Privacy policy

This privacy policy describes how YARDA AI, a limited liability company (SARL) under Ivorian law, registered with the Trade and Personal Property Credit Registry (RCCM) of Abidjan, with its registered office in Abidjan, Côte d’Ivoire (hereinafter "YARDA AI", "we", "our" or "us"), collects, uses, stores and protects the personal data of its users, clients and visitors (hereinafter "you" or "your"). This policy is established in accordance with: • Law No. 2013-450 of June 19, 2013 on the protection of personal data in Côte d’Ivoire • UEMOA Regulation No. 08/CM/UEMOA on the protection of personal data in the UEMOA zone • Recommendations of the Telecommunications/ICT Regulatory Authority of Côte d’Ivoire (ARTCI) • International best practices in data protection (EU GDPR, as reference)

The data controller is: YARDA AI SARL Registered office: Abidjan, Côte d’Ivoire For any question about the protection of your personal data, write to us through the contact form on this website ("Request a demo" section), stating the purpose of your request. A dedicated email address will be published here shortly.

In the course of our activities, we may collect the following categories of data: a) Identification data: • First and last name • Professional email address • Phone or WhatsApp number (optional) • Company name and country b) Technical data: • IP address, used only temporarily to limit abuse (repeated submissions) and never stored with your request c) Transactional data (within our SaaS platform): • Financial transaction data transmitted by our operator clients (MTO/MMO) via our API • Risk scores and platform decisions • Alert and review history d) Communication data: • Content of messages sent through our contact form • Technical support correspondence history Important: Transactional data processed by our platform is transmitted by our operator clients as part of their AML/CFT compliance obligations. YARDA AI acts as a data processor for this data in accordance with processing agreements concluded with each client.

Your personal data is processed for the following purposes: a) Contractual performance: • Provision of our fraud detection and compliance services • Management of your client account and subscription • Technical support and assistance b) Legitimate interest: • Improvement of our services and platform • Anonymized statistical analysis of our AI model performance • Infrastructure security and abuse prevention c) Consent: • Answering your demo and contact requests, with your explicit agreement d) Legal obligation: • Compliance with AML/CFT regulatory obligations • Responding to requests from competent authorities (CENTIF, BCEAO, ARTCI) • Data retention in accordance with legal requirements

We retain your personal data for the following periods: • Identification and account data: throughout the contractual relationship, then 5 years after contract termination in accordance with Ivorian legal obligations • Transactional data: in accordance with AML/CFT legal retention obligations (minimum 10 years from account closure or transaction execution, per UEMOA regulations) • Communication data: 3 years from last contact • Prospecting data: 3 years from last contact Upon expiration of these periods, your data is deleted or irreversibly anonymized.

Your personal data may be shared with the following technical sub-processors, strictly to provide the service: • Vercel: hosting of the website and the console (global delivery network) • Railway: API hosting (United States) • Neon: database (United States, encrypted at rest by the provider) • Comet ML: storage of each client’s AI models • Resend: transactional e-mails, once enabled Competent authorities: upon legal request from judicial or regulatory authorities, or as part of reporting obligations to the CENTIF. International transfers: data is currently hosted outside the UEMOA zone, in the United States. These transfers are governed by our providers’ contractual terms. We are assessing hosting closer to our clients. We never sell your personal data to third parties.

We apply the following measures to protect your data: • Encrypted connections (HTTPS) across the website, the console and the API • Database encryption at rest, provided by our hosting provider • Strict isolation of each client’s data within the platform • Role-based access control and regularly renewed authenticated sessions • Pseudonymisation of identifiers sent by our operator clients • Logging of access and sensitive actions In the event of a data breach likely to result in a high risk to your rights and freedoms, we will inform you without undue delay in accordance with applicable law.

The marketing website sets a single cookie, and only if you change language with the FR / EN switch: yarda_lang, which remembers the language you chose (fr or en) for twelve months, so that yarda.tech opens in that language on your next visit. It holds nothing else, is read only by the website and is used for neither audience measurement nor advertising. You can delete it at any time in your browser settings. The website uses no audience measurement or advertising tools. The client console only uses a session cookie that is strictly necessary to sign in. It keeps your display preferences (language, theme, period) in your browser’s local storage and never shares them with third parties. Should we ever add audience measurement, it will work without cookies and this policy will be updated beforehand.

In accordance with Law No. 2013-450 of June 19, 2013 and UEMOA regulations, you have the following rights: • Right of access: obtain confirmation that your data is being processed and obtain a copy • Right of rectification: have your inaccurate or incomplete data corrected • Right of erasure: request deletion of your data in cases provided by law • Right to object: object to the processing of your data on legitimate grounds • Right to restriction: request limitation of processing in certain cases • Right to portability: receive your data in a structured, commonly used format To exercise these rights, write to us through the contact form on this website ("Request a demo" section), stating the purpose of your request. We will respond to your request within a maximum of 30 days. In case of difficulty, you may file a complaint with ARTCI (Telecommunications/ICT Regulatory Authority of Côte d’Ivoire).

We may update this privacy policy. Any significant change will be indicated on this page, together with its update date. We encourage you to review it regularly.

For any question about this privacy policy or the processing of your personal data, write to us through the contact form on this website ("Request a demo" section), stating the purpose of your request. YARDA AI SARL Registered office: Abidjan, Côte d’Ivoire