Your data, in plain words.

What we collect, why, who helps us process it, and how long we keep it.

Last updated 1 October 2026

Who is responsible

yellow3 ApS, CVR 44954087, Hovedgaden 43, 2970 Hørsholm, Denmark, is responsible for your account data. Contact: use Contact support at the bottom of every page.
When your crew works with your own customers’ details (for example in an email you choose), we process them on your behalf, as your processor. We offer business customers a data processing agreement on request.

Your email address, to sign you in.
What you tell us about your business: your brief, your answers, your prices and your review link.
The work your crew prepares for you, and whether you kept or dismissed it.
If you connect Gmail: read-only access, used only when you start a job, and only for up to 10 recent conversations that look relevant.
Billing details are handled by Stripe. We see your subscription, what you paid and your billing country, never your card number.
Invoices and quotes you ask your crew to keep an eye on: your customer’s name and email address, the invoice number or what the quote was for, the amount, the due date or the date you sent the quote, your notes, and what you tell us happened. They are kept with your account until you ask us to delete it.
How you found us, when you create an account: the website that sent you or the campaign tag in the link you followed, and the first page you saw. It helps us learn where our customers come from. Nothing is stored in your browser for this.
Basic technical logs, such as when a page was requested, to keep the service running and secure.
If you accept analytics cookies, Google Analytics records how you use this website, such as the pages you visit, your type of device and your approximate location. We use this only to improve the site, never for advertising. You can change your choice any time under Cookie settings at the bottom of every page.

Email text your crew reads is cleared from our system within about 20 minutes. The record that a scan happened is deleted after 30 days.
Your account, business information and your crew’s work are kept until you ask us to delete your account.
Billing records are kept for 5 years, as Danish bookkeeping law requires.

Supabase stores our database, in the EU (Ireland).
Vercel runs our website and servers, in the EU (Ireland).
OpenAI prepares drafts and research. It receives only the text needed for the task you started. Under OpenAI’s API terms it does not use this data to train its models, and it may keep it for up to 30 days to check for misuse, unless the law requires longer. OpenAI may process data in the United States. This transfer is covered by OpenAI’s standard data processing terms, including the EU standard contractual clauses.
Stripe handles payments.
Google provides the Gmail connection, only if you choose to connect it.
Namecheap Private Email sends our sign-in emails.
Google Analytics measures visits to our website, only if you accept analytics cookies.

You can ask to see, correct, export or delete your data by using Contact support at the bottom of every page.
You can disconnect Gmail at any time on your crew page, and remove our access in your Google account too.
If you think we handle your data wrongly, you can complain to the Danish Data Protection Agency (Datatilsynet).