Privacy policy

Privacy Policy

This policy describes the ways we collect, store, use and protect your personal and company information. You accepted this policy when you signed up for our Service. We may amend this policy at any time by posting a revised version on our website. The revised version will be effective at the time we post it. Should a revision prove unacceptable to you, please contact us at support@yardstone.com

Our Commitment To Privacy

Your privacy is important to us. To better protect your privacy, we provide this notice explaining our online information practices and the choices you can make about the way your information is collected and used. It represents our good-faith efforts to ensure your privacy and provide you with a great service.

1. What information do we collect?

This applies to all information collected or shared within the Yardstone application.

Information you provide

We collect personal information that you voluntarily provide when you register such as:

• Name
• Phone number
• Email address
• Job title

We do not request sensitive personal information. However, files, emails, or records you choose to connect or sync (see Section 12) may contain whatever information you include in them, which could include sensitive data; we process that content only to provide the features described in this policy.

Information you Upload Or Link with Yardstone

We collect and store data you share with us or give us permission to access. This includes but is not limited to:

• Emails sent or forwarded to your Yardstone project address
• Files linked via cloud storage providers (see Section 12 for details)
• Records you request we sync from accounting systems

Information collected automatically

When you visit our Services, we automatically collect certain technical data:

• Log & usage data — IP address, browser type, pages viewed, timestamps, and in-app actions
• Device data — device identifiers, hardware model, operating system, ISP or carrier
• Location data — derived from your IP or device GPS. You can opt out via device settings, though some features may be affected.

We also collect information via cookies and similar technologies. See Section 4 for details.

2. How do we process your information?

We only process your data when we have a valid legal basis to do so. Purposes include:

• Account creation and authentication
• Responding to your inquiries and support requests
• Evaluating and improving our Services and marketing
• Identifying usage trends
• Complying with legal obligations

3. When and with whom do we share your information?

We may share your information in the following situations:

• Business transfers — during a merger, acquisition, financing, or sale of company assets. See Section 12 for exclusions related to data accessed via third-party APIs.
• Google Maps Platform APIs — to power location-based features.

We do not sell your data for monetary consideration. Some of the third-party analytics technologies on our marketing website (see Section 4) may qualify as a "sale" or "sharing" of personal information under certain US state privacy laws. We do not engage in this on the Yardstone web application, and it never involves data accessed through Google APIs. You can opt out as described in Section 11.

4. Cookies and other tracking technologies

We use cookies, web beacons, and pixels to maintain security, save your preferences, support core site functions, and understand how our Services are used. We work with third-party analytics and business-intelligence providers — currently Google Analytics, PostHog, and ZoomInfo — to measure usage of our website and improve our Services. We do not use these technologies, or the data they collect, for advertising.

One of these providers, ZoomInfo, identifies business visitors to our marketing website. This is used only on our public website, not within the Yardstone web application, and does not involve any data accessed through Google APIs. This identification may qualify as a "sale" or "sharing" of personal information under certain US state privacy laws; you can opt out as described in Section 11, and we honor Global Privacy Control (GPC) browser signals as a valid opt-out.

These website analytics technologies apply to visitors of our marketing website and Services. They do not apply to data we access through Google APIs (including Google Drive), which is governed solely by Section 12.

Google Analytics

We use Google Analytics to understand how our Services are used. You can opt out at tools.google.com/dlpage/gaoptout.

5. AI-based products

We offer features powered by artificial intelligence through third-party AI providers, including Anthropic and Google Cloud AI. Your inputs, outputs, and related information may be shared with these providers to operate AI features. Where these AI features operate on data accessed through Google APIs (including Google Drive), that data is handled as described in Section 12: it is processed only to provide the feature to you, our AI providers are contractually prohibited from using it to train or improve their models, and it is not used to develop, improve, or train any generalized or non-personalized AI or machine-learning models.

Our AI products are used for: text analysis, data extraction, AI automation, AI insights, and AI applications. You must not use our AI products in ways that violate any AI provider's terms or policies.

6. How long do we keep your information?

We retain personal information only as long as necessary for the purposes described in this notice, or as required by law. We will not keep your information longer than 180 days after your account is terminated.

When there is no longer a legitimate need to process your data, we will delete or anonymize it. If immediate deletion is not possible (e.g., data held in backups), we will securely isolate it until deletion is feasible.

7. How do we keep your information safe?

We have implemented appropriate technical and organizational security measures to protect your personal information. However, no internet transmission or storage technology is 100% secure. We cannot guarantee that unauthorized parties will never access your data. Please only access our Services within a secure environment.

8. Do we collect information from minors?

We do not knowingly collect data from or market to anyone under 18. By using our Services, you confirm you are at least 18, or a parent/guardian consenting on behalf of a minor dependent.

If we learn we have collected data from someone under 18, we will deactivate the account and promptly delete the data. Contact us at support@yardstone.com if you believe we have collected data from a minor.

9. Your privacy rights

Depending on your location, you may have various rights over your personal data. You can exercise them by contacting us at any time:

• Withdraw consent — contact us using the details in Section 13. Note this doesn't affect lawfulness of prior processing.
• Review or update your account — log in to your account settings or contact us.
• Terminate your account — contact us; we will deactivate your account and remove your data from active databases (some data may be retained for legal or fraud-prevention purposes).

For cookie preferences, most browsers allow you to remove or block cookies — note this may affect certain features of our Services.

Email support@yardstone.com with privacy questions or requests.

10. Do-not-track controls

We do not currently respond to Do-Not-Track (DNT) browser signals, as no uniform technical standard for recognizing and implementing DNT has been finalized. If such a standard is adopted, we will update this notice.

California law requires us to disclose this position: we do not respond to DNT signals at this time.

11. US residents' specific privacy rights

Residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia may have the following rights:

Personal information collected (past 12 months)

How to exercise your rights

Submit a data subject access request or email support@yardstone.com. Authorized agents must provide written, signed permission from you. We may need to verify your identity before processing requests.

Do Not Sell or Share My Personal Information

To opt out of the "sharing" of personal information for analytics described in Sections 3 and 4, email support@yardstone.com or use the opt-out controls on our website. We also honor Global Privacy Control (GPC) browser signals as a valid opt-out request, and will treat a GPC signal as a request to stop this sharing for your browser automatically.

Appeals

If we decline your request, you may appeal by emailing support@yardstone.com. If your appeal is denied, you may file a complaint with your state attorney general.

California "Shine the Light" law

California residents may request, once per year and free of charge, information about personal data disclosed to third parties for direct marketing. Submit such requests in writing using the contact details in Section 13.

12. Data shared via third-party services

Limits on Your Google Drive Data

If you link Yardstone with your Google account or Google Drive, our use of that data is subject to these additional restrictions:

• What we access and why. To sync the folders you choose — including files you add to them later — Yardstone uses Google's read-only Drive scope (drive.readonly). Google does not offer a folder-level scope that also covers newly added files, so this is the narrowest scope that supports continuous folder sync. Although this scope technically grants read access to your Drive, Yardstone only accesses, downloads, and processes the specific folders you designate for syncing. We do not read or index other files in your Drive.
• Use limited to features you can see. We use the data we access only to provide and improve user-facing features of Yardstone that are visible and prominent in its interface — for example, syncing your selected folders, extracting text from documents (such as OCR on invoices), and indexing their contents so you can search and retrieve them. We do not use this data for any other purpose.
• AI and machine learning. We do not use, retain, or transfer your Google Workspace data to develop, improve, or train generalized or non-personalized AI or machine-learning models. Where AI-powered features operate on your data — such as answering questions about your own documents — they do so solely to provide that feature to you, and any third-party AI providers we use are contractually prohibited from training their models on your data or using it for any purpose other than serving you.
• Copies of your files. Yardstone stores copies of the files in your selected folders and keeps them in sync as you add or change files, so we can index them and provide search and retrieval. We do not copy data outside your selected folders. We retain these copies only while your Google Drive is connected. If you disconnect Google Drive, we delete the synced copies, including any held in backups, within 30 days. If you close your account, your data is removed as described in Section 6.
• No sale, no ads, no transfers. We do not sell or transfer your Google data to third parties — including advertising platforms, data brokers, or information resellers — and we do not use it to serve ads (including retargeting or personalized or interest-based advertising) or to determine credit-worthiness. We share this data only with service providers who process it on our behalf to deliver these features under confidentiality obligations, with your consent, where necessary for security, or to comply with applicable law. We may also transfer this data as part of a merger, acquisition, or sale of assets, in which case we will obtain your explicit consent before your Google data is transferred.
• Limited human access. Extraction, indexing, and search are performed by automated systems. We do not allow any person to read your Google data unless: (a) you have given us your affirmative agreement to view specific files — for example, when you request support and authorize us to access them; (b) it is necessary for security purposes, such as investigating a bug or abuse; (c) it is necessary to comply with applicable law; or (d) the data has been aggregated and anonymized and is used for internal operations consistent with applicable privacy and legal requirements.
• Compliance. Yardstone's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

13. Updates to this notice

We may update this Privacy Notice periodically. The date at the top reflects the latest revision. We may notify you of material changes by posting a notice or contacting you directly. We encourage you to review this page regularly.

14. How to contact us