Yuxor Ltd · yuxor.dev
Privacy Policy & Terms of Use
Your data, your rights, our commitment
Version 3.0Last Updated: 22.08.2026
1. Introduction, Data Controller & Scope
Understanding this policy
1.1 About This Policy
This Global Privacy Policy (“Policy”) explains how YUXOR LTD, its affiliates and group companies (“Company”, “we”, “us” or “our”) collects, uses, processes, shares and protects your personal data in connection with your use of the websites, applications, AI-powered chat (chatbot) services, image and content generation services, application programming interfaces (APIs), and reseller/licensing services provided by the Company (collectively, the “Services”).
By using our Services, you acknowledge that you understand your personal data will be processed as described in this Policy.
1.2 Data Controller
YUXOR LTD
Company No. 16811941
71-75 Shelton Street, Covent Garden
London, United Kingdom, WC2H 9JQ
ICO Registration No.: ZC127332
yuxor.dev · studio.yuxor.dev
[email protected]1.3 For Users in Türkiye (KVKK)
This Policy constitutes an “Information Notice” under Turkish Personal Data Protection Law No. 6698 (“KVKK”) and fulfils our notification obligation under KVKK. Your personal data is processed subject to KVKK together with the UK GDPR and the Data Protection Act 2018.
1.4 Operations Carried Out in Türkiye
Part of our support and operations activities is carried out in Türkiye. Accordingly, your personal data may also be processed within the territory of the Republic of Türkiye and subject to KVKK. Such access takes place under the international transfer safeguards set out in Clause 3.2 of this Policy, in accordance with the UK GDPR.
1.5 Language
The English version of this Policy is the reference text. The Turkish version is equivalent to the English version for the purposes of the information obligation under KVKK. In the event of any discrepancy between versions, the English version prevails, without prejudice to the mandatory provisions of your country of residence.
2. Personal Data We Collect
What we collect and why
2.1 Data Categories
| Category | Purpose | Legal Basis | Retention |
|---|---|---|---|
| Identity & Contact (username, email, profile photo, 2FA) | Account creation, authentication, support | Contract (KVKK 5(2)(c)) | Account + 5 years |
| Transaction Data (payments, invoices, subscription records) | Payments, fraud prevention, tax/accounting | Legal obligation | Statutory retention periods |
| Technical Data (IP address, browser/device information, consent records, system logs) | Service functionality, security, abuse prevention | Legitimate interests | 24 months |
| Content/Input Data (prompts, conversations, uploaded material) | AI output generation, service delivery | Contract / Legitimate interests | 12 months or until deleted |
| API Usage Data (request counts, token usage, IP-based statistics, key metadata) | Security, abuse prevention, usage reporting, billing | Contract / Legitimate interests | 24 months |
| Support Communications (support tickets, messages) | Service support, request handling | Contract / Legitimate interests | 24 months |
| Marketing Data (newsletter opt-ins, communication preferences) | Promotional communications | Consent | Until withdrawn |
2.2 Sensitive Personal Data
We process sensitive personal data (e.g. biometric data, health data) only for specific services, where expressly stated, with your explicit consent (UK GDPR / GDPR Article 9(2)(a) and KVKK Article 6). We recommend that you do not include sensitive data in your AI prompts or uploaded content.
2.3 AI Models and Third-Party Providers
IMPORTANT — The Company does not develop or train its own foundation AI models. AI functionality (including chat, image and content generation) is provided by integrating and redistributing (proxy/dispatch) models sourced from third-party model providers. Commercial information regarding our suppliers and infrastructure providers constitutes a trade secret and is not disclosed in any way.
Your prompts and uploaded content (“Inputs”) may be transmitted to and processed by service providers in the following categories only, for the purpose of generating Outputs: cloud hosting (European Union), AI model providers, payment processing, analytics, and security services. The Company does not use your content to train its own AI models.
Third-party model providers process data under their own terms and privacy policies and may use your Inputs/Outputs for model training or improvement. We seek to limit this contractually where possible; however, we cannot guarantee it.
3. Data Sharing & International Transfers
Who we share your data with
Service Providers
Cloud hosting located in the European Union; AI model providers; payment processing; analytics; security and customer support infrastructure providers (category level only).
Legal Obligations
Where required by legal obligations, court orders, or the protection of the public interest.
Business Transfers
In the event of a merger, acquisition or asset sale, with prior notice.
3.2 International Data Transfers
Your data is primarily processed in data centres located in the European Union. Transfers outside the UK, EEA or Türkiye are made under the following safeguards:
- Support and operations access from Türkiye: under UK International Data Transfer Agreement (IDTA) or Standard Contractual Clauses (SCC) safeguards, subject to KVKK
- AI model providers may be located in third countries including the USA: UK IDTA or EU SCC safeguards apply
- Adequacy decisions for countries ensuring an adequate level of protection
- These transfers do not affect your rights or the level of protection afforded to you; a summary of the transfer safeguards is available on request
4. Your Data Protection Rights
Rights we guarantee
Right to Information
Clear information about how your data is processed
Right of Access
Access to your personal data and copies of it
Right to Rectification
Correction of inaccurate or incomplete data
Right to Erasure
Request deletion of your data in certain circumstances
Right to Restriction
Temporary halt of processing in certain cases
Right to Portability
Receive your data in a structured format
Right to Object
Object to processing based on legitimate interests
Right to Withdraw
Withdraw your consent at any time
4.1 How to Exercise Your Rights
You can submit requests to [email protected]. We may need to verify your identity; your request will be answered free of charge within 1 month at the latest.
You can delete all of your chat content at any time yourself using the “Delete All Messages” feature in your account. You may also request the deletion of your account and all related data via the same address.
4.2 Right to Complain to a Supervisory Authority
If you believe your rights have been infringed, you have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement: in the United Kingdom, the Information Commissioner's Office (ico.org.uk); in Türkiye, the Personal Data Protection Board (kvkk.gov.tr); in the EEA, your local data protection authority.
5. Jurisdiction-Specific Provisions
Regional legal requirements
🇺🇸California Residents (CCPA/CPRA)
- Right to know what personal information is collected
- Right to opt out of the “sale” of personal information
- Right to limit the use of sensitive personal information
- Right not to be discriminated against for exercising these rights
- The Company does not “sell” your personal information in the traditional sense.
🇹🇷Residents of Türkiye (KVKK Article 11)
Pursuant to Article 11 of KVKK, you have the following rights:
- To learn whether your data is processed
- To request information if it has been processed
- To learn the purpose of processing
- To know third parties to whom data is transferred
- To request correction of incomplete data
- To request deletion under Article 7 conditions
- To request notification of third parties
- To object to automated analysis outcomes
- To claim compensation for damages
6. Data Security, Retention & Cookies
How we protect your data
6.1 Security Measures
We take appropriate technical and organisational security measures to protect your personal data, including data encryption, access controls and secure development practices. No system is 100% secure, and absolute security cannot be guaranteed.
6.2 Retention Policy
We retain personal data only for the periods set out in Clause 2.1 and only as long as necessary. We may retain certain data for longer in order to comply with legal obligations or to resolve disputes.
6.3 Data Processing Agreement (B2B / API)
If you use the Services (in particular the API) to process personal data of your own end users, you are the controller with respect to that data; it is your responsibility to establish a lawful basis, inform your end users and put the required safeguards in place. In that case, Yuxor acts as a processor within the meaning of Article 28 UK GDPR, and a Data Processing Agreement (DPA) available on request via [email protected] is incorporated into and forms part of this Policy.
6.4 Data Breach Notification
In the event of a personal data breach likely to result in a high risk, we will inform the competent supervisory authority and affected users within the periods prescribed by applicable law (under the UK GDPR, within 72 hours of becoming aware).
6.5 Automated Decision-Making
The Services may include automated processes such as content moderation. Under Article 22 UK GDPR, you have the right not to be subject to a decision based solely on automated processing that significantly affects you, to request human intervention, and to contest the decision.
6.6 Cookies
Our website uses strictly necessary cookies such as session and language preference cookies, Cloudflare cookies for security purposes, and analytics cookies (Google Analytics 4) that are loaded only with your consent. Analytics cookies depend on the consent you give through the on-site cookie consent tool and are not loaded without it.
For details, please see our Cookie Policy at yuxor.dev/cookies; you can change your preferences at any time via your browser settings or the on-site consent tool.
7. Children's Privacy
18+ age limit
Our Services are intended for adults aged 18 and over, and we do not knowingly collect personal data from individuals under 18. When registering, you represent that you are at least 18 years old; if we learn that an account holder is a minor, we will close the account and delete the associated data (see Terms of Use Clause 1).
If you are a parent or guardian and become aware that your child has provided us with data, please contact us at [email protected]; we will promptly delete the relevant data.
8. Changes to This Policy
Updates
We may update this Policy from time to time. When we make changes, we will revise the “Last Updated” date above. For material changes we will notify you by email or a prominent in-service notice and, where necessary, request your renewed consent.
9. Contact Us
Get in touch
If you have any questions about this Privacy Policy or our data practices, please contact us:
YUXOR LTD
Company No. 16811941
71-75 Shelton Street, Covent Garden
London, United Kingdom, WC2H 9JQ
ICO Registration No.: ZC127332
yuxor.dev · studio.yuxor.dev
[email protected]II. Terms of Use
Legal agreement for use of the Services
These Terms of Use (“Terms”) are a legally binding contract between you and YUXOR LTD. BY ACCESSING OR USING OUR SERVICES, YOU REPRESENT THAT YOU ACCEPT THESE TERMS.
⚠️ IMPORTANT — These Terms contain limitations of liability, indemnification, a binding arbitration clause and a class action waiver.
1. Account Eligibility and Security
You must be at least 18 years old to use the Services. By creating an account, you warrant that the information you provide is accurate and current. You are responsible for the security of your account and all activity occurring under it.
2. Use of the Services
We grant you a limited, non-exclusive, non-transferable and revocable licence. You may not use the Services for illegal or harmful purposes or in breach of Clause 12.
3. Intellectual Property
The Services and their original content are owned by the Company. Your Inputs (prompts and uploaded content) remain yours; you grant the Company a licence to process them solely to provide the Services. Upon payment of all fees, rights in the Outputs are assigned to you; however, the uniqueness of Outputs is not guaranteed and they may be subject to third-party provider terms. It is your responsibility to verify that commercial use of Outputs does not infringe third-party rights.
4. Payments and Billing
Certain features require payment; subscriptions renew automatically unless cancelled. For digital services performed instantly, performance beginning with your express consent may cause the loss of your 14-day cancellation right under the UK Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013; in that case payments are non-refundable to the extent permitted by law, but your statutory consumer rights are preserved. Free trials convert to a paid plan at the end of the trial period. Usage exceeding plan limits (overage) is charged additionally. Price changes are notified at least 30 days in advance. See our Cancellation & Refund Policy (yuxor.dev/refund-policy) for cancellation and refund terms.
5. Suspension, Changes and Termination
We may suspend or terminate your access for any reason, including your breach of these Terms. You may cancel your subscription at any time; cancellation takes effect at the end of the current period. The Company reserves the right to modify, suspend or discontinue the Services.
6. Warranty Disclaimers
To the maximum extent permitted by law, the Services are provided “AS IS” and “AS AVAILABLE”, without any express or implied warranty. We do not warrant that the Services will be uninterrupted, error-free or secure. Your statutory consumer guarantees are preserved.
7. Limitation of Liability
To the maximum extent permitted by law, the Company is not liable for indirect, incidental, special, punitive or consequential damages. Our total liability does not exceed the amount you paid in the 12 months preceding the claim, or £100, whichever is higher. We are not responsible for third-party provider outages. Death or personal injury, fraud, non-excludable liabilities and consumer rights are preserved.
8. Special Provisions for AI Services
AI functionality is delivered through third-party models and the Company acts as an intermediary/distributor. All Outputs are generated by probabilistic models and may be inaccurate, incomplete or unfit for purpose. Images may resemble real people/brands; assessing legality and appropriateness is your responsibility. Chatbot outputs may contain “hallucinations” and do not substitute for professional (medical/legal/financial) advice. The Services clearly indicate that you are interacting with AI systems, and Outputs constitute synthetic content; users who publish Outputs are responsible for compliance with applicable AI transparency and content marking obligations (including the EU AI Act).
9. User Representations and Warranties
For each Input and Output, you represent and warrant that you hold all relevant rights and permissions, that the content is lawful and does not infringe third-party rights, and that it does not breach Clause 12.
10. Indemnification
You agree to indemnify and defend the Company against all claims, damages and costs arising from your use of the Services, your Inputs/Outputs, your breach of these Terms, or your infringement of third-party rights or laws. Consumer rights are preserved.
11. Model Training and Data Use
The Company does not train its own foundation models; it sources and redistributes AI from third-party providers. Your Inputs/Outputs are not used to train the Company's own models. Commercial information regarding our suppliers and infrastructure providers is a trade secret and is not disclosed. Providers may use data for model training under their own terms; we seek to limit this contractually where possible but cannot guarantee it. More restrictive terms for B2B/API may be granted only by separate written agreement.
12. Acceptable Use Policy
You may not use the Services for: child sexual abuse material (CSAM) or content sexualising minors (reported immediately to law enforcement and NCMEC/IWF); non-consensual deepfakes; unlawful, hateful, violence-glorifying or harassing content; disinformation, fraud, phishing, spam or malware; content infringing third-party intellectual property or privacy rights; or activities that overload systems or circumvent security. Violations may result in termination without notice and referral to the relevant authorities.
13. API Terms of Use
You are solely responsible for the confidentiality of your API keys; keys may not be transferred or shared. API requests, including request counts, token usage and IP-based statistics, are processed for security, abuse prevention, usage reporting and billing purposes (Privacy Policy Clause 2.1). The Company may apply rate limits, quotas and IP restrictions; overage is charged additionally, and keys may be suspended upon abuse. Where changes originate from model providers (removal, substitution or limitation of a model), notice will be given by reasonable means and period; no liability is accepted for such changes. If you transmit personal data of third parties via the API, you are the controller of that data; establishing a lawful basis, informing your end users and requesting a DPA are your responsibilities (see Privacy Policy Clause 6.3). You may not use the API for reverse engineering, developing competing products/models, or circumventing security. The API is provided without any uptime guarantee unless a separate written SLA is executed.
14. Force Majeure
The Company cannot be held liable for delay or non-performance caused by events beyond its reasonable control (including natural disasters, war, epidemics, strikes, government actions, internet/telecommunications outages, power outages, or third-party service/cloud/AI provider failures).
15. Copyright Complaints (DMCA / Takedown)
If you believe your copyright has been infringed, send a notice to [email protected] including a description of the work, the location of the infringing material, your contact details and a good-faith statement. For valid notices, we will remove the content and terminate the accounts of repeat infringers.
16. Governing Law
These Terms are governed by the laws of England and Wales, without regard to conflict-of-laws principles. The CISG does not apply. If you are a consumer, the mandatory consumer protection provisions of your country of residence are preserved.
17. Dispute Resolution, Arbitration and Class Action Waiver
For disputes arising from these Terms, the parties agree to negotiate in good faith for 30 days before pursuing litigation or arbitration. Disputes are subject to the exclusive jurisdiction of the courts of England and Wales. The parties (in particular Business Users) may agree to resolve disputes through LCIA arbitration seated in London. Claims may be brought only on an individual basis. This clause does not affect non-waivable consumer rights.
18. General Provisions
Severability, entirety, waiver and assignment provisions apply. You represent that your use of the Services complies with export control and sanctions laws (UK/EU/US-OFAC) and that you comply with anti-corruption laws including the UK Bribery Act 2010. We may update these Terms; material changes will be notified within a reasonable period. In the event of any discrepancy between the Turkish and English versions of the Terms, the English version prevails, without prejudice to mandatory local law.
Class Action Waiver
YOU AND THE COMPANY AGREE THAT CLAIMS MAY BE BROUGHT ONLY ON AN INDIVIDUAL BASIS AND THAT YOU MAY NOT PARTICIPATE IN ANY CLASS ACTION.
Important Legal Notice
BY USING THIS SERVICE, YOU REPRESENT THAT YOU HAVE READ, UNDERSTOOD AND ACCEPTED ALL OF THE TERMS ABOVE; AND THAT YUXOR PROVIDES NO WARRANTIES AND LIMITS ITS LIABILITY TO THE MAXIMUM EXTENT PERMITTED BY LAW.
You are strongly advised to seek independent legal advice regarding the legal consequences of this agreement.