right for you, email support@yayce.com within 30 days of your first payment and we will refund that payment in full. No questions asked.

• It covers the first payment for your yayce plan, and any add-on billed with it (such as HR).

• It applies once per agency.

• Later monthly payments are not refunded, but you can cancel at any time so you are not charged again.

Refunds: Free trials

You are not charged during a free trial. If you cancel before the trial ends, you pay nothing. If the trial turns into a paid plan, that first payment is covered by the 30-day guarantee above.

Refunds: Founding-agency offers

• Free founding months have no payment to refund. The first payment after them (at 40% off with FOUNDING40) is covered by the 30-day guarantee.

• Discounted founding plans (the FOUNDING40 code) follow this same policy: the first discounted payment is covered by the 30-day guarantee.

Refunds: How refunds are paid

Payments are processed by Polar, our merchant of record, so refunds are issued through Polar to the payment method you used. Your bank usually shows it within 5–10 business days.

Refunds: What we can't refund

• Charges from other companies, which bill you or your clients directly: your own AI provider, Twilio, Vapi, Stripe fees, domains.

• Payments for accounts we closed for breaking our Terms (such as spam or fraud).

If you open a chargeback instead of asking us, we may pause the account while it is resolved. Please email us first: it is faster.

Refunds: Questions

Email support@yayce.com. We reply within 24 hours on weekdays.

YAYCE LLC · 507 Ash St, Morrison, Missouri 65061-3002, USA · support@yayce.com

Data Processing Addendum

Effective date: October 27, 2026

This Data Processing Addendum ("DPA") is part of the yayce Terms of Service between YAYCE LLC, 507 Ash St, Morrison, Missouri 65061-3002, USA ("yayce", "we"; contact: support@yayce.com) and the agency that holds a yayce account ("Customer", "you"). It applies when we process Customer Personal Data to provide the Service.

DPA 1. Definitions

• Customer Personal Data: personal data in Customer Data (as defined in the Terms) that we process for you: for example, your clients' contacts, their end customers' messages, bookings, calls and orders, and your and your clients' team members' details inside workspaces.

• Data Protection Laws: the laws that apply to that processing, including, where they apply, the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss FADP, US state privacy laws (such as the California Consumer Privacy Act as amended, "CCPA"), Canada's PIPEDA, and Australia's Privacy Act 1988.

• "Controller", "processor", "data subject", "personal data breach" and "processing" have the meanings those laws give them. "Service provider" has its CCPA meaning.

• Subprocessor: a company we engage that processes Customer Personal Data for us.

DPA 2. Roles

• You are the controller of Customer Personal Data, or a processor acting for your clients, who are then the controllers.

• We are your processor (or subprocessor, when you act for your clients), and a service provider under the CCPA.

• You are responsible for having a lawful basis, giving the required notices and getting the consents needed for the processing you ask us to do, including through your agreements with your clients.

DPA 3. Our processing

We process Customer Personal Data only:

• to provide, secure and support the Service under the Terms;

• on your documented instructions, which are the Terms, this DPA and your use and settings of the Service (including what your team approves in the AI approval queue); and

• as the law requires, in which case we tell you first unless the law forbids it.

We tell you if we think an instruction breaks Data Protection Laws. The details of the processing are in Annex 1.

CCPA. We do not sell or share Customer Personal Data; do not retain, use or disclose it outside our direct business relationship with you or for any purpose other than providing the Service; and do not combine it with personal data we get elsewhere, except as the CCPA allows. We comply with the CCPA's obligations for service providers and tell you if we can no longer meet them.

AI. We do not use Customer Personal Data to train AI models. AI providers receive only what a task needs (Annex 3).

DPA 4. Our people

Everyone at yayce who can access Customer Personal Data is bound by confidentiality. We look inside your account only to provide the Service, or for support when your account owner grants access in the app, for the scope and time the owner chooses, with every request logged and visible to you.

DPA 5. Security

We keep the technical and organizational measures in Annex 2 and may improve them, but will not reduce the overall protection they give.

DPA 6. Subprocessors

• You authorize the subprocessors in Annex 3.

• We bind each subprocessor to data protection terms at least as protective as this DPA, and remain responsible for its performance.

• We will give at least 30 days' notice of a new subprocessor by email to the account owner. You may object on reasonable data protection grounds within that time; if we cannot address it, you may cancel the affected part of the Service and get a pro-rata refund of prepaid fees for it.

• Services you or your clients connect with your own accounts (Annex 3, part B) are not our subprocessors. They process data under your agreements with them.

DPA 7. Helping you

Taking into account the nature of the processing, we help you, by appropriate technical and organizational measures and on request:

• respond to data subjects' requests (much of this you can do yourself in the app; for the rest, email support@yayce.com). If a data subject contacts us directly about Customer Personal Data, we pass the request to you and do not answer it ourselves unless you ask;

• with data protection impact assessments and consultations with authorities, where they relate to the Service; and

• with security, using the measures in Annex 2.

DPA 8. Personal data breaches

We tell you without undue delay, and within 72 hours, after we become aware of a personal data breach affecting Customer Personal Data. We give you what we know (what happened, the data and people likely affected, likely consequences, what we are doing), update you as we learn more, and take reasonable steps to contain it. Notifying a breach is not an admission of fault.

DPA 9. Where data is processed, and international transfers

DPA 9.1 Data location

Customer Personal Data is stored and processed in India. The application servers and the database run on Oracle Cloud Infrastructure in Hyderabad, India (region ap-hyderabad-1). Email is sent and received through Amazon Web Services in Mumbai, India (region ap-south-1). Uploaded files and encrypted backups are kept off the servers in Cloudflare R2 storage. Some subprocessors process data in other countries, as Annex 3 shows.

This applies to every Customer, wherever it or its clients are based. By accepting this DPA, you acknowledge that Customer Personal Data will be transferred to and processed in India and the other locations in Annex 3, and you are responsible for telling your clients and their end customers where it is processed, as Data Protection Laws require.

DPA 9.2 Transfers from the EU, the UK and Switzerland

India has no adequacy decision from the European Commission, the UK or Switzerland. When you, or your clients, send Customer Personal Data subject to the EU GDPR, the UK GDPR or the Swiss FADP to yayce, the transfer is protected as follows, and the clauses below are incorporated into this DPA by reference:

• EU: the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 ("SCCs"):

– Module Two (controller to processor) where you are a controller, and Module Three (processor to processor) where you act as a processor for your clients;

– you are the "data exporter" and YAYCE LLC the "data importer";

– Clause 7 (docking clause) applies;

– Clause 9: option 2, general written authorization, with the notice period in DPA section 6;

– Clause 11: the optional wording does not apply;

– Clause 13: the supervisory authority is the one that has authority over the data exporter;

– Clauses 17 and 18: the law and courts of Ireland;

– Annexes I, II and III of the SCCs are completed by this DPA's Annexes 1, 2 and 3.

• UK: the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (version B1.0, in force from March 21, 2022) applies, with Table 1 completed from the parties' details, Table 2 by the Module choices above, Table 3 by this DPA's Annexes, and Table 4: either party may end the Addendum as its Section 19 allows.

• Switzerland: the SCCs apply with these changes: the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for transfers under the FADP; "Member State" includes Switzerland so Swiss data subjects can bring claims there; and references to the GDPR mean the FADP.

• Onward transfers. Where a subprocessor processes this data outside India, the UK, the EU or Switzerland (for example, in the US or China), YAYCE LLC puts in place the same protection with that subprocessor, normally the SCCs (Module Three) or the subprocessor's own approved transfer terms.

• Transfer risk. On request, YAYCE LLC will give you the information you reasonably need for a transfer impact assessment, including how requests from public authorities are handled. YAYCE LLC will tell you promptly if it receives a legally binding request from a public authority for Customer Personal Data, unless the law forbids it, and will challenge requests it considers unlawful.

• If the SCCs and this DPA conflict, the SCCs win.

DPA 9.3 Other countries

For Customers in the US, Canada and Australia, Customer Personal Data is transferred to India and the locations in Annex 3 under this DPA's protections. YAYCE LLC remains accountable for it wherever it is processed.

DPA 10. Returning and deleting data

• During the subscription, you can view and edit Customer Personal Data in the app, and we keep it while the subscription is active.

• When the subscription ends (at the end of the last paid period, or when a trial ends without a plan), you have 30 days to ask for an export.

• Exports are on request by email to support@yayce.com, delivered within 30 days of the request as CSV files. They aren't self-serve. You can also ask for one while the subscription is active, for example to answer a data subject's portability request. Exports leave out passwords, security codes, keys and uploaded files (the files on request).

• Within 30 days after that export window we delete Customer Personal Data: when you ask, or at our monthly clean-up, whichever comes first, unless the law requires us to keep it. You can ask for deletion sooner.

• Billing records and invoices for your yayce subscription are kept as long as tax law requires. They're yayce's own records about you, not Customer Personal Data in your workspaces.

• Backups: copies in backups are purged within 90 days, and are kept secure and unused until then.

• Logs containing personal data are kept for 30 days.

DPA 11. Audits

On request, we will give you the information reasonably needed to show that we comply with this DPA, including answers to a security questionnaire once a year. If that is not enough, or an authority requires it, you may audit our compliance once a year, with 30 days' notice, during business hours, at your cost, under confidentiality, in a way that does not put other customers' data at risk.

DPA 12. General

This DPA lasts as long as we process Customer Personal Data for you. The Terms' limits on liability apply to this DPA. If this DPA and the Terms conflict on personal data, this DPA wins; the SCCs win over both where they apply.

DPA Annex 1: Details of the processing

Subject matter: Providing the yayce platform to the Customer and its clients

Duration: The term of the Customer's subscription, plus the return or deletion period in DPA section 10

Nature and purpose: Hosting, storing, organizing, displaying, sending and receiving data; running automations and AI tasks the Customer sets up; delivering email, texts, calls, bookings, payments and portal access on the Customer's instructions; support; security; backups

Data subjects: The Customer's team members; its clients' team members; its clients' end customers, leads and website visitors; the Customer's and its clients' employees (HR module)

Categories of personal data: Names and contact details; company and job details; messages (chat, text, WhatsApp, email) and their content; call recordings, transcripts and summaries; bookings; orders, invoices and payment status (card details stay with Stripe); website form entries; portal sign-ins; reviews and feedback; HR records (attendance, leave, salary, visible only to HR managers); device, IP and usage data; any custom fields the Customer creates

Special categories: None. The Customer must not use the Service for special category data, or for protected health information under HIPAA or any medical or patient records. yayce is not HIPAA compliant and does not sign Business Associate Agreements (Terms, section 8)

Where: Stored and processed in India (DPA section 9), and by the subprocessors in Annex 3 in their locations

Retention: While the subscription is active; 30 days after it ends for export; deleted within 30 days after that, on request or at the monthly clean-up; backups purged within 90 days; logs kept 30 days (DPA section 10)

Frequency: Continuous

DPA Annex 2: Security measures

As of October 27, 2026.

Encryption

• HTTPS for every yayce, agency and client address, with certificates issued and renewed automatically.

• Secrets (payment-account tokens, AI provider keys, API tokens) are encrypted at rest with a master key; the app only ever shows a short hint of a saved secret.

• Database backups are encrypted before they leave the server.

Isolation and access control

• Every request is scoped to one agency and one client workspace; a workspace's records cannot be reached from another. Automated tests check this for every part of the app.

• Roles with fine-grained permissions, custom roles, and staff limited to chosen clients. An agency always keeps an owner.

• Optional two-factor sign-in (authenticator app), which an agency can require of its team or clients; a list of signed-in devices with sign-out.

• yayce staff access an account only through a grant from its owner: whole agency or one client, read-only or read-and-write, for 1, 3 or 7 days, revocable at any time. Billing, team and roles, keys and secrets, payment connections, domains and deletion are never available under a grant. Every request made under it is logged and shown to the agency.

AI safeguards

• AI teammates read through tools and can only propose changes. A person approves each proposal, and it applies once. Each teammate works in one workspace only.

• Some AI providers (such as DeepSeek) stay off until the agency opts in after a notice.

Infrastructure and operations

• The application and database run on dedicated cloud servers; the database accepts local connections only, and the app is reachable only through the web server.

• Network protection (DNS and attack mitigation) in front of yayce.com.

• Bot checks on public forms; rate limits on sensitive endpoints.

• Storage credentials scoped to a single bucket, with the least access needed.

• Point-in-time database backups (changes archived at least every minute) plus nightly backups, stored off the server. An automated job restores the latest backup on a separate server every week to prove it works.

• Every release runs the test suite first; production releases take a database restore point first and roll back automatically if the new version fails its health check.

• Logs are kept for 30 days; backups are purged within 90 days.

Email and messaging

• Bounces and complaints suppress the address; an unsubscribe link is always included in campaigns, with one-click unsubscribe.

yayce holds no third-party certification (such as SOC 2 or ISO 27001), and doesn't yet keep an audit log of agencies' own staff actions.

DPA Annex 3: Subprocessors

DPA Annex 3, part A: Subprocessors yayce engages

• Oracle (Oracle Cloud Infrastructure). What it does for yayce: Hosts the application servers and the database (production, staging and the backup-restore test server). Data involved: All Customer Personal Data. Location: India (Hyderabad, ap-hyderabad-1). When: Always

• Amazon Web Services (SES, SNS, S3). What it does for yayce: Sends all email: sign-in links, invites, password resets, portal links, booking emails, notices, campaigns, automation and assistant email; reports bounces and complaints; receives email sent to workspace inbox addresses and stores large incoming messages. Data involved: Email addresses, names, message content. Location: India (Mumbai, ap-south-1), for sending and receiving. When: Always

• Cloudflare. What it does for yayce: DNS and network protection for yayce.com; R2 storage for uploaded files (website images, portal and help files, logos) and for encrypted backups; Turnstile bot checks on public forms; routing of email sent to @yayce.com addresses. Data involved: Uploaded files; encrypted backups; visitors' IP and browser signals; support emails. Location: Global network. When: Always

• Stripe. What it does for yayce: Stripe Connect: links the Customer's and its clients' own Stripe accounts, and creates client plans, invoices, payment links and checkouts on them. Data involved: Customer and end-customer names, emails, invoice and order details. Location: United States. When: When a Stripe account is connected

• Anthropic. What it does for yayce: AI models for AI teammates and the assistant on yayce's included allowance. Data involved: The workspace content an AI task needs. Location: United States. When: When AI runs on yayce's allowance

• DeepSeek. What it does for yayce: AI models, only for agencies that opt in after a notice. Data involved: The workspace content an AI task needs. Location: China. When: Only after opt-in

• Google. What it does for yayce: Business Profile connection to read and reply to Google reviews (through yayce's Google Cloud app); Google Fonts for app themes that use them. Data involved: Business Profile data, reviewers' names and reviews; users' IP addresses (fonts). Location: United States. When: When a workspace connects Google; when a theme uses a Google font

• Browser push services (Google Firebase Cloud Messaging, Apple Push Notification service, Mozilla Push). What it does for yayce: Deliver notifications to the phone app. Data involved: Notification content (encrypted for the device under the Web Push standard, RFC 8291, so the push service can't read it); device push address. Location: United States. When: When a user turns on notifications

• Polar. What it does for yayce: Merchant of record for the Customer's yayce subscription. Data involved: The Customer's billing contact and payment details (not workspace data). When: Agency billing

• Google (Gmail). What it does for yayce: yayce's support inbox: email to support@yayce.com is forwarded there. Data involved: Whatever a support email contains, which may include workspace data the Customer sends. Location: United States. When: When the Customer emails support

Polar processes the Customer's own billing data, for which yayce is the controller; it is listed here for completeness.

DPA Annex 3, part B: Services the Customer connects (not yayce subprocessors)

• Twilio. Used for: Texts, WhatsApp, business phone numbers, missed-call text-back. Whose account: Each client's own Twilio account, connected per workspace

• Vapi. Used for: The AI voice agent: calls, recordings, transcripts. Whose account: Each client's own Vapi account, set per workspace

• Stripe (as the account holder's payment processor). Used for: Taking payments from clients and end customers. Whose account: The Customer's or the client's own Stripe account

• The Customer's own AI provider. Used for: AI tasks past the included allowance, or by choice. Whose account: The Customer's own key with the provider it picks

• Google Analytics, Plausible, Google Search Console. Used for: Analytics and search data on clients' websites, when their IDs are added. Whose account: The client's own accounts