Privacy draft
How Yrka handles customer and workforce operations data
This launch draft describes what Yrka stores, why it stores it, and the limits of the current service. It should be reviewed by counsel before public launch.
Data We Store
Yrka stores organization, user profile, employee record, timecard, schedule, job, message, company resource, training, task, acknowledgement, notification, import, search, payroll-prep, document metadata, uploaded file, billing account, support, and audit information entered into or generated by the service.
Stripe handles standard payment details. Yrka stores Stripe customer, subscription, plan, billing status, and webhook event metadata, but not full card numbers.
How We Use Data
We use customer data to provide the hosted product, authenticate users, enforce account permissions, support billing account operations, run imports, produce permission-scoped search results, route notifications, support AI-assisted product features when enabled, debug errors, investigate abuse, and maintain audit history.
Customer workforce data should not be used for advertising. Marketing analytics, when enabled in production, should be limited to public-site usage measurement and should be described in the cookie notice.
AI Features
AI-assisted admin, official Manual, and Resources chat features may send prompts and selected product context to a configured AI provider when the feature is enabled. Resources chat uses approved prepared records rather than every uploaded draft or file. Customers should review AI outputs before relying on them.
AI output is not legal advice, HR advice, payroll processing, tax filing, safety advice, or a compliance determination.
Cookies And Analytics
The product uses authentication/session storage required to operate the service. The public site may use Vercel Analytics in production for aggregate page and performance measurement and Google Analytics 4 only after the visitor accepts the marketing analytics cookie.
Yrka should not add advertising pixels or cross-site behavioral advertising without updating this policy, the cookie notice, and the subprocessor list.
Retention And Deletion
When paid access ends, customer data remains available for export or reactivation for 30 days unless a support-approved exception applies.
After that window, organization data is eligible for deletion. Backups may retain deleted data until the backup retention period expires.
Deletion requests should be scoped to the requesting customer account and reviewed before action. Some operational records may be retained where needed for security, billing, abuse prevention, support, audit integrity, dispute handling, or legal obligations.
Exports should be prepared for the authorized customer owner or approved administrator. Customers are responsible for protecting exported files after they leave Yrka.
Customer Responsibilities
Customers are responsible for assigning owner/admin access carefully, entering accurate information, reviewing outputs before relying on them, and meeting their own payroll, tax, legal, HR, recordkeeping, and employee-notice obligations.
Customers are responsible for telling employees and other users what data the customer chooses to collect in Yrka, what policies apply to the workplace, which connected providers the customer authorizes, and who inside the customer organization may access or export records.
Customers should review AI-assisted output, imported records, provider sync results, and prepared exports before relying on them. Yrka helps organize the workflow; it does not replace the customer's professional review obligations.
Security And Access
Yrka uses authentication, organization scoping, role and permission checks, row-level security, private storage for employee documents, signed URLs for sensitive file access, audit events, and server-side privileged seams to protect customer data.
No access model is useful if customer administrators grant broad access casually. Customers should review owners, admins, manager roles, provider connections, and employee visibility settings as part of rollout and offboarding.