Yo Yo Yo — Privacy Notice

Version 2: — 19 August 2026
Data controller: Multidimensional Creatives, trading as Yo Yo Yo
Privacy contact: support@multidimensionalcreatives.com

1. Introduction

This Privacy Notice explains how we collect, use, share, and protect your personal data when you use the Yo Yo Yo application and website (the "Service"), and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It is written to be read alongside our Terms of Use.

Yo Yo Yo is a voice-based wellbeing application. Because you speak during interactive sessions, and what you say may reveal information about your emotional and mental wellbeing, parts of your data are "special category data" under UK GDPR. We treat this with particular care, as set out in Sections 4 and 5.

2. The data we collect

Account data. Name, email address, password (stored hashed), plan/subscription status, and payment records (payments are handled by Stripe); we do not store full card details.

Session voice data (interactive sessions only). When you take part in an interactive session, we process: your live microphone audio; real-time transcripts of what you say; the AI-generated responses spoken to you; and technical session data (timings, device/browser type, error events).

The storage position for each of the above: Audio is processed in real time and is not recorded or retained by us. Transcripts are held in memory to run your session and are not stored after the session ends.

Safety records. If the automated safety feature activates (see Terms, Section 7), we record — e.g. "the fact, category, and time of the event", retention period, and whether any content is included. An alert email is sent to our support address so we can review the Service's safety behaviour.

Voice Test data. If you use the Daily Voice Test, we process a short voice recording to produce your resonance results. The audio is not retained; the results are stored temporarily, displayed, and not retained.

Scripts and videos that you deliberately create in Yo Yo Yo are stored so you can access them, until you delete them or your account is closed.

Usage and device data. The application's data practices regarding usage and diagnostic information align with the platform architecture and standard Base44 implementations:

• Log Data: Logs are maintained by the Base44 platform for the primary purposes of system operation, troubleshooting, and security monitoring. These logs assist in diagnosing performance issues and investigating potential security incidents.
• Approximate Location: The platform captures approximate location data derived from IP addresses for security, auditing, and regional compliance purposes.
• App Events: Custom analytical events are tracked (e.g., user flow progress and feature usage) solely to monitor app performance, identify bugs, and improve the user experience.
• Diagnostics: Diagnostic information is used to ensure system reliability and to maintain the security of the application infrastructure.
• No Advertising Trackers: The platform does not implement third-party advertising trackers or behavioural advertising cookies. Data collection is strictly limited to the operational, security, and analytical requirements of the service.

3. Why we process your data (purposes and lawful bases)

• Provide your account and the Service — Account, usage data — Lawful basis: Contract (6(1)(b)).
• Run interactive voice sessions — Session voice data — Lawful basis: Contract (6(1)(b)) — Special category basis: Explicit consent (9(2)(a)).
• Safety pause feature — Safety records — Lawful basis: Legitimate interests (6(1)(f)) — protecting vital interests of users — Special category basis: Explicit consent (9(2)(a)).
• Daily Voice Test results — Voice Test data — Lawful basis: Contract (6(1)(b)) — Special category basis: Explicit consent (9(2)(a)).
• Payments and records — Account, payment — Lawful basis: Contract; Legal obligation (6(1)(c)).
• Service security, debugging, improvement — Usage, technical — Lawful basis: Legitimate interests (6(1)(f)).
• Marketing emails (optional) — Email — Lawful basis: Consent (6(1)(a)).

We do not sell your personal data. We do not use the content of your sessions for advertising. Your session content is not used to train AI models by us or our providers.

4. Special category data and your explicit consent

What you say in interactive sessions and the Daily Voice Test may reveal information about your emotional and mental state. We ask for your explicit consent before your first interactive session, via the Terms of Use ticked checkbox, and we record the time and version of the consent you gave. You may withdraw consent at any time via [settings location] or by emailing support@multidimensionalcreatives.com; interactive features will then be unavailable, and withdrawal does not affect prior processing.

5. Our service providers (processors)

We use specialist providers to deliver the Service. Each acts under contract on our instructions:

• Anthropic — AI response generation (Claude API) — Session transcripts sent for response generation — USA — IDTA / UK Addendum — DPA and API no-training/retention terms.
• Stripe — Payments — Payment data.
• Gmail and outlook.cloud.microsoft email providers — Transactional email, safety alert delivery — Email, alert metadata.

Where providers are outside the UK, we rely on the safeguards shown (International Data Transfer Agreement or the UK Addendum to EU Standard Contractual Clauses).

6. How long we keep data

This retention policy is based on the Base44 Yo Yo Yo app codebase and current infrastructure.

• Session Transcripts — Not Retained — Transcripts are processed in-session and are not stored in the database.
• Safety Records (CrisisIncident) — 12 Months — Retained for 12 months for safety/wellbeing infrastructure, then permanently deleted by the system.
• Transcription Failure Logs — Not Stored — System logs that transiently capture errors; specific error details for user-driven sessions are not persisted in standard entity storage beyond temporary diagnostic needs.
• Voice Test Results — Account Life — Retained while the user's account is active to provide baseline comparisons; deleted upon user erasure request.
• Studio Content (Scripts/Recordings) — Account Life — Retained until explicit user deletion or account closure.
• Account Data — Account Life — Retained for the duration of the account. Erasure requests trigger the immediate, permanent deletion of associated entity records.
• System/Platform Logs — Platform-Managed — Managed by Base44 infrastructure.

When retention ends or upon a valid user erasure request, the data is deleted or rendered irreversibly anonymous in the database. Note that platform-level file storage (audio/video files) is subject to the limitations of the current SDK; while database records are deleted, any associated files must be managed per Base44's platform capabilities.

7. Security

Yo Yo Yo protects user data through:

• Encryption: Data is encrypted both in transit (TLS) and at rest.
• Access Controls: Strict RLS (Row-Level Security) ensures users can only access their own data.
• Minimisation by Design: Only necessary data points are captured to facilitate the core experience (meditation sessions, script rehearsals, and voice tests).
• Breach Protocol: Should a breach occur that risks user rights, the system is designed to notify the ICO within 72 hours and inform affected users without undue delay, in full accordance with UK GDPR.

8. User Rights

Every person has the following rights under UK GDPR:

• Access: The right to obtain a copy of their personal data.
• Rectification: The right to correct inaccurate data.
• Erasure ("Right to be Forgotten"): The right to request the deletion of their personal data.
• Restriction of Processing: The right to limit how their data is used.
• Data Portability: The right to receive their data in a structured format.
• Object to Processing: The right to object based on legitimate interests.
• Withdraw Consent: The right to withdraw consent at any time.
• Automated Decision-making: You are not subject to solely automated decisions with legal or significant effects. The AI within Yo Yo Yo serves as a guide for your session and reflection, but it does not make diagnostic, legal, or other binding decisions about your life.

Exercising Rights: Users may exercise any of these rights by emailing support@multidimensionalcreatives.com. We will respond within one month. If you are dissatisfied with our response, you may complain to the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113. We would, however, welcome the opportunity to resolve any concerns directly first.

9. Children

The Service is for adults aged 18 and over. We do not knowingly process children's data; if you believe a child has used the Service, contact us and we will delete the account and associated data.

10. Changes to this Notice

We will post any changes here and, for material changes, notify you in the app or by email before they take effect.