Privacy Policy
What Yibbit collects, why, and how to make us stop.
Last updated 28 July 2026
This policy covers two quite different groups of people, and it's worth being clear up front about which one you are:
- People who signed up — you joined the waitlist or use the app. We got your details from you.
- Businesses we found — you run a local business and Yibbit has a record of it. You never gave us anything; we collected it from Google Places and your own public website. There's a separate page for you, including how to be removed.
Cookies and tracking
We set exactly one cookie, wsl_session, and only after you sign
in. It stores your login session, is HTTP-only, and is marked Secure and
SameSite=Lax. It is strictly necessary to operate the service, which is why
there is no cookie banner on this site — there is nothing to consent to. If
that ever changes, this section changes with it and you'll be asked.
If you signed up
What we collect
| Data | Why | Basis |
|---|---|---|
| First and last name | To address you properly when we get in touch | Consent |
| Email address | To tell you when early access opens; to run your account if you have one | Consent, then contract once you're a customer |
| Business type and city | To judge which markets and business types to open to first | Consent |
| Which form you used, and when | To understand which parts of the site actually work | Legitimate interests |
| The consent wording you were shown, and the time you agreed | So we can show what you actually agreed to, not just that you did | Legal obligation |
Our web server keeps ordinary request logs, which include IP addresses, for a short period for security and debugging. We don't build profiles from them.
Marketing email
The marketing opt-in on our signup forms is separate from accepting this policy, unticked by default, and entirely optional — declining it does not affect your place on the waitlist. If you opt in, every marketing email we send carries a working unsubscribe link and our postal address. If you don't, we will still email you about the thing you signed up for, and nothing else.
How long we keep it
Waitlist entries are kept until we launch and you've either become a customer or told us you're not interested, and in any case no longer than two years from your last interaction with us. Ask and we'll delete it sooner.
If you run a business we found
Yibbit searches Google Places for businesses in a given city and trade, and runs an automated technical audit of their public websites. If you're a sole trader, or your business contact details are your personal ones, that record is personal data about you and this policy applies to it.
We rely on legitimate interests for this — specifically, identifying businesses whose websites have problems our customers can fix. You have an absolute right to object, and we will honour it. The full detail, including what we hold and a form that actually removes it, is on the business data page.
Who we share it with
We do not sell personal data, and we do not share it for anyone else's marketing. We use these providers to run the service:
| Provider | What for | Where |
|---|---|---|
| Google Cloud Platform | Hosting, screenshot storage | United States |
| Neon | The application database | United States |
| Google Firebase / Identity Platform | Sign-in and account security | United States |
| Google Maps Platform | Business listing data | United States |
| Anthropic | The AI that writes audit summaries | United States |
| Google Workspace | Sending our email | United States |
| Cloudflare | Getting traffic to our server securely | Global edge network |
These are US-based, so data about people in the UK or EU is transferred outside the UK/EEA. Those transfers rely on the providers' standard contractual clauses. We'll also hand over data where the law actually requires it, and we'd tell you unless we were forbidden from doing so.
Your rights
If you're in the UK or EU you have the right to get a copy of your data, correct it, delete it, restrict or object to how we use it, take it elsewhere, and withdraw consent at any time. We don't make automated decisions that have a legal or similarly significant effect on you.
Email [email protected] and we will respond within one month. There's no charge, and you don't need to explain why. If we've got it wrong you can complain to the UK's Information Commissioner's Office at ico.org.uk, or to your local supervisory authority in the EU — though we'd rather you came to us first.
If you're in California: we don't sell or share personal information as those terms are defined by the CCPA, and we haven't in the past 12 months.
Security
Traffic is encrypted in transit, the database requires TLS, the application connects with a least-privilege account, and audit screenshots are served through short-lived signed URLs rather than public links. No system is perfect; if you've found a problem, please tell us at [email protected] and we'll treat it seriously.
Children
Yibbit is a business tool and isn't intended for anyone under 16. We don't knowingly collect their data.
Changes
If we change this policy materially we'll update the date above, and we'll email you if you're on our list and the change actually affects you.
Who we are
Yibbit is operated by Josiah Bedford, trading as a sole trader.
Postal address: 6080 N Marks Ave, APT 126, Fresno, CA 93711, USA
General enquiries: [email protected]
Data protection and privacy requests: [email protected]