Privacy Policy

Last updated: 13 September 2026

Yeeyoo is an AI marketing platform that generates social media content and — only when you explicitly approve it — publishes that content to the accounts you have connected. This policy explains what personal data we process, why, how long we keep it, and how you can have it deleted.

1. Who is responsible for your data

The data controller is Basecap AS, a company registered in Norway, operating the Yeeyoo service. For any question about this policy, about the data we hold about you, or to exercise any of the rights described in section 8, contact us at privacy@yeeyoo.ai.

2. What we collect

• Account data — the e-mail address and name you sign up with, and the authentication identifiers needed to keep you signed in.
• Project content — the brands, projects, briefs, tone-of-voice settings, prompts, drafts and media you create or upload in Yeeyoo.
• Facebook Page and Instagram professional account identifiers — the numeric IDs and display names of the Pages and Instagram professional accounts you choose to connect, so we can show you which destination a post is going to.
• Page access tokens — the credentials Meta issues when you connect a Page. They are stored encrypted at rest and are used only to publish content you have approved and to read engagement counts for your own Pages.
• Post content and publishing results — the text, images and video of each post, together with the outcome returned by the platform (published or failed, the resulting post ID, and any error message).

3. Why we process it

• To schedule and publish the posts you have explicitly approved, to the destinations you have selected. Yeeyoo never publishes anything you have not approved.
• To show you engagement figures for your own Pages and Instagram professional accounts, so you can see how your content performed.
• To operate the service itself: authenticating you, storing your projects, generating drafts on your request, and supporting you when something fails.
• To take payment for a paid plan and to meet the bookkeeping obligations that follow from it.

Our legal basis is the performance of our contract with you (delivering the service you signed up for), our legitimate interest in keeping the service secure and functioning, and — where required — your consent, which you give by connecting an account and which you can withdraw at any time by disconnecting it.

4. Data obtained through Meta (Facebook and Instagram)

When you connect a Facebook Page or an Instagram professional account, Yeeyoo requests only the following permissions, and nothing else:

• pages_show_list — to list the Pages you administer so you can pick one.
• pages_read_engagement — to read engagement figures for your own Pages.
• pages_manage_posts — to publish the posts you approve to your Page.
• instagram_basic — to identify the Instagram professional account linked to that Page.
• instagram_content_publish — to publish approved content to that Instagram account.

We do not request access to your personal profile, your friends, your private messages, your ad accounts, or anything else beyond the five permissions above.

Access tokens are encrypted at rest. They are never shared with a third party, never sold, and never used for advertising or profiling. They are deleted immediately when you disconnect the account, when you delete your Yeeyoo account, and when Meta notifies us that you have removed the Yeeyoo app.

5. How long we keep it

• Meta access tokens and connection data — until you disconnect, delete your account, or remove the app on Facebook. Deletion is immediate on disconnect, and within 24 hours of a deletion request received from Meta.
• Account and project data — for as long as your account exists. When you delete your account it is removed within 30 days, including from routine backups.
• Invoices and payment records — for as long as Norwegian bookkeeping law requires (currently five years), because we are not permitted to delete them earlier.

6. Who we share it with

We do not sell personal data and we do not share it for anyone else's marketing. We use the following sub-processors to run the service, each under a data processing agreement and each with access only to what their function requires:

• Render — application hosting and the primary database.
• Vercel — hosting of the web front end.
• Cloudflare R2 — storage of the images and video used in your posts.
• Anthropic — the language models that generate drafts from your briefs.
• fal.ai — image and video generation.
• Stripe — card payments and subscription billing.
• Vipps — payments for customers in Norway.

We also share content with Meta when — and only when — you publish a post to a connected Facebook Page or Instagram account. Where a sub-processor stores data outside the EU/EEA, the transfer is covered by the European Commission's standard contractual clauses.

7. Security

Access tokens and other credentials are encrypted at rest. Traffic is encrypted in transit. Access to production data is limited to the people who need it to operate the service. No system is perfectly secure, and we will notify you and the Norwegian Data Protection Authority without undue delay if a breach affects your personal data.

8. Your rights under the GDPR

You have the right to:

• access the personal data we hold about you, and receive a copy of it;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to our processing;
• receive your data in a portable, machine-readable format;
• withdraw a consent you have given, without affecting processing already carried out;
• lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) or with the supervisory authority in your own country.

Write to privacy@yeeyoo.ai and we will respond within 30 days.

9. How to delete your data

You can disconnect a Meta account, delete everything Yeeyoo holds about you, or check the status of a deletion request started from Facebook. The exact steps are on the data deletion page.

10. Children

Yeeyoo is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16.

11. Changes to this policy

If we change this policy we will update the date at the top of the page, and — for changes that materially affect you — notify you by e-mail before they take effect.