Privacy & GDPR
How to recognise a GDPR-compliant AI assistant: a DPA under Art. 28, the server location, no training on your data, deletion periods and the EU AI Act.
Privacy and GDPR at Yura: your data security is our top priority. Learn how we collect, store, and protect your information in compliance with GDPR regulations.
Certified infrastructure
These certificates belong to our hosting partner and its data centres. Yura itself does not hold them – we run the service on this audited infrastructure.
GDPR Compliant
Full compliance with EU data protection regulations
Hosted in Germany
Our hosting partner's data centres in Germany
Certified Datacenters
Certifications held by our hosting partner's data centres
SSL/TLS
Encrypted transfer between your device and Yura
Servers in Germany
Application, database and AI model requests in Germany
Climate Friendly
The data centers of our hosting partner run on green electricity
Your Data Rights
Under GDPR, you have comprehensive rights over your personal data
Right to Access
You have the right to request a copy of all personal data we hold about you.
We will provide you with a complete copy of your data in a structured, commonly used format within 30 days of your request.
Right to Rectification
You can request correction of inaccurate or incomplete personal data.
Simply contact us with the correct information, and we will update your data promptly.
Right to Erasure
You can request deletion of your personal data ("right to be forgotten").
We will delete your data unless we have a legal obligation to retain it. This process typically takes 30 days.
Right to Data Portability
You can receive your data in a portable format and transfer it to another service.
We provide data exports in JSON, CSV, or XML format for easy transfer to other platforms.
Right to Object
You can object to processing of your personal data for specific purposes.
This includes objecting to direct marketing, profiling, and processing based on legitimate interests.
Right to Restriction
You can request restriction of processing in certain circumstances.
We will mark your data and only process it with your consent or for legal claims.
Security Infrastructure
How we protect your data with enterprise-grade security
Data Encryption
All data is encrypted at rest using AES-256 and in transit using TLS 1.3.
Access Control
Role-based access control ensures only authorized personnel can access data.
Regular Audits
Independent security audits conducted quarterly to ensure compliance.
Backup & Recovery
Automated daily backups with 30-day retention and disaster recovery plan.
How to recognise a GDPR-compliant AI assistant
Seven points to settle before rollout, with our answer for Yura.
Check · Why it matters · How Yura handles it
Data processing agreement (Art. 28 GDPR): Anyone letting an external AI service process personal data needs a DPA. Without one, company use is open to challenge. Raise it with us before the contract starts. We settle the DPA together with your data protection officer.
Server location: Where data sits determines which level of protection applies and which authorities can demand access. Application and database run in our hosting partner's data centres in Germany. A DPA is in place with the host.
Transfers to third countries: As soon as a language model answers from outside the EU, you need a legal basis. Vendors who never mention this usually have not settled it. Model requests are processed in Germany. The exact wording is in our privacy policy.
No training on your content: Consumer plans from large vendors allow inputs to be used for model improvement. That is not an option for company data. We use business and enterprise interfaces only. It is contractually established that your inputs, documents and company data do not feed the training of global models.
Deletion policy and deadlines: The right to erasure only works in practice if the vendor has defined processes and deadlines. Chat logs that are no longer needed are deleted automatically after 30 days. We handle access, export and erasure requests within 30 days.
Encryption: Without encryption at rest, any access to the infrastructure becomes a data breach. AES-256 for stored data, TLS 1.3 in transit.
Control over operations: Some industries may not let certain data leave their own network at all. For those cases we offer operation on your own infrastructure with complete audit logs.
What the AI Act changes
The substantive obligations of the EU AI Regulation apply from 2 August 2026.
The AI Act classifies systems by risk. For most office applications this means transparency and documentation duties rather than the strict requirements for high-risk systems. What counts is how you use the system in practice. That classification is made by the operator, not the vendor.
Transparency towards people
People must be able to tell that they are dealing with an AI system. Yura marks generated replies and calls accordingly.
Traceability
You should be able to show which task the system took over. Yura records which message triggered which action.
Human in the loop
Yura proposes replies, tasks and appointments. In the default settings a person decides what actually goes out.
Classifying your purpose
Whether your specific case counts as high-risk (in recruitment, for example) depends on the use. Your data protection officer makes that assessment; we supply the technical details for it.
Have Questions About Your Data?
Privacy Questions
Answers to what gets asked most. Something else on your mind?
Is the Yura chatbot GDPR-compliant?
Yes. Like every Yura module, the chatbot runs on servers in Germany, chat histories are never used to train AI models and are deleted after the retention period you set. Before it goes live on your website or in WhatsApp we sign a data processing agreement under Art. 28 GDPR. You decide which data the chatbot may collect.
Where is my data stored with Yura?
The application and database run in our hosting partner's data centres in Germany, and a data processing agreement is in place with the host. Requests to the language models are processed in Germany as well. The full wording is in our privacy policy.
Does Yura use my data to train AI models?
No. We use business and enterprise interfaces from the model vendors only, and it is contractually established that your inputs, documents and company data are not used to train global models.
Do I get a data processing agreement under Art. 28 GDPR?
A DPA belongs to every rollout that processes personal data. Raise it with us before the contract starts and we will settle the paperwork directly with your data protection officer.
How long are chat histories kept?
Chat logs are stored temporarily to handle the request in question. Unless law or contract says otherwise, logs that are no longer needed are deleted automatically after 30 days.
How do I request access to my stored data?
Write to us through the contact form. You will receive a complete copy of your data within 30 days in a structured, common format, as JSON, CSV or XML.
What happens to my data if I cancel?
You can export your data before cancelling. After that it is deleted, unless a statutory retention duty applies (commercial or tax deadlines for invoice data, for example).
Is Yura itself certified?
No, and we state that deliberately. The certificates shown on this page belong to our hosting partner and its data centres. We run the service on that audited infrastructure but are not the certificate holder ourselves.
Can we run Yura in our own data centre?
Yes. For organisations with stricter requirements there is operation on your own infrastructure, including complete audit logs and a connection to your own roles and permissions setup.
Does Yura make automated decisions about people?
Not in the default settings. Yura prepares replies, tasks and appointments; a person approves them. If you want to automate a process end to end, have it assessed under data protection law first.
What does the EU AI Act change for us?
The substantive obligations of the AI Regulation have applied since 2 August 2026. For office workflows the focus is on transparency and documentation. How your specific purpose is classified is decided by your data protection officer. We provide the technical details.