How we use your data when you sign up
Who is responsible. Genetic History S.L.U. is responsible for this processing on yfull.ai. You can reach our data protection contact at dpo@yfull.ai.
What we use and why. When you request a signup link, we use your email address, your invitation code and the language of this page to send you an email with a link. The link lets you show that you can receive email at that address before an account is created. Your account is created only later, in a separate step, if you choose to create it. We do this because you ask us to, as a step before the agreement for your account (Article 6(1)(b) of the GDPR). We need your email address and invitation code to send the link; without them we cannot create your account.
Keeping the form secure. To protect this form from bots and repeated requests, our security provider Cloudflare checks your IP address and interaction signals, and we count requests from your IP address for one minute. Like every request to our website, your request is also recorded in our web server's technical log with your IP address, the time, the page address and your browser type, but not your email address. We do this on the basis of our legitimate interest in keeping the service secure (Article 6(1)(f) of the GDPR).
Who receives the data. Our email provider Resend (Plus Five Five, Inc.), in the United States, receives your email address and the email, including the link, to deliver it. Cloudflare, Inc., in the United States, runs the security check. Our hosting provider Scaleway SAS stores our data in France. The safeguards for the transfers to the United States are described under Cross-border transfers in our Privacy notice.
How long we keep it. Until you create an account, we keep no record of your request in our database. The link is valid for 15 minutes, and we do not store it. Resend keeps the email and its delivery record for 30 days. We delete the web server's technical log within 16 days. If you create an account, we keep your email address, your password in protected form and the invitation you used until your account is deleted, for example when you ask us to delete it at dpo@yfull.ai. When you create your account and each time you sign in, we keep a session record with your IP address and browser type until you sign out or your account is deleted. Where Spanish law requires blocking, the data remain restricted solely for the possible liabilities arising from processing until the applicable limitation periods expire, and are then destroyed. We keep encrypted backup copies of our customer database only so that we can restore it. If you create an account, its data can remain in these copies after they are deleted from our systems, until the copies themselves are deleted, which our backup schedule sets at 15 days for daily copies, 90 days for Sunday copies and five years for copies made on the first day of a month. An encrypted copy of these backups is also kept at our separate backup location in Spain (EU); we have not yet confirmed when that copy is deleted. The email in your own mailbox, and any copy of the link kept by your browser or email program, remain under your control.
Your rights. You can ask for access to your data, its correction or deletion, restriction of its use, or its portability, by writing to dpo@yfull.ai. You can also complain to the Spanish Data Protection Agency (AEPD) at www.aepd.es.
Your right to object. You can object at any time, on grounds relating to your particular situation, to the security processing described above, which rests on our legitimate interest, by writing to dpo@yfull.ai.
