Privacy Policy

Last updated: August 22, 2026

1. Who we are

This site and the services it describes are operated by Yaya Tech PBC, a public benefit corporation incorporated in the State of California, United States of America ("Yaya Tech", "we"). Privacy contact: andre@yaya.tech.

This policy follows Peru's Personal Data Protection Law No. 29733 and its Regulation (Supreme Decree 016-2024-JUS), and applies, where relevant, to users elsewhere (including California's CCPA/CPRA for residents of that state).

2. Two kinds of people, two roles

• Operators: businesses and machine owners who create a yaya.cash account, install the YAYA app and connect wallets or machines. For their data, Yaya Tech is the data controller.
• Payers: people who pay an Operator. Their data reaches yaya.cash only as part of the Operator's payment notification. For that data the Operator is the controller and Yaya Tech acts as processor.

If you paid at a machine or business that uses yaya.cash and have questions about your data, contact that business first. You can also write to us and we will help route your request.

3. What we collect

3.1 Data you give us when you sign up

Phone number, email, business name, machine addresses (if any), and the wallets you choose to connect. If you buy a plan, the payment reference.

3.2 Data the app reads from your phone (only with your permission)

The YAYA app requests Android's notification access permission. With it, and only for the wallet or bank apps you enable, it reads and sends to our servers: amount, currency, payer name or partial phone as shown in the notification, operation code if shown, timestamp and source app. The app does not read your chat history, contacts, gallery or other apps' content; it only sees the text each app shows in its notification.

3.3 Machines and devices

Vending machines fitted with our module send telemetry: machine id, connection status, selected product and price, sale outcome, errors. The module has no camera or microphone.

3.4 Messaging (beta)

If you enable messaging channels (e.g., WhatsApp), we read payment-confirmation notifications to match them with the wallet, and the conversation history with each customer to keep continuity.

3.5 Technical and website data

Device model, Android and app version, a device identifier we generate, IP address, timestamps, usage counters and error logs. The yaya.cash site keeps a standard access log (IP, pages, browser, date). No tracking cookies or third-party ads; the dashboard stores a session cookie and your language preference in your browser.

4. How we use data

• Confirm payments, unlock machines, record sales and service charges (including plans of other Yaya Tech products paid through yaya.cash), and show your history.
• Verify your identity at sign-up and protect accounts against abuse and fraud.
• Send operational notices (payments, machine faults, Service changes) and, if you opted in, news.
• Measure and improve the Service with aggregate or anonymised data. Meet legal obligations (including accounting and anti-money-laundering rules where applicable).

Legal basis. Your consent (at sign-up and when enabling each permission) and performance of our contract with you. For Payers' data we act on the Operator's instructions. No targeted advertising; we do not sell or rent personal data.

5. Automated decisions

Payment confirmation is automatic: we match the wallet notification against the pending sale (amount, time, machine). If a notification is ambiguous we may use an AI model to interpret it. An unrecognised payment is never "invented": it stays pending for the Operator to review in the dashboard against the wallet receipt.

6. Who we share data with

Wallets and banks. yaya.cash reads the notifications those apps show on your phone. We have no agreement with them, do not access your accounts and do not send them your data; they process your data under their own policies.

We may switch providers within these categories and will update the table. We may also disclose data where a law or competent authority requires it, or in a merger or acquisition, with prior notice.

7. How long we keep data

• Account and settings: while the account is active and up to 90 days after closure, unless you ask for immediate deletion.
• Payment and sales records: while the account is active, then for as long as applicable accounting and tax rules require (up to 5 years), for that purpose only.
• Machine telemetry: 12 months. Technical and access logs: up to 12 months. Verification codes: minutes.

International transfers

Yaya Tech is a U.S. company and our servers and providers may be outside Peru (mainly in the United States and the European Union). By using the Service you consent to this cross-border data flow. We require providers to give confidentiality and security guarantees equivalent to this policy.

Security

We use encryption in transit (TLS) across the Service; access keys are stored encrypted; administrative access requires separate keys and is logged; usage limits curb abuse. No system is infallible: if we detect a breach affecting your data we will notify you without undue delay and, where required, the Peruvian data-protection authority.

Your rights

You may access your data, rectify it, delete it, object to processing, withdraw consent and request portability (ARCO rights). Write to andre@yaya.tech from your registered email or number; we answer within 10 business days (access: 20), free of charge. If you believe we did not handle your request properly you may complain to Peru's National Authority for Personal Data Protection (ANPD). California residents also have the rights granted by the CCPA/CPRA; we do not sell or "share" personal data within the meaning of that law.

Minors

The Service is intended for businesses and people aged 18 or over. We do not knowingly register accounts for minors.

Changes to this policy

We will notify material changes through the Service or by email before they take effect. The "last updated" date shows the version in force.

Contact

Yaya Tech PBC · andre@yaya.tech. Consumers in Peru may also use our Libro de Reclamaciones.