Privacy notice
This page is in preparation. The full privacy notice for yfull.ai will ship in an upcoming release. Until then, the surfaces below cover your active rights and contact channels.
Your data rights are active now
- Submit access, portability, correction, deletion, or objection requests via the DSAR portal. We respond within one month per Article 12(3) of the GDPR.
- You also have the right to ask us to restrict how we use your data, and the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) at www.aepd.es.
- Manage non-essential consent at /account/consent/. Each consent slot describes the current per-purpose operational position.
- For privacy questions or to escalate a request, email our data protection contact at dpo@yfull.ai.
Data controller: Genetic History S.L.U., CIF B24962573, registered in Spain.
Your data rights under the GDPR
Full detail for this section ships in the upcoming release. In the meantime: for active rights actions, use the DSAR portal; for the current per-purpose operational position, see /account/consent/; for questions, contact dpo@yfull.ai.
Essential cookies
Full detail for this section ships in the upcoming release. In the meantime: for active rights actions, use the DSAR portal; for the current per-purpose operational position, see /account/consent/; for questions, contact dpo@yfull.ai.
Genetic data processing
Full detail for this section ships in the upcoming release. In the meantime: for active rights actions, use the DSAR portal; for the current per-purpose operational position, see /account/consent/; for questions, contact dpo@yfull.ai.
yfull.com account link
Full detail for this section ships in the upcoming release. In the meantime: for active rights actions, use the DSAR portal; for the current per-purpose operational position, see /account/consent/; for questions, contact dpo@yfull.ai.
Cross-border transfers
What crosses a border, and why. When our forms run an anti-bot check — for example when you join the waitlist or place your sample — our security provider Cloudflare, Inc., in the United States, processes your IP address and interaction signals to keep the service secure against automated bots and fraud. This is not your genetic data and not special-category data, and it does not run on your consent: it rests on our legitimate interest in keeping the service secure (Article 6(1)(f) of the GDPR, recognised by Recital 49).
How the transfer is protected. Because Cloudflare is in the United States, this is a transfer outside the European Union. It is protected by the EU–US Data Privacy Framework (the European Commission's adequacy decision under Article 45 of the GDPR) and, in our contract with Cloudflare, the European Commission's Standard Contractual Clauses (Module 2, under Article 46(2)(c) of the GDPR). You can ask for a copy of those Clauses at any time by emailing our data protection contact at dpo@yfull.ai.
AI training data
Full detail for this section ships in the upcoming release. In the meantime: for active rights actions, use the DSAR portal; for the current per-purpose operational position, see /account/consent/; for questions, contact dpo@yfull.ai.
Marketing communications
Full detail for this section ships in the upcoming release. In the meantime: for active rights actions, use the DSAR portal; for the current per-purpose operational position, see /account/consent/; for questions, contact dpo@yfull.ai.
Automated decision-making
Full detail for this section ships in the upcoming release. In the meantime: for active rights actions, use the DSAR portal; for the current per-purpose operational position, see /account/consent/; for questions, contact dpo@yfull.ai.
Sub-processor registry
Who processes your data on our behalf. A sub-processor is a company we use to carry out part of the service under our instructions and a written data-processing contract. yfull.ai uses the following sub-processors:
| Sub-processor | What they do | Where | Safeguard for any transfer |
|---|---|---|---|
| Scaleway SAS | Hosts your account and stored data | France (EU) — DC2, Vitry-sur-Seine, Val-de-Marne | Stays within the EU; no transfer to a third country |
| Cloudflare, Inc. (Turnstile) | Runs the anti-bot challenge on our forms, using your IP address and interaction signals | United States | EU–US Data Privacy Framework (adequacy), Standard Contractual Clauses (Module 2) — see Cross-border transfers |
If we add or change a sub-processor, we give you at least 30 days' written notice beforehand, so you can review the change.
Consent withdrawal
Full detail for this section ships in the upcoming release. In the meantime: for active rights actions, use the DSAR portal; for the current per-purpose operational position, see /account/consent/; for questions, contact dpo@yfull.ai.