Privacy policy

Who we are

Y.I.N. Technologies LLC, a Delaware limited liability company in the United States, operates YIN-AI CERTIFICATION at certification.yintechnologies.com. We are the data controller for the information described here.

For any privacy question or request, write to ilyesmazari@yintechnologies.com.

What we collect

We collect only what the service needs to run and to stop abuse. There is no advertising network, no analytics tracker, and no third-party script on this website.

Your email addressGiven when you sign up. Used to send your API key, to verify the address is yours, and to contact you about the service. Never sold, never shared for marketing.
Your IP address at signupRecorded against signup attempts so we can rate-limit and detect abuse. It is not attached to your certificates and not used to profile you.
A browser fingerprint at signupA derived value used only to spot one person opening many free accounts. It is not used for advertising and not shared.
The content you submit for certificationWhen you request a certificate, the decision you submit — the query, the answer, and any context you attach — is stored as part of the issued certificate. This is the point of the product: the certificate is the audit record, and it must remain intact to stay verifiable. Do not submit personal or special-category data you do not intend to retain.
Billing identifiersIf you move to a paid tier, we store a Stripe customer identifier. Card numbers go directly to Stripe and never reach our servers.

We do not use cookies for tracking. The website sets no advertising or analytics cookies. Signing in to the consumer interface at /app uses a session cookie that is strictly necessary for it to work.

Why we are allowed to hold it

To provide the service you asked for. Your email, API key and certificates exist because you requested certification. Without them there is no account.
Our legitimate interest in keeping the service up. IP addresses and signup fingerprints exist to stop automated abuse of a free tier. They are kept narrow and are not used for anything else.
To meet a legal obligation. Billing records are kept as long as tax and accounting rules require.

Who else processes it

We keep this list short on purpose. These are the only third parties that touch your data:

HostingerHosts the server the service runs on.
ResendDelivers the verification and API-key emails. Receives your email address only.
StripeProcesses payments for paid tiers. Receives your billing details directly; we never see your card number.

We do not sell personal data, and we do not share it with advertisers or data brokers. We would disclose data if compelled by valid legal process, and we would tell you unless legally prevented from doing so.

How long we keep it

Account data — while your account exists, and then deleted on request.
Certificates — kept while your account exists, because they are your audit record. You can ask us to delete specific certificates or all of them; once deleted we cannot reconstruct them.
Signup IP addresses and fingerprints — kept only as long as they are useful for abuse prevention, then removed.
Billing records — kept as long as tax and accounting law requires.

How it is protected

All traffic is encrypted in transit with TLS.
API keys are stored as hashes. We cannot read your key, which is why we can only show it to you once.
Certificates are isolated per account at the database level, so one account cannot read another's rows.
Application logs are filtered to strip anything shaped like a credential, token or email address before it is written.

No system is perfect. If we ever discover a breach affecting your data, we will tell you and the relevant regulator without undue delay.

Your rights

Wherever you live, you can ask us to do all of the following, and we will do them free of charge:

Tell you exactly what we hold about you.
Give you a copy in a portable format.
Correct anything that is wrong.
Delete your account and your data.
Stop using your data for a given purpose, or object to that use.

Email ilyesmazari@yintechnologies.com and we will respond within 30 days. If you are in the UK, EU or EEA and you are unhappy with our response, you may complain to your national data protection authority. If you are in California, you have the rights described above and we will not discriminate against you for exercising them.

International transfers

Our servers and our processors are located in the United States and the European Union. If you are outside those regions, your data will be transferred there so we can provide the service. We rely on standard contractual clauses with our processors where that is required.