Privacy Policy

v3 — we keep this policy honest and current. If we change what data we collect, how we use it, or who processes it on our behalf, this page updates first and we email account holders before the change takes effect.

This Privacy Policy describes how TOP LLC, a Minnesota limited liability company doing business as Yorvana ("Yorvana," "we," "us," or "our"), collects, uses, discloses, and protects information when you use yorvana.com and related services (the "Service").

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, do not use the Service.

1. Who we are

Legal entity: TOP LLC, a Minnesota limited liability company
Doing business as: Yorvana
Mailing address: 7578 Homestead Ave S, Cottage Grove, MN 55016, United States
Contact email: hello@yorvana.com
Contact form: yorvana.com/contact
Founder and authorized representative: Nick Fisher, CEO

For privacy-related inquiries, you may contact us via email or our contact form (select "Data privacy request" as the reason).

2. Information we collect

2.1 Information you provide directly

• Account information: your name, email address, business name, business address, and phone number. We use magic-link (email) authentication by default; if you choose to set a password, it is stored only as a salted hash by our authentication provider (Supabase) — never in plain text.
• Business profile data: menu items, hours, locations, photos, branding information, gift card designs, customer-facing content, and similar business operating data you input or upload.
• Customer data you upload: names, email addresses, phone numbers, birthdays, visit history, spending data, and preferences of your customers, which you upload or import into our CRM feature. You are responsible for ensuring you have a lawful basis to share this data with us.
• Payment-card processing statements: if you use the statement audit feature, you upload payment-processing statements which may contain transaction data, fee disclosures, and merchant account identifiers. We process these only to provide the audit.
• Communications: messages you send to us through chat, email, our contact form, support tickets, or feedback forms.

If you use our free Statement Audit tool at /audit (no account required), we collect the statement you upload, the analysis we generate from it, and — if you choose to unlock the full report — your name, email, and optional phone number so we can send you the PDF and follow up with a consultation.

2.2 Information collected automatically

• Usage data: pages visited, features used, actions taken within the Service, timestamps, and session duration.
• Device and connection data: IP address, browser type and version, operating system, device identifiers, language preferences, and approximate location derived from IP.
• Cookies and similar technologies: we use first-party cookies for authentication, session management, and analytics. We do not use third-party advertising cookies.
• Logs and diagnostic data: server logs, error reports, and performance metrics necessary to operate and improve the Service.

2.3 Information from third parties

If you connect the Service to a third-party platform — Google Business Profile, Meta (Facebook / Instagram), TikTok, or X — we receive information from those platforms as authorized by you, including reviews, social posts, listings, and engagement data. The information received depends on the specific permissions you grant when you connect each platform.

3. How we use information

We use information to:

• Provide, operate, maintain, and improve the Service
• Authenticate your account and process your requests
• Generate AI-drafted content (social posts, review replies, marketing emails, menu descriptions, chat answers) in your specified brand voice
• Sync content and listings to connected third-party platforms when you authorize us to do so
• Detect, prevent, and address technical issues, fraud, and abuse
• Send service-related communications (account notices, security alerts, billing updates, and feature announcements)
• Send marketing communications, where permitted by law, with the ability to opt out at any time
• Comply with legal obligations and enforce our Terms of Service
• Conduct analytics and research to improve the Service

We do not sell your personal information or your customers' personal information to third parties.

4. AI processing

The Service uses artificial intelligence to generate content, analyze data, and provide automated features. When AI processing occurs:

• We send relevant input data (such as menu items, your brand voice settings, prior review text, or your uploaded processing statements) to the AI provider sub-processors listed in Section 6.
• AI providers process the data to return generated content (drafts, replies, analyses, recommendations).
• Generated content is returned to you for approval before publishing or sending in most workflows; you remain responsible for content you ultimately publish.
• We use these providers' commercial APIs. Under those API terms, inputs are not used to train the providers' general-purpose models; providers may retain inputs for a limited period (for example, for abuse monitoring) per their published policies. Your statements are never sent to consumer-tier AI services.

5. Sharing of information

We share information only as follows:

5.1 Sub-processors

We use vetted third-party sub-processors to operate the Service. These sub-processors process information on our behalf under confidentiality and security obligations. See Section 6 for the current list.

5.2 Third-party platforms you connect

When you authorize the Service to connect with Google Business Profile, Meta (Facebook / Instagram), TikTok, or X, we send data to those platforms as necessary to fulfill the workflows you initiate (for example, publishing a social post or syncing your business hours). Each platform has its own privacy policy governing the data it receives.

5.3 Legal requirements

We may disclose information if required to do so by law, valid legal process, or to protect the rights, property, or safety of Yorvana, our users, or others.

5.4 Business transfers

If Yorvana is involved in a merger, acquisition, asset sale, or bankruptcy, information may be transferred as part of that transaction, subject to standard confidentiality and continuity-of-policy obligations.

5.5 With your consent

We may share information for purposes not described in this policy with your explicit consent.

6. Sub-processors

We use the following sub-processors to operate the Service. This list reflects the providers actually configured in production today; it will be updated as we add or change providers, and substantive changes will be communicated in advance where reasonably practicable.

Full DPA links and current sub-processor changes are available on request at hello@yorvana.com. We do not sell or rent your data to anyone, and we do not share it with parties outside this list except as described in Section 5.

7. Data retention

We retain personal information only for as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements.

• Account data: retained for the life of your account, plus 90 days after termination for billing and dispute resolution
• Customer data you upload: retained for the life of your account; deleted within 30 days of your account termination unless you export it first
• Processing statements: encrypted at rest and retained for 24 months by default; you can request earlier deletion at any time
• Usage and diagnostic logs: retained for up to 12 months
• AI inputs and outputs: AI provider sub-processors retain inputs only for the limited periods described in their API terms; we retain generated outputs within your account for as long as you keep them
• Backup data: may persist in encrypted backups for up to 35 days after deletion from active systems

Specific retention periods may be longer if required by law (for example, tax records retained for 7 years).

8. Your rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access — request a copy of personal information we hold about you
• Correction — request correction of inaccurate or incomplete information
• Deletion — request deletion of your information (subject to legal retention requirements)
• Portability — request transfer of your data in a machine-readable format
• Objection / restriction — object to or restrict certain processing
• Withdrawal of consent — withdraw consent for processing that relies on consent

To exercise any of these rights, you may use either of the following methods:

1. Email hello@yorvana.com from the email address associated with your account
2. Submit our contact form at yorvana.com/contact (select "Data privacy request" as the reason)

We will respond within 30 days, or notify you if we need additional time.

Meta data deletion callback

Per Meta Platform Terms, users of our service who have connected their Meta (Facebook / Instagram) account may request deletion of their Meta-sourced data at any time using any of the following methods:

• Email hello@yorvana.com with the subject line "Meta Data Deletion Request"
• Submit our contact form at yorvana.com/contact
• Visit our dedicated data-deletion page for full instructions

We will confirm deletion within 30 days and provide a confirmation code per Meta's data-deletion specification.

9. Security

We implement administrative, technical, and physical safeguards designed to protect personal information, including:

• Encryption in transit (TLS 1.2+) and at rest
• Email magic-link authentication by default; optional account passwords are stored as salted hashes, never in plain text
• Access controls limiting who can reach production data
• We never see or store your credit card information
• Regular security review of dependencies and infrastructure

No system is perfectly secure. We will notify affected users and applicable authorities of any breach of personal information in accordance with applicable law.

10. Children

The Service is not directed to individuals under 18 and we do not knowingly collect personal information from children. If you believe we have collected information from a child, contact us at hello@yorvana.com and we will delete it.

11. International users

The Service is operated from the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States (and, for the sub-processors noted in Section 6, the countries listed there). By using the Service, you consent to this transfer.

If you are located in the European Economic Area, United Kingdom, or another jurisdiction with applicable cross-border transfer requirements, you may have additional rights. Contact us at hello@yorvana.com for information about our cross-border transfer mechanisms.

12. California residents

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including the rights described in Section 8 plus:

• The right to know what categories of personal information we have collected and disclosed in the past 12 months
• The right to opt out of the "sale" or "sharing" of personal information (we do not sell or share personal information for cross-context behavioral advertising)
• The right to non-discrimination for exercising privacy rights

To exercise these rights, use either of the two methods California law requires us to make available:

1. Email hello@yorvana.com
2. Submit our contact form at yorvana.com/contact (select "Data privacy request" as the reason)

These two designated methods satisfy the CCPA / CPRA requirement that businesses provide at least two methods for submitting consumer privacy requests.

13. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email and via in-Service notice at least 30 days before taking effect. The "Last updated" date at the top reflects the most recent revision.

14. Contact

For questions, complaints, or requests related to this Privacy Policy:

TOP LLC dba Yorvana
7578 Homestead Ave S, Cottage Grove, MN 55016
United States
Email: hello@yorvana.com
Web: yorvana.com
Contact form: yorvana.com/contact

TOP LLC dba Yorvana