Privacy Policy

We collect minimal personal data required for triage services, including:

• •Age & Date of Birth: For age-appropriate support and safeguarding tier assignment.
• •Region: To signpost you to relevant local services in your area.
• •Chat Data: Conversations with Tony Bot to provide continuity in your support journey.
• •Account Information: Name and email address for account access.
• •The Vault: Documents you choose to upload for secure safekeeping.

Data is used solely to provide immediate support and signposting to local services. We do not sell your data.

• •All data is encrypted in transit (TLS 1.3) and at rest (AES-256 on database storage).
• •Vault documents receive an additional layer of end-to-end AES-256-GCM encryption keyed to your Login Password via Argon2id (OWASP ASVS v4.0). Even our engineers cannot read your Vault files without your password or recovery phrase.
• •We never sell your personal data to third parties.
• •Access to your data is strictly limited to authorised personnel for support purposes only.
• •We comply with UK GDPR and Data Protection Act 2018.

To power the Tony chat assistant and related features, YNOT Support shares the minimum necessary text/voice content with the following sub-processors under UK GDPR Article 28 contracts:

• •Google (Gemini) — processes your chat messages to generate Tony's replies and the Landlord Pulse analysis. Google does not train on our API traffic (Gemini API zero-data-retention policy, Google Cloud EU/UK region). Data is transmitted over TLS and retained only for the duration of the request.
• •OpenAI (Whisper & TTS) — processes voice journal recordings for speech-to-text and text-to-speech. OpenAI API traffic is excluded from model training under their standard API terms.
• •Vault documents are never sent to any AI processor. Filenames may be scanned locally for auto-categorisation; the file body never leaves our servers in readable form.
• •Firebase Cloud Messaging (Google) — used to deliver push notifications. Only a notification device token and short message body are shared.

You can review and exercise your rights over AI-processed data via tony@ynotsupport.co.uk.

As a safeguarding platform, we may share data with emergency services if a user is at immediate risk of harm.

This includes situations involving risk of self-harm, harm to others, or child protection concerns. YNOT Support® operates a tiered safeguarding system with crisis detection, caregiver notifications, and the Double-Lock protocol for protecting young people.

• •Right to Access: Request a copy of all data we hold about you.
• •Right to Rectification: Correct any inaccurate personal data.
• •Right to Erasure: Request deletion of your account and all associated data via the "Delete My Account" button in Settings.
• •Right to Portability: Export your data in a machine-readable format.