Privacy Policy

1. Who we are

YAAA is provided by NxisAI LLC, a Michigan limited liability company (“NxisAI”, “we”, “us”). This policy covers the yaaa command-line tool, its agent skills and MCP server, the YAAA service it talks to, the web desk, and yaaa.io. During the beta, YAAA is for people 18 and older in the United States. Questions or requests: support@nxis.ai.

2. What we collect

Your account and devices

• A random account ID, created when you run yaaa init.
• Device names, for example “jane@laptop” (by default, your computer’s user and host name), and for the web desk, the browser and system (for example “Chrome on macOS”).
• The IP address an account was created from, and of failed recovery attempts, to limit abuse.
• Sign-in records: session tokens and your recovery key are stored only in hashed form. For passkeys, we store the credential ID, the public key, the name you give it, and when it was added and last used. Face ID, Touch ID, and fingerprints never leave your device.

Your shopping

• Searches your agent runs, with their filters, and the products and stores they involve.
• Quotes, purchases (items, totals, status, confirm links), and the order number, carrier, and tracking number the store sends back.
• Price watches, recurring orders, spending limits, and the alerts we send you.

yaaa Plus billing

• If you subscribe to yaaa Plus: your Stripe customer ID, your subscription’s status, plan, and billing interval (monthly or yearly), its renewal or end date, and a record of billing events (such as a payment, a failed payment, or a cancellation). Your card details, name, billing address, and the email you give at checkout are collected by Stripe, our payment processor, not by YAAA (see section 5).

Alert channels you turn on

• An email address, or a Discord webhook URL, if you ask YAAA to send alerts there.

Technical data

• When YAAA talks to our service: IP address, YAAA version, time, and errors, kept in server logs for security and troubleshooting. Once a day at most, YAAA checks yaaa.io for a newer version.

The merchant waitlist

• If you join it: your name, email, store address and platform, what you sell, order volume, interests, and any note.

3. What we don’t collect

• Payment details, shipping address, and your sign-in to Shop Pay, Apple Pay, or Google Pay. You enter those in the store’s own checkout; YAAA never sees them.
• Card numbers for yaaa Plus. You pay for yaaa Plus at Stripe Checkout; Stripe processes your payment details, and YAAA never receives your card number.
• Your conversations with your AI agent. We only receive the requests the agent makes to YAAA, such as a search or a quote.
• Your shopping preferences (sizes, budgets, favorite brands), which YAAA keeps on your device.
• Product images. Your device loads them straight from the store when it shows them; we don’t store them.

4. How we use it

• To run YAAA: search, quote, create checkouts, send confirm links, run price watches and recurring orders, and send the alerts you turned on.
• To keep YAAA secure: sign-in, rate limits, abuse and fraud prevention.
• To support you, fix problems, and improve YAAA.
• To produce demand insights for merchants. These are totals (for example, how many searches a product or store got) and never identify you.
• To tell you about changes to YAAA or these policies, and to meet legal obligations.

We don’t sell your personal information, and we don’t use it for advertising.

5. Who we share it with

• Stores and Shopify, to do what you ask: searches go to Shopify’s catalog, and quotes and checkouts go to the store, with the items you chose. You give the store your details yourself, at its checkout.
• Stripe, our payment processor for yaaa Plus. Stripe processes your payment details and billing address, uses the billing address to calculate sales tax, and sends receipts and billing emails. Stripe handles that information under its own privacy policy. We give Stripe your YAAA account ID, so a payment can be matched to your account.
• Service providers who run YAAA for us under contract: Google Cloud (hosting and databases), an email provider (if you turn on email alerts), and Discord (if you turn on Discord alerts; we also use Discord internally for merchant waitlist sign-ups).
• Our Discord community is run on Discord, under Discord’s terms and privacy policy. What you post there is public to its members. We don’t connect Discord accounts to YAAA accounts.
• Merchants receive demand insights only as totals, never your identity.
• For legal reasons, when required by law or to protect people, YAAA, or our rights.
• In a business transfer, such as a merger or sale, under this policy.

6. Cookies and the website

yaaa.io uses no cookies and no analytics or advertising trackers. It loads one outside resource, fonts from Google Fonts, which, like any web request, receives your IP address and browser details. The structured data (JSON-LD) that describes each page for search engines and AI agents is part of the page itself; it collects nothing.

Some links to stores on yaaa.io are affiliate links (see How we make money). When you click one, the affiliate network (Sovrn) and the store may set their own cookies to credit the sale; yaaa.io itself still sets none.

The web desk uses one cookie, which keeps you signed in for up to 30 days. It’s needed for the desk to work and is never used for tracking.

7. How long we keep it

• Account and shopping data: while your account exists. Ask us to delete it at any time.
• yaaa Plus billing records: while your account exists, and after that for as long as we need them for tax and accounting records. Stripe keeps its own records under its privacy policy.
• Web desk sessions: 30 days at most. Signed-out and expired sessions stop working immediately.
• Server logs: a limited time, currently up to 30 days.
• Merchant waitlist entries: until you ask us to remove yours, or until we no longer need them for onboarding.
• Demand insights may be kept as totals that don’t identify anyone.

8. Security

We use encryption in transit (HTTPS), store sign-in secrets only in hashed form, limit who can access data, and keep YAAA’s own systems up to date. No system is perfectly secure, so please keep your recovery key and devices safe too.

9. Your choices and rights

• Alerts: turn email or Discord alerts off at any time (yaaa notify or the web desk).
• Devices and passkeys: sign devices out and remove passkeys on the web desk.
• Access, correction, and deletion: email support@nxis.ai with your YAAA account ID (yaaa whoami). Because accounts have no email, we may ask you to confirm the request from a device signed in to the account.

Depending on your state (for example California, Colorado, Connecticut, Virginia, and others), you may have the right to know what personal information we have about you, to get a copy, to correct it, to delete it, and to opt out of its sale, “sharing” for targeted advertising, or profiling. We don’t sell or share personal information in those ways. We won’t treat you differently for using your rights. You can use an authorized agent; we may ask them for proof of permission. If we deny a request, you can appeal by replying to our answer.

10. Children

YAAA is for adults. We don’t knowingly collect information from anyone under 18. If you believe a minor is using YAAA, contact support@nxis.ai and we’ll delete the account.

11. Where your data is

During the beta, YAAA is offered only in the United States, and your information is stored and processed in the United States.

12. Changes

We may update this policy. We’ll change the date at the top and, for material changes, tell you before they apply, for example on yaaa.io or in YAAA itself. Contact: NxisAI LLC, support@nxis.ai.