Privacy policy

Please read this Privacy Policy carefully to understand our policies and practices regarding your information and how we will treat it.

1. WHO ARE WE?

Ylee Studio LTD ("Ylee", "Controller", "we") is a technology-driven company offering the service for creating the ad and social creatives.
You may find our contacts below (Section 17).
If you have a question concerning the processing of your Personal data or other data, you may contact us any time via [email protected].
The purpose of this privacy policy ("Privacy Policy") is to inform you of the steps we take regarding the collection, processing, and use of the Personal data and other data you provide to us when (i) using the website https://instories.com ("Website"), (ii) installing and using our mobile applications that can be downloaded from the App Store or Google Play ("Mobile apps"); and (iii) using our Free Services and Services.
We have tried to do our best to make this Privacy Policy easy for you to understand and to enable you to navigate easily through its contents.

2. GENERAL PROVISIONS & SERVICE

This Privacy Policy is applicable to the processing of Personal data of the data subjects located in the European Union ("EU") and the European Economic Area ("EEA") by Controller in respect of the following: Website, Mobile apps and constant improvements and all other future services to be delivered by Controller to its Users inside the EU and the EEA.
From time to time, we may develop new or offer additional services. They'll also be subject to this Privacy Policy unless stated otherwise when we introduce them.
This Privacy Policy is not the Terms available at https://instories.com/terms-and-conditions, which is a separate document. The Terms outline the legal contract between you and Controller for using the Services.
This Privacy Policy is also applicable to the processing of Personal data of US residents. We have included further information about rights and disclosures as required under the California Consumer Privacy Act ("CCPA").

3. DEFINITIONS AND INTERPRETATION

The following definitions apply to this Privacy Policy:
Data subject, User, "you" or "your" means:
visitors to our Website;
Users to Free Services or Services we offer through our Website or Mobile apps;
Representatives mean, in relation to a party, its employees, officers, contractors, subcontractors, representatives, and, advisers;
Controller means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal data; where the purposes and means of such processing are determined by EU or Member State law, the controller or the specific criteria for its nomination may be provided for by EU or Member State law;
Processor means a natural or legal person, public authority, agency, or other body which processes Personal data on behalf of the controller;
Personal data means any information relating to an identified or identifiable person (data subject) from which that person can be directly or indirectly identified such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological etс. It does not include data where the identity has been removed (anonymous data);
Member States mean all European Union member states, plus Iceland, Lichtenstein, Norway — which are part of the European Economic Area;
The above definition and other terms under this Privacy Policy include, where applicable, the definitions included in the General Data Protection Regulation (EU 2016/679) ("GDPR").
The following rules of interpretation will apply unless otherwise stipulated by Privacy Policy:
unless the context otherwise requires, words in the singular shall include the plural and, in the plural, shall include the singular;
unless the context otherwise requires, a reference to one gender shall include a reference to the other gender.

4. PRINCIPLES FOR THE PROCESSING OF PERSONAL DATA

When processing Personal data, we comply with the following principles:
Personal data are processed lawfully, fairly, and transparently in relation to the Data subject ("lawfulness, fairness and transparency");
Personal data are collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes, or for statistical purposes shall not be considered incompatible with the original purposes ("purpose limitation");
Personal data are adequate, relevant, and limited to what is necessary for relation to the purposes for which they are processed ("data minimisation");
For our part, we make sure that Personal data is accurate and, where necessary, they are kept up to date; we take all reasonable steps to ensure that any Personal data that are inaccurate, having regard to the purposes for which they are processed, erased or rectified without delay ("accuracy");
Personal data are kept in a form that permits identification of Data subjects for no longer than is necessary for the purposes for which the Personal data are processed; Personal data may be stored for longer periods insofar as the Personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, taking into account the implementation of appropriate technical and organisational measures required by the GDPR to safeguard the rights and freedoms of the Data subject ("storage limitation");
Personal data are processed in a manner that ensures appropriate security of Personal data, including protection against unauthorised, or unlawful processing and accidental loss, destruction, or damage, using appropriate technical or organisational measures ("integrity and confidentiality").
We take all necessary measures to comply with the above principles.

5. INFORMATION WE COLLECT AND HOW WE COLLECT IT

We may collect several types of information, including Personal Data, as described below.
Data Provided by Users: when you use the Services, you may provide:
  • Personal Data such as your email address and company name;
  • User Content.
User Content
We collect the content that you create, upload, generate, or access through the Services, including photos, images, videos, audio recordings, texts, prompts, and templates, together with related metadata (such as time of creation and technical information) (“User Content”).
In order to provide AI-powered features, User Content may be automatically uploaded to our servers at the moment you initiate generation or editing (including prior to saving or publishing).
Image, Video, and Audio Processing: we may process information derived from your User Content, including:
  • object and scene detection;
  • identification of facial or body features;
  • audio analysis;
  • transcription of speech into text.
This processing is performed solely to provide requested AI-based features, generate content, improve functionality, and ensure moderation and safety.
Facial and body-related information, where used, is processed only for the time necessary to generate the requested output and is not used to identify individuals.
Technical data: when you visit or interact with our Website, Mobile Apps and Free Services or Services, we may collect, record, or generate certain technical data about you including the following:
  • Online identifiers. Online identifiers are unique identifiers, including IDFA or AAID, IP address, device ID, etc. When you use the Mobile Apps, we, or our third-party partners, identify you through online identifiers (hereinafter – "Online identifiers").
  • cookies (for more details, see here https://instories.com/cookie-policy);
  • Device data. Data about the devices you use to access Website or Mobile apps like manufacturer, model, operator etc., and data about your device usage and activity;
  • Metadata of images or videos. We may collect the metadata linked to your User Content. For example, your images may be accompanied by additional content like comments or a geotag;
  • Location data. We receive information from you, the relevant User and other third-parties that helps us approximate your location. We may, for example, use an IP address received from your browser or device to determine approximate location. Ylee may also collect location information from devices in accordance with the consent provided by your device.
Information from App store and Google play: If you create an account to use our services through Apple, Google with your permission, we collect information from those accounts ( your email, Apple ID, User ID, Device ID and other public profile information depending on the privacy settings you chose) to authenticate you within our Free Services and Services.
Information from Linked Third-Party Services: If you choose to connect your Instagram Business or Creator account (and, where required by Meta, the associated Facebook Page) to the Services, we may collect information from Meta Platforms and other linked third-party services that you explicitly authorize us to access.
Depending on the permissions you grant, such information may include:
your Instagram account profile information (including username, account ID, profile picture and follower counts);
metadata relating to your Instagram content, including posts, Reels and other media;
performance and analytics data relating to your account and content, including aggregated or de-identified analytics regarding reach, impressions, engagement, audience demographics and audience activity;
content that you explicitly choose to publish or schedule through the Services, including media files, captions, hashtags and publication schedules;
We use this information solely to:
display your connected account within the Services;
provide analytics and performance insights;
generate content recommendations and publication timing suggestions;
publish or schedule content only upon your explicit instruction;
link your Instagram account with the associated Facebook Page where required by Meta;
provide other features requested by you through the Services.
We collect and process this information only after you have authorized the relevant connection through Meta's authentication process. We do not access or process data beyond the permissions you have granted, and you may revoke such access at any time through your Meta account settings or by disconnecting the linked account from the Services.
AI Processing and Third-Party Providers
To enable AI-powered image, video, audio, and text generation, your User Content (including photos, videos, audio, texts, prompts, and associated metadata) may be transmitted to third-party AI service providers and cloud infrastructure providers.
Such providers process User Content strictly on our behalf, under our instructions, and solely for the purpose of generating the requested output and supporting the functionality of the Services.
We do not sell User Content.
We do not permit third-party providers to use User Content for advertising, profiling, or independent purposes. Unless explicitly disclosed otherwise, we do not authorize the use of User Content for training their own models.
Third-party providers are contractually required to:
maintain confidentiality;
implement appropriate technical and organizational safeguards;
process data only under documented instructions; and
provide a level of data protection equivalent to that described in this Policy.
User Content is retained by third-party providers only for the time necessary to provide the requested processing, unless longer retention is required for security or legal compliance.
By using AI-powered features within the Services, you explicitly consent to the processing and transfer of your User Content as described in this section. If you do not agree, you should not use such features.

6. WHAT PERSONAL DATA, FOR WHAT PURPOSES, HOW LONG, AND BASED ON WHAT GROUNDS DO WE PROCESS AS A CONTROLLER?

Ylee determines the purposes and means of the processing of Personal data in respect of the Services inside the EEA and the EU and therefore acts as a Сontroller in the sense of the GDPR.
Purpose of ProcessingData Subjects: Categories of dataStorage PeriodLegal Basis
to offer access to the Mobile apps, Website and provide Free Services and Servicesour Users and/or Users’ Representatives: email addresses / Information from App store and Google play, name of Administratoruntil the termination of a contract (Terms)processing is necessary for the performance of a contract (Terms) to which you are the party
to offer access to the Website and provide Free Services and Serviceour Users and/or Users’ Representatives: email addresses, name of Administratoruntil the termination of a contract (Terms)processing is necessary for the performance of a contract (Terms) to which you are the party
to fulfill our obligations to you under the contract with our UsersUsers and/or Users’ Representatives: email addresses / Information from App store and Google play, cookies, company name (in case of using invoice)until the termination of a contractprocessing is necessary for the performance of a contract (Terms of Service) to which you are the party
to send emails or important Services-related notices, and other marketing communications about our Free Services and Services

Users and/or Users’ Representatives: email addresses / Information from App store and Google play

subscribers to our newsletter: email addresses / Information from App store and Google play

until you withdraw your consent or until the end of the campaign whichever happened earlier

your consent to receive our newsletter. You may withdraw your consent at any time by clicking the “unsubscribe” link in the email communications we send to you

As for important Services-related notices, We consider these communications as part of our Services or Free Services to you

to monitor, study and analyze the use of our Free Services and Services with the aim to provide a more convenient experience to you, to analyze which pages you visit

Users and/or Users’ Representatives: Online identifiers*, cookies

When associated with an Online Identifier it will be treated as Personal Data, otherwise, if the usage data is aggregated, anonymized or de-identified, it will not be considered as Personal Data.

5 years or until you withdraw your consent whichever happened earlier

When the processing is for tracking, the lawful basis would be your consent to store cookies in your browser and Online identifiers. You may withdraw your consent at any time.

When the processing of Personal Data is for operations and providing the Mobile app or Website functionalities, the lawful basis would the necessity for the performance of a contract (Terms) to which you are the Party

to measure advertising and promotional effectiveness

Users and/or Users’ Representatives: Online identifiers*, cookies

When associated with an Online Identifier it will be treated as Personal Data, otherwise, if the usage data is aggregated, anonymized or de-identified, it will not be considered as Personal Data.

5 years or until you withdraw your consent whichever happened earlieryour consent to store cookies in your browser and Online identifiers. You may withdraw your consent at any time.
to provide social media integrations, analytics, content publishing and scheduling featuresInstagram account information, connected Facebook Page information, Instagram content metadata, analytics data, publication data, Business Manager information.until the User disconnects the linked account or requests deletion, unless longer retention is required by law.performance of a contract and/or your consent.
If you reside or are using the Free Services and Services in a territory governed by privacy laws under which “consent” is the only or most appropriate legal basis for the processing of personal data or other data as described herein (in general, or specifically with respect to the types of personal data you expect or elect to process or have processed by us or via the Services, or due to nature of such processing), your acceptance of our Terms of Service and this Privacy Policy will be deemed as your consent to the processing of your personal data and other data for all purposes detailed in this Privacy Policy, unless applicable law requires a different form of consent. If you wish to revoke such consent, please contact us at [email protected].

7. WHO DO WE SHARE YOUR DATA WITH?

We may share Personal Data and User Content with third-party service providers, including cloud infrastructure providers, analytics providers, and AI processing providers, such as Amazon Web Services, Google Analytics, AppsFlyer, Amplitude, Runware, and similar providers, solely for the purpose of operating, maintaining, and improving the Services.
If you choose to connect your Instagram account or other third-party services to the Services, information may be exchanged between the Services and such third-party platforms solely to provide the functionality requested by you, including analytics, account management, content publishing and scheduling.
Your use of such third-party services remains subject to the applicable privacy policies and terms of those providers.
The specific providers may change from time to time.
Such transfers may involve processing outside your country of residence.
For users located in the European Economic Area, processing is based on:
performance of a contract (to provide requested Services); and/or
your consent, where required.
Acting as a Controller we share your data with the following Processors:
Purpose of processingProcessors, their location and the link to the Privacy policy / Website if applicableSafeguards for restricted transfers (outside the EEA and ‘adequate’ jurisdictions)
to fulfill our obligations to you under the Terms with our UsersAmazon Web Services, Inc. (the USA), Privacy Policy and AWS Service Terms (and applicable Addendum)We transfer your data according to the AWS Service Terms AWS Service Terms (and applicable Addendum) between us and Amazon Web Service
to send direct email marketing communications about our ServiceThe Rocket Science Group LLC (USA) d/b/a Mailchimp, Global Privacy StatementWe transfer your data according to the Data Processing Addendum between us and Mailchimp
to better understand your preferences, to help you navigate our Website and/or Mobile apps, to personalize and provide a more convenient experience to you, to analyze which pages you visit, and to measure advertising and promotional effectiveness, cloud hostingGoogle LLC (Google Analytics) (the USA), Privacy PolicyWe transfer your data according to the Model Contract Clauses between us and Google
AppsFlyer UK Ltd (UK), Privacy PolicyWe transfer your data according to the Data Processing Addendum between us and AppsFlyer
Amplitude, Inc. (USA), Privacy PolicyWe transfer your data according to the Data Processing Addendum between us and Amplitude
to deliver targeted advertisements to individuals who visit our WebsiteMeta Platforms Inc. (Facebook Custom Audiences) (the USA), Privacy Policy
to provide requested by User analytics servicesMeta Platforms Inc.Our access to and use of information obtained through Meta Platforms (Instagram and Facebook) complies with the Meta Platform Terms and Developer Policies. We use this Platform Data solely to provide the features you request within the Services. We do not sell it, do not use it for advertising or to build advertising audiences, and do not use it to train AI/ML models.

8. SECURITY OF DATA

We are ensuring the confidentiality of the processed Personal data and other data on behalf of our Users, under the procedure provided by applicable legislation. Protection of Personal data and other data is supported by the implementation of legal, organisational, and technical measures necessary and sufficient to ensure that the requirements of the applicable data protection legislation are met. However, be aware that no system is ever completely secure from unauthorized access to information, its disclosure, alteration or destruction.

9. AUTOMATED DECISIONS

We do not make any automated decisions about you or with your Personal Data that would result in legal or other similarly significant effects on you.

10. REQUEST FOR ADDITIONAL INFORMATION TO IDENTIFY THE DATA SUBJECT

During the processing of your data, we may ask you to provide us with additional information to enable us to identify you.
On our part, we endeavour to obtain a minimum of additional information in order to be able to carry out such identification. If you do not provide us with said additional information upon our request, we will not be able to exercise your rights.

11. YOUR RIGHTS AS A USER

You have the following rights under the GDPR with respect to Personal data:
the right to access to information held about you;
the right to rectification of the processed data;
the right of erasure ('the right to be forgotten');
the right to restriction of processing;
the right to data portability;
the right to object and automated individual decision-making;
the right to withdraw consent;
the right to lodge a complaint.
To exercise these rights, please contact us via email [email protected].
Ylee should respond without delay and within one month of receipt of the request.
Ylee may extend the time limit by a further two months if the request is complex or if Ylee receives a number of requests from the individual.

11.1. THE RIGHT OF ACCESS TO INFORMATION HELD ABOUT YOU

The Data subject has the right to obtain from the Controller confirmation as to whether or not Personal data concerning him or her are being processed and, if so, access to the data, as well as other information, namely:
information about the purposes for which the Personal data are processed;
information on the categories of Personal data concerned;
information on the recipients or categories of recipients to whom the Personal data have been or will be disclosed, including recipients in third countries (outside EU and EEA) or international organisations;
information on the envisaged period for which the Personal data will be stored, or, if not possible, the criteria used to determine that period;
information on the existence of the right of rectification or the right to erasure or the right to object to processing of Personal data concerning the data subject or to object to such processing;
if the data are not collected from you, any available information on the source of the data;
information on the right to lodge a complaint with a supervisory authority;
information on the guarantees of data transfer to third countries (outside the EU and EEA) or to international organisations, where such transfer will take place;
information about the availability of automated decision-making, including profiling, and, where available, information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.

11.2. THE RIGHT TO RECTIFICATION OF PROCESSED DATA

We take all measures to detect any inaccurate, incomplete, or outdated Personal data.
You have the right to rectify your Personal data without undue delay if it is inaccurate, incomplete, or out of date.
Once we have rectified your Personal data, we will promptly provide you with an appropriate notification.

11.3. THE RIGHT OF ERASURE

You have the right to request the erasure of your Personal data, and this will be done without undue delay.
If we cannot erase your Personal data, we will anonymise it in a way that you are not identified.
Once your Personal data has been erased or anonymised, you will be notified.
We cannot exercise the right to the erasure of your Personal data in particular if your Personal data is processed:
in order to exercise the right to freedom of expression and information;
in order to comply with a legal obligation that requires the processing of data in accordance with the provisions of Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest, or in the exercise of official authority vested in the controller;
for reasons of public interest in the area of public health;
for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes;
for the establishment, exercise, or defence of legal claims.
To request deletion of data obtained from your Connected Account, you may either (i) disconnect the Connected Account within the Services, or (ii) contact us at [email protected]. Upon receipt of such a request or disconnection of the Connected Account, we will cease accessing the Connected Account and delete the relevant data within 30 days, unless we are required to retain certain information by applicable law.

11.4. THE RIGHT TO RESTRICTION OF PROCESSING

Where the processing is restricted, we will store your Personal data, but we will not process it further until the restrictions are removed. Restrictions on processing can be removed at any time upon request.
The right to restrict data processing can only be exercised in the following cases:
the accuracy of the Personal data will be contested by you for a period of time that allows us to verify the accuracy of the Personal data;
the processing of your Personal data is unlawful and you oppose the erasure of the Personal data and request the restriction of their use instead;
where we no longer need the Personal data for the purposes of the processing, but they are required by you for the establishment, exercise, or defense of legal claims;
you object to the processing pending verification of whether the legitimate grounds indicated by the controller override the grounds indicated by you.
Exceptions to this right. Once we have restricted the processing of your Personal data, we may continue processing in the following cases:
with the data subject's consent, in order to establish, exercise or defend against legal claims;
in order to protect the rights of another natural or legal person;
for reasons of important public interest of the Union or a Member State.

11.5. THE RIGHT TO DATA PORTABILITY

You have the right to receive the Personal data that you have provided to us in a structured, commonly used, and machine-readable format and the right to transmit this data to another controller, as far as this is technically possible.
You can exercise the aforementioned right if the data are subject to processing on the basis of your consent or a contract signed with you and the data are processed electronically.

11.6. THE RIGHT TO OBJECT

You have the right, at any time, to object to the processing of Personal data based on your particular situation:
in relation to the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
in relation to the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by interests or fundamental rights and freedoms of the data subject, which require protection of personal data, in particular where the data subject is a child.
We will no longer process your Personal data unless we identify compelling legitimate grounds for the processing.
You have the right at any time to object to the processing of your Personal data for direct marketing purposes.

11.7. THE AUTOMATED INDIVIDUAL DECISION-MAKING INCLUDING PROFILING

You have the right not to be subject to decisions based solely on automated processing, including profiling, which produces legal effects on you or has a similar significant impact on you.
Exceptions to this right:
it is necessary for the entering into or performance of a contract between the Data subject and the Controller;
it arises from a provision of EU or Member State law to which the Controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests;
it is based on the explicit consent given by the Data subject.

11.8. THE RIGHT TO WITHDRAW CONSENT

If you have consented to the processing of your Personal data or other data, you have the right to withdraw such consent at any time.
We process your Personal data on the basis of consent for processing, mailing, push notifications, and cookie processing.
We process other data on the basis of consent for the performance of a contract (Terms of Service) to which you are the party (for further details, see Sections 5 and 6).
We provide you with the possibility to withdraw your consent in a simple way, i.e:
You can withdraw your consent to receive emails by clicking on the "unsubscribe" link that is available in every email communication;
You have the option to manage your marketing preferences for push notifications using your browser or phone settings, or by contacting us;
You can withdraw your consent to the processing of cookies through any of our websites using the cookie control tool.
You can withdraw your consent to process other data by contacting us (see Section 17).
If you have connected your Instagram account or another third-party service, you may revoke our access at any time through your Meta account settings or by disconnecting the linked account within the Services. Please note that revoking access will not affect information already lawfully processed before the withdrawal.

11.9. THE RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY

You have the right to lodge a complaint with the supervisory authority of your own country if you have concerns about the manner in, which we process your Personal data and about the protection and exercise of your rights.
You can find the contact details of your country's supervisory authority on the website of the European Data Protection Board here: https://edpb.europa.eu/about-edpb/board/members_en

12. CONDITIONS UNDER WHICH WE PROVIDE YOU WITH INFORMATION RELATED TO YOUR RIGHTS

Information related to your rights is provided free of charge. Where the data subject's requests are manifestly unfounded or excessive, in particular, because of their repetitive character, we may charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the requested action, or refusing to act on the request.

13. CONDITIONS UNDER WHICH WE PROVIDE YOU WITH INFORMATION RELATED TO YOUR RIGHTS

We will not store or collect your payment card details or any other relevant valid, up-to-date, and complete contact and billing details. We use the third-party service Stripe for payment processing (e.g. payment processors).
The payment card details or any other relevant valid, up-to-date, and complete contact and billing details are provided directly to our third-party payment processor Stripe whose use of your personal information is governed by Stripe's privacy policy.
We may ask you to provide information to facilitate this transaction and verify your identity.

14. COOKIES

Ylee also uses cookies. You can find more information about cookies here https://instories.com/cookie-policy.

15. DO NOT TRACK

"Do Not Track" is a privacy preference that you can set in certain web browsers. We do not change our practices in response to a "Do Not Track" signal in the HTTP header from a browser or mobile application, you can manage your cookies preferences, including whether or not to accept them and how to remove them, through your browser settings. Please bear in mind that disabling cookies may complicate or even prevent you from using the Free Services or Services.

16. CHANGES TO THIS PRIVACY POLICY

We may occasionally make changes to this Privacy Policy.
When we make material changes to this Privacy Policy, we'll provide you with prominent notice as appropriate under the circumstances. For example, we may display a prominent notice within the Free Service or Service or send you an email, and we will update the "Last updated date" above to indicate when those changes were made.

17. HOW TO CONTACT US

If you have any questions about this Policy, complaints, or claims, please contact us via e-mail:
Address: Spyrou Araouzou 165, Office 401, 4th floor, Lordos Waterfront Court, Limassol 3036, Cyprus.
e-mail: [email protected].

ADDENDUM CALIFORNIA PRIVACY DISCLOSURES

This Addendum reflects the parties’ agreement on the processing of User Personal Data in connection with the California Consumer Privacy Act of 2018 (“CCPA”).
Ylee and the User have entered into the Addendum Privacy Policy which supplements the Privacy Policy (the “Addendum”).
Beginning 1 January 2020, the California Consumer Privacy Act ("CCPA") gives California residents certain rights with respect to the processing of Personal Data (known as "personal information" under the CCPA). We provide this statement to USA residents ("you") in accordance with requirements under the CCPA to make certain disclosures about the collection and processing of their personal information.
For information about how we’ve extended the CCPA core rights to control personal information to all of our users in the United States, please see our provisions of the Privacy Policy.
This supplement provides additional privacy disclosures and details additional rights and should be read in conjunction with our Privacy Policy.

1. PERSONAL INFORMATION

Section 6 of our Privacy Policy sets forth the categories of personal information (categories of data) that Ylee collects and processes about you, the purpose of the processing of each category, and the storage period.

2. REQUESTS TO EXERCISE YOUR RIGHTS

2.1. RIGHT TO KNOW REQUEST

Under the CCPA, you have a right to request information about our collection, use, and disclosure of your personal information over the prior 12 months, and ask that we provide you with the following information:
Categories of and specific pieces of personal information we have collected about you;
Categories of sources from which we collect personal information;
Purposes for collecting personal information;
Categories of third parties with whom we share personal information (please see Section 7);
Categories of personal information disclosed about you for a business purpose;
If applicable, categories of personal information sold about you and the categories of third parties to which the personal information was sold, by category or categories of personal information for each third party to which the personal information was sold.
To make a verifiable request for information about the personal information we have collected about you, please email us at [email protected].

2.2. RIGHT TO DELETE REQUEST

You also have a right to request that we delete personal information, subject to certain exceptions. You may exercise your right to delete via email [email protected].

2.3. HOUSEHOLD REQUESTS

Ylee currently does not collect household data.

2.4. SALE OF PERSONAL INFORMATION

Ylee does not sell personal information. We have taken substantial steps to identify and remediate any data sharing arrangements that could constitute a "sale" under the CCPA.