Yacooti helps agencies turn a client's brief into narrated videos, and recut videos of people talking to camera. To do that we handle information about the people who use Yacooti, and about the brands, products and people that appear in the videos. This policy explains what we collect, why, who we share it with, how long we keep it, and what you can ask us to do with it.
Who we are
Yacooti ("we", "us") is based in Nairobi, Kenya. Our postal address is P.O. Box 74139 - 00200, Nairobi, and you can reach us at info at yacooti dot com .
We follow Kenya's Data Protection Act, 2019 and its regulations. If you are in the European Union or the United Kingdom, we also apply the rights the GDPR gives you.
Your data and your clients' data
Information reaches us in two ways, and our responsibility differs between them.
- Information about you, the people who use Yacooti: your email address, your workspace, your payments and how you use the service. We decide how this is used, so we are its data controller.
- What you upload for your clients: briefs, logos, photos, testimonials, footage and the people in it. Your agency decides what goes into Yacooti and what is made from it, so for this material your agency is the controller and we are its data processor. We use it only to make your videos and run the service, as our terms of service set out.
If you upload anything that shows or names a person (a customer quote, a staff photo, footage of someone speaking), it's your responsibility to have their permission to use it in this way.
What we collect
When you sign up and use your account
- Your email address, and a password if you choose to set one (stored only as a hash).
- The workspaces you belong to, your role in each, the invitations you send and receive, and a log of changes to members, roles, plans and billing.
- Your email preferences, and a record of which emails we've sent you.
What you put into Yacooti
- Clients, brand kits (colours, fonts, logos, voice and music choices) and any names of people or products in your glossary.
- Briefs: products, offers, prices, contact details, facts, testimonials and the names of the people who gave them.
- Images and video footage you upload, including the faces and voices of the people in them.
- Scripts, cards, comments, approvals and the videos we make.
When you pay
Payments are handled by Paystack. You enter your card or M-Pesa details on Paystack's checkout, not ours, so we never see or store your full card number or M-Pesa PIN. We keep the payment's reference, amount, method (card or M-Pesa), plan, dates and whether it went through, and Paystack's identifiers for your subscription.
When you write to us
When you use our contact page we keep your name, email address, company (if you give one), the topic and your message, with your IP address and browser details, and your account if you were logged in. We use them only to answer you.
Automatically
- Your IP address and browser details, in our server logs and to limit how often log-in, sign-up and similar actions can be tried.
- When you last logged in, and which device sessions are open.
- Whether our emails reached you, and whether you opened them or clicked their links. Our email provider, Brevo, records this: links in our emails pass through Brevo's address (r.mail.yacooti.com) on their way to the page, and emails may carry a tiny image that tells Brevo they were opened. We use it to see that emails arrive and which ones are useful.
- What each workspace uses (videos made, minutes transcribed, rendering time) and what it costs us, to apply plan limits and price fairly.
We don't use advertising trackers, and we don't buy information about you from anyone else.
Why we use it
| What we do | Why we're allowed to |
|---|---|
| Run your account and workspaces, make your videos, store and deliver them | To perform our contract with you |
| Take payments, apply your plan and its limits, send receipts | To perform our contract, and to keep the records tax law requires |
| Send account emails: log-in links, invitations, videos ready, approvals, payment problems | To perform our contract |
| Send tips, reminders and a monthly recap | Our legitimate interest in helping you get value from Yacooti. Turn them off at any time from any of these emails or your account settings. |
| Answer messages you send through our contact page | Our legitimate interest in answering you, or steps you ask for before signing up |
| Keep the service secure, stop abuse and bots, fix errors | Our legitimate interest in a safe, working service |
| Understand costs and usage, to set prices and plan improvements | Our legitimate interest in running a sustainable business |
| Respond to legal requests, enforce our terms | Legal obligation, and our legitimate interests |
We don't sell personal information, and we don't use it for advertising.
AI and your content
Yacooti uses AI services to do its work:
- Scripts and recut cards are written by Claude, from Anthropic. It receives the brief, smaller copies of the images you picked, and for recuts the transcript of the footage.
- Narration and music are made by ElevenLabs from the script's words and the music style. Our narrators are synthetic voices designed for Yacooti, not recordings or copies of real people's voices.
- Transcripts of footage are made by ElevenLabs' speech-to-text, which receives the footage's sound and the names in your glossary.
- Framing recuts: to keep the speaker in the frame, our own software finds where a face is in the footage. It records only the face's position and size. It doesn't identify who the person is, and we keep no facial template or other biometric profile.
We send these services only what each step needs, through their business services. We don't train AI models on your content, and we don't let anyone else use it to train theirs where we can choose. You read and approve every script before a video is made.
Where it's stored
Your uploads and videos are stored with Amazon Web Services in Stockholm, Sweden, and our database is hosted in the United States. Some of the providers above process data in other countries, including the United States. When information leaves Kenya, we rely on the safeguards the Data Protection Act requires: providers bound by contract to protect it, with security measures at least as strong as this policy describes.
How long we keep it
| Information | Kept for |
|---|---|
| Your account | As long as you have it. Ask us to delete it and we will, along with workspaces where you are the only member. |
| Clients, brand kits, briefs, images and videos | Until you delete them. Deleted items wait in the workspace's trash for 30 days, so mistakes can be undone, and are then deleted for good. |
| Working copies of footage | Up to 90 days. Your original upload is kept until you delete the recut. |
| Log-in links and sessions | Log-in links work for 15 minutes; a session lasts up to 14 days. |
| Invitations | 7 days, or until accepted. |
| Payment records and receipts | As long as Kenyan tax law requires, even after an account is deleted. |
| Messages sent through the contact page | As long as we need them to answer you and follow up. Ask us and we'll delete them. |
| Server logs | Only as long as needed to keep the service secure and working. |
Copies in our providers' backups are overwritten on their own schedule after the original is deleted.
How we protect it
- Everything travels over encrypted connections, and our providers encrypt it where it's stored.
- Passwords are stored only as salted hashes, and log-in and invitation links only as hashes of the link.
- Uploads and videos sit in private storage, reached through links that expire.
- Each person sees only what their role in the workspace allows, and changes to members, roles and billing are logged.
No system is perfectly secure. If a breach puts your information at risk, we will tell you without undue delay, and tell the Data Protection Commissioner as the law requires.
Your rights
You have the right to:
- be told how your information is used (this policy);
- get a copy of the information we hold about you;
- have it corrected if it's wrong, or deleted;
- object to, or ask us to restrict, how we use it;
- receive it in a format you can take elsewhere;
- withdraw your consent where we relied on it.
Email info at yacooti dot com to use any of these rights. We may ask you to prove who you are first. You can change your email address and which emails we send you yourself, in your account settings.
If you appear in a video an agency made with Yacooti, contact that agency first: they decided to use your image or words. We'll help them answer you.
If you're unhappy with how we've handled your information, you can complain to Kenya's Office of the Data Protection Commissioner , or to the data protection authority where you live.
Children
Yacooti is a service for businesses and isn't meant for anyone under 18. We don't knowingly collect information from children. Agencies must not upload images or footage of children without the consent of a parent or guardian.
Changes to this policy
When this policy changes, we'll update the date at the top. If a change matters to how your information is used, we'll email workspace owners before it takes effect.
Contact us
Questions about this policy or your information: info at yacooti dot com , or write to us at P.O. Box 74139 - 00200, Nairobi, Kenya.