Legal
Hosted service privacy notice
Last updated: 9 November 2026
This notice explains how AB & Friends Group (Pty) Ltd (“yae”, “we”) handles personal information in the yae hosted service: your yae account at app.yae.digital, the workspaces, and the MCP endpoints that organisations use to govern their AI agents. Our website privacy policy covers the yae.digital website and emails to us. Our terms of service cover your use of the service.
1. Who we are and our two roles
- AB & Friends Group (Pty) Ltd, a private company registered in South Africa (registration number 2025/956901/07), based in Plumstead, Cape Town. Contact us, or our Information Officer, at hello@yae.digital.
- For your yae account (signing in, sign-in methods, organisations, members and plans), we decide how personal information is used. Under POPIA we are the responsible party; under the GDPR, the controller.
- Inside an organisation’s workspace (its policies, people, AI agents, approvals and evidence), we process information on that organisation’s behalf and on its instructions. The organisation is the responsible party (controller), and we are its operator (processor). If your question is about what an organisation’s workspace holds about you, please contact that organisation. We will help it answer.
2. What we collect
| When | What | Why |
|---|---|---|
| You sign in with Google | Google’s identifier for you, your email address and your display name. Google’s sign-in token doesn’t always include your email address; when it doesn’t, we ask Google’s sign-in service for the address of the Google account you just signed in with. We never receive your Google password and don’t keep Google access tokens. We ask only for the openid and email permissions. | To identify you and keep your account secure |
| You sign in with an email link | Your email address. We email you a one-time link that works once, only in the browser that asked for it, and expires after 15 minutes. Google’s sign-in service creates the link; we send it from notifications@yae.digital. | To identify you and keep your account secure |
| You manage your sign-in methods | The sign-in methods on your account and their email addresses, and a history of sign-ins, refused sign-ins, and methods added, removed or restored, with the time. This history doesn’t record your IP address. | So you can see and control how your account is used |
| Something security-related happens | When your account is signed in to, when a sign-in method is added, removed or restored, when someone tries to sign in with a removed method, and when your other browsers are signed out, we email the addresses of the sign-in methods on your account. The email says what happened, when, and, for a sign-in, which sign-in method and browser type were used (for example “Chrome on macOS”). These are service messages: you get them while the method is on your account. | To warn you about activity and changes you didn’t make |
| Your organisation’s team changes | When someone joins an organisation through an invitation, has their role changed or leaves it, we email the organisation’s owners. The email gives that person’s name and a masked email address (for example “a***@example.com”), their role, who made the change and when. | So owners know who has access to their organisation’s account |
| You use your account | Session cookies (section 6), the organisations you create or join, and your role in each (Owner, Billing or Member) | To provide the service |
| You invite someone | The role offered and, if you enter it, the invitee’s email address. You send the invitation link yourself; the invitee joins only by accepting. | To record the invitation |
| Your organisation chooses a plan | The plan and its standing. The Solo plan is free: we don’t take payments today and hold no card or bank details. | To provide the plan |
| A workspace is set up | Who requested and who approved each workspace, and when (an append-only record) | Accountability |
| Inside a workspace (as operator, section 1) | The people registry (sign-in identifier, display name, roles). AI agent identities (agent tokens are stored only as one-way hashes). Policies. Approvals with the approver’s identity and reason. An evidence record of every governed AI action: the action, its arguments, the policy decision, any approval, and the outcome. Arguments are whatever the organisation’s AI sends, and can include personal information from the organisation’s own systems. | To enforce the organisation’s rules and keep its tamper-evident record |
| Every request | IP address, browser user agent, time and requested address, in security and request logs | Security, abuse prevention and troubleshooting |
| You email us | Your email address and what you write | Support |
We don’t use analytics, advertising trackers or social media pixels in the service. We don’t sell personal information.
3. AI agents and automated actions
- yae doesn’t run an AI model, and we don’t send your information to any AI provider.
- An organisation connects its own AI client (for example Claude Code) to its workspace.
- yae checks each action the AI attempts against the organisation’s policy. Where the policy requires it, yae asks a named person to approve. It records the result, and only then lets the action reach the organisation’s own system.
- Results of permitted actions go back to the organisation’s AI client, and so reach the AI provider the organisation chose, under the organisation’s own agreement with that provider.
- yae doesn’t make decisions about individuals. It enforces rules the organisation writes. Where an organisation uses AI for decisions that affect people, the organisation is responsible for the transparency, review and redress those decisions need.
4. Why we’re allowed to use it
- Our agreement with you and your organisation (terms of service), and steps towards it.
- Our legitimate interests in securing the service, preventing abuse, warning you about security changes, and keeping an accountable record of our own operators’ actions.
- Legal obligations, for example answering lawful requests from authorities.
- Inside workspaces: the organisation’s instructions and its own lawful basis.
5. Who we share it with
| Provider | What for | Where |
|---|---|---|
| Google Cloud (Cloud Run, Cloud SQL, Compute Engine, Cloud KMS, Secret Manager, Cloud Logging, Cloud Storage, Cloud Load Balancing and Cloud Armor) | Hosting, database, keys, logs, backups, network edge | South Africa (africa-south1, Johannesburg) for the service and its data. Network edge: Google’s global network. |
| Google Identity Platform | Sign-in, and creating email sign-in links | Global Google service |
| Google Workspace | Sending sign-in links, security notices and team notices (from notifications@yae.digital), and our support email (hello@yae.digital) | Global Google service |
These providers act on our instructions under contracts that require security and confidentiality. We’ll give organisations notice before adding a provider that processes workspace data. We don’t use a payment provider today; if we start taking payments, we’ll add it here first. We disclose information to authorities only where the law requires it.
6. Cookies
The service uses only cookies that are strictly necessary for signing in and security:
__Host-yae_account: your account session;__Host-yae_session: your workspace session;__Host-yae_handoff_state: a five-minute cookie that links signing in to your account with opening your workspace;__Host-yae_account_loginand__Host-yae_login: short-lived sign-in state;__Host-yae_email: ties an email sign-in link to the browser that asked for it, for 15 minutes.
All are HttpOnly, sent only over HTTPS, and only to the site that set them. There are no analytics or advertising cookies, so we don’t ask for cookie consent.
7. Where it’s stored, and processing outside South Africa
Service data, including workspace evidence and backups, is stored in Google Cloud in South Africa. Some processing happens outside South Africa:
- Google’s network edge, which terminates encrypted connections;
- Google Identity Platform, for sign-in;
- Google Workspace, for email.
For these we rely on Google’s data processing terms, which bind Google to protect personal information in a way substantially similar to POPIA (section 72 of POPIA) and, where it applies, provide the GDPR’s safeguards for international transfers.
8. How long we keep it
| Information | Kept |
|---|---|
| Your account: organisations, memberships, invitations, sign-in methods and their history | While the account exists, then 12 months after it’s closed. Then deleted. |
| Workspace evidence | While the workspace exists. Each plan shows how long it’s set to keep evidence (Solo: 30 days), but yae doesn’t yet delete evidence automatically on that schedule. When a workspace is closed, its evidence is deleted within 12 months; the organisation can export it first. |
| Request and security logs | 30 days |
| Records of our operators’ actions | 400 days |
| Backups | Daily database backups for 30 days, with 7 days of point-in-time recovery. Weekly database exports for 120 days. Workspace disk snapshots for 14 days. Copies made before a software update are deleted within 120 days. Deleted information can stay in a backup until that backup expires. |
Evidence records can’t be edited or partly erased. They form a tamper-evident chain: removing one entry would break the record for the whole organisation. A person can be removed from a workspace at once, but their past entries stay in the organisation’s record until it’s deleted, under the organisation’s lawful basis for keeping an audit record.
9. Your rights
You may ask us:
- to confirm what we hold about you, and give you a copy;
- to correct or delete it;
- to object to or restrict its use;
- and you may withdraw any consent.
You can see and remove your own sign-in methods in your account. For anything else, including closing your account, email hello@yae.digital. We may need to check who you are. For information in an organisation’s workspace, we’ll pass your request to that organisation and help it respond.
You may complain to the Information Regulator of South Africa (inforegulator.org.za, enquiries@inforegulator.org.za) or, in the EU or UK, to your data protection authority.
10. Security
- Encryption in transit (TLS 1.2 or later) and at rest.
- Each workspace runs as its own process and operating-system user.
- Email sign-in links work once, only in the browser that asked for them, and expire after 15 minutes.
- Sign-in methods are never joined because their email addresses match; you link them yourself, and we email you when they change.
- Signed, single-use links between your account and your workspace.
- Default-deny access, and every action by our operators is attributed to a verified person.
No system is perfectly secure. If a breach affects your personal information, we’ll notify you and the Information Regulator as POPIA requires, and we’ll notify affected organisations promptly. To report a security issue, email hello@yae.digital.
11. Changes
We’ll update this notice when our practices change, and show the date at the top. We’ll tell account owners about significant changes by email before they take effect.