Legal
Privacy Policy
Last reviewed 26 May 2026
The two things people ask first:
1. We don't use your uploads or generated outputs to train any AI model — ours or anyone else's.
2. We don't sell your data to anyone, ever.
What we collect, and why
Account information
When you create an account: your name, email address, hashed password, signup IP address, and the timestamp of registration. We use this to give you an account that works, to verify your email, to log you in, and to detect signup-gate abuse.
Legal basis: performance of the contract you enter into by creating an account, and our legitimate interest in preventing abuse.
Your uploads and generated outputs
When you use the tools: reference images you upload, prompts you type, palettes you save, briefs you build, AI-generated plates and prints, scan reports, and CAD outputs. These are stored on UK-hosted disk against your user account.
Legal basis: performance of the contract — you asked us to process and store them.
Credit and usage records
Every action that spends or grants credits is logged: action name, model used, credits spent or refunded, timestamp. We use this to keep your balance correct, to show you your activity history, and for billing audit.
Legal basis: performance of the contract, and our legal obligation to maintain accurate billing records.
Email-related tokens
Email verification and password-reset tokens are stored as one-way hashes alongside your user id and an expiry timestamp. The plaintext token only ever appears in the email link to you. Verification tokens are valid for 24 hours; reset tokens for 1 hour. Used tokens are kept for a short audit window then deleted.
Session cookie
When you log in, we set a single session cookie (the standard PHP session cookie). It's used solely to keep you logged in. It's not used for tracking, analytics or advertising. We don't use third-party analytics, advertising pixels, or behavioural-tracking cookies on the YakLab application.
Who your data goes to
We use a small number of service providers to run YakLab. These are our sub-processors:
| Provider | What for |
|---|---|
| Fasthosts | UK web hosting (account database, file storage) and SMTP relay for outbound email. UK-based. |
| Google (Gemini API) | AI generation. Your prompts and reference images are sent to Google's Gemini API to produce each output; Google may process the request in the EU, US, or other regions per their published terms. We use the standard commercial API tier — Google's terms confirm that paid-API content is not used to train their models. |
| Stripe (when paid plans launch) | Payment processing only. Card data is collected directly by Stripe and never touches our servers. We receive a confirmation that a payment succeeded, plus the credit pack you bought. |
That's the whole list. We don't share your data with advertisers, data brokers, social platforms, or anyone else. If we ever add a sub-processor, this page gets updated and account holders are emailed.
International transfers
Your account and files are stored in the UK (Fasthosts). When you generate an image, the request leaves the UK to reach Google's Gemini infrastructure, which may process it in the EU, US, or another region. Google operates under Standard Contractual Clauses for transfers out of the UK/EEA, which is the legal framework UK GDPR requires for transfers to countries without an adequacy decision.
How long we keep it
- Account, uploads, outputs: for as long as your account is open.
- Credit and usage records: retained for 6 years after account closure to meet UK tax and accounting record-keeping requirements.
- Email verification tokens: 24 hours, then deleted.
- Password reset tokens: 1 hour, then deleted.
- Server access logs: rotated by our host (Fasthosts) on their standard schedule, typically 30–90 days.
When you delete your account, your files are unlinked from disk immediately and your row is removed. Some records may persist briefly in encrypted backups for up to 30 days before backup rotation completes. After that, we only retain records we have a legal basis under UK GDPR to keep — credit and usage logs (for tax and accounting), and any records needed for active dispute resolution or fraud investigation.
Your rights under UK GDPR
You have the following rights:
- Access — ask for a copy of the personal data we hold about you.
- Rectification — ask us to correct anything wrong.
- Erasure — ask us to delete your data (subject to the retention obligations above).
- Portability — ask for an export of your data in a structured, machine-readable format.
- Restriction — ask us to pause certain processing while a dispute is resolved.
- Objection — object to processing based on legitimate interests (we don't use legitimate-interest processing for marketing).
- Complaint — lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. We'd appreciate you raising it with us first so we can try to fix it, but you don't have to.
To exercise any of these rights, email hello@yaklab.co.uk. We respond within 30 days, usually faster, at no cost.
Security
Your password is stored as a salted hash, never in plain text. Sessions use a server-set cookie and are bound to your account ID. Email tokens are stored hashed and are single-use with short expiry windows. Database backups are encrypted at rest. All connections between your browser and the YakLab app use HTTPS.
No system is perfectly secure. If we ever discover a breach of your personal data that creates a meaningful risk to you, we'll tell you and notify the ICO as required by UK GDPR (within 72 hours of becoming aware).
Children
YakLab isn't intended for anyone under 18. We don't knowingly create accounts for children. If we discover an account belongs to a minor, we'll close it and delete the associated data. If you think a minor has signed up, email hello@yaklab.co.uk.
Marketing
We send transactional emails about your account (welcome, verify email, password reset, billing receipts when paid plans launch, expiry warnings). These you can't unsubscribe from while you have an active account — they're necessary for the service to work.
We don't currently send marketing emails. If we ever start, it'll be opt-in only and you'll be able to unsubscribe at any time from a link in the footer of every such email.
Changes to this policy
If we change anything material in this policy, we email account holders at least 14 days before the new version takes effect. The date at the top of this page bumps on every revision. The updated policy applies from the effective date stated in the notice.
Questions about anything in here? hello@yaklab.co.uk. The data controller is Threadline Studios Ltd, the company that operates YakLab.