Privacy Policy

Last updated: May 2026

1. Introduction

Welcome to YAM Digital Limited ("we," "our," or "us"). This Privacy Policy explains how we collect, use, and protect your personal information when you visit our website, contact us via phone, email, or messaging, or use our services. We are committed to protecting your privacy and complying with applicable data protection laws, including the General Data Protection Regulation (GDPR), the Irish Data Protection Act 2018, and the ePrivacy Directive as transposed into Irish law (S.I. No. 336/2011).

When you call our business line, your call is answered by an AI assistant that records audio, generates a transcript, and extracts relevant details to help us follow up on your enquiry. Section 18 of this policy explains this in detail.

2. Data Controller

The data controller responsible for your personal information is:

YAM Digital Limited
Company Registration Number (CRO): 812950
Registered Office: 18 Mallow Street Upper, Limerick, V94 N12Y, Ireland
Email: hello@yam.ie
Phone: +353 61 788 110
Website: https://yam.ie

For data protection inquiries, please contact us at hello@yam.ie.

3. Information We Collect

We collect the following types of information:

3.1 Information You Provide

When you submit our contact form, we collect:

Your name (required)
Email address (required)
Phone number (optional)
Message content (optional)
UTM parameters (source, medium, campaign, content, term) — automatically captured from the URL for marketing attribution

3.2 Automatically Collected Information

When you visit our website, the following data may be collected automatically by our hosting infrastructure:

IP address
Browser type and version
Device information
Pages visited and time of access
Referring website

We do not use any third-party analytics services (such as Google Analytics) on this website.

3.3 Cloudflare Turnstile

Our forms use Cloudflare Turnstile, a CAPTCHA alternative, to protect against spam and abuse. Turnstile may process your IP address and browser metadata to verify that you are a real user. This data is processed by Cloudflare, Inc. under their Privacy Policy. Cloudflare is certified under the EU–U.S. Data Privacy Framework. We use Turnstile on the basis of our legitimate interest in preventing spam (Article 6(1)(f) GDPR).

3.4 Information from Phone Calls

When you call our business line (+353 61 788 110), we collect the following:

Caller ID — your phone number, as transmitted by the telephone network (unless you have hidden it)
Call audio — the full audio recording of the conversation
Call transcript — a text transcription of the conversation generated automatically by our AI voice platform
Information you provide during the call — including your name, company, role, email address, project details, the reason for your call, and any other information you choose to share
Call metadata — date, time, duration of the call, which AI agent handled the call, and routing information
AI-extracted summary and classification — our AI agents may classify your call (e.g., as a sales enquiry, support request, or message) and extract a structured summary to help our team respond efficiently

You will be informed at the start of the call that the call is recorded and processed for service quality and follow-up purposes. If you do not wish your call to be recorded or processed by an AI agent, please contact us via email at hello@yam.ie or via the contact form on our website instead.

3.5 Information from Messaging Channels

If you contact us via WhatsApp (+353 85 146 4070), we collect:

Your name and profile information as displayed by WhatsApp
Phone number
Message content and any attachments you send
Date and time of the messages

WhatsApp messages are processed by Meta Platforms, Inc. under their own privacy policy.

4. How We Use Your Information

We use your personal information for the following purposes:

To respond to your enquiries received via phone, email, contact form, or messaging
To process and follow up on calls received on our business line, including by transcribing calls, extracting key details, and routing your enquiry to the appropriate team member
To classify enquiries (e.g., new project, existing client matter, message) so we can respond efficiently
To communicate about potential projects and collaborations
To deliver and manage services for clients with whom we have a business relationship
To improve our website, services, and AI agent performance (using anonymised or aggregated data only)
To comply with legal and accounting obligations
To protect our rights, property, and safety, and that of our clients

5. Legal Basis for Processing

We process your personal data based on:

Consent: When you submit the contact form and tick the consent checkbox, you provide consent for us to process your data to respond to your inquiry
Legitimate Interest: To operate our business communication channels (including phone calls answered by AI agents), respond to enquiries, maintain website security, and improve our services. See Sections 12 and 18 for details on phone call processing.
Contract: To fulfill service agreements with existing clients, including support and project communications
Legal Obligation: To comply with applicable laws, including accounting and tax compliance

6. Data Storage, Security and Retention

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. Your data is stored on secure servers with access controls.

We retain your personal information for the following periods:

Contact form submissions: 24 months from the date of submission, after which they are permanently deleted
Phone call recordings and transcripts: Up to 12 months from the date of the call, after which they are deleted from our processing systems. Call summaries and contact details may be retained longer as part of our CRM (see below)
Phone call summaries and lead records (CRM): For the duration of the business relationship plus 7 years for accounting and legal compliance purposes; or 24 months if no business relationship is established
WhatsApp / messaging conversations: Retained for the duration of the conversation and up to 24 months afterwards for follow-up; longer if a business relationship is established
Client project data: For the duration of the business relationship and up to 7 years afterwards for legal and tax compliance purposes
Session data: Automatically deleted when the session expires (typically 2 hours of inactivity)

7. Data Sharing

We do not sell, trade, or rent your personal information to third parties.

We use the following third-party service providers ("processors") who process personal data on our behalf to deliver our services:

Telephony and AI processing

Twilio Inc. (USA) — provides our business phone number and routes incoming calls. Twilio processes caller phone numbers, call audio, and call metadata. Twilio is certified under the EU–U.S. Data Privacy Framework. See Twilio Privacy Notice.
ElevenLabs Inc. (USA) — provides the AI voice platform that answers our calls, generates transcripts, and extracts call summaries. ElevenLabs processes call audio, transcripts, and your conversation contents. We have a data processing agreement with ElevenLabs and rely on Standard Contractual Clauses for the international transfer. See ElevenLabs Privacy Policy.
Google LLC (USA) — provides large language model services (Gemini) used by some of our AI voice agents to understand and respond to caller requests, and provides our business email infrastructure (Google Workspace) for hello@yam.ie. Google processes call transcripts, conversation context, and the contents of emails sent to or from our business address. Google is certified under the EU–U.S. Data Privacy Framework. See Google Privacy Policy.
Anthropic, PBC (USA) — provides large language model services (Claude) used by some of our AI voice agents (sales and support) to understand and respond to caller requests. Anthropic processes call transcripts and conversation context. Transfers governed by Standard Contractual Clauses (SCCs) approved by the European Commission. See Anthropic Privacy Policy.

Workflow and notifications

n8n (self-hosted, EU) — workflow automation platform we operate on our own infrastructure to receive call data and send notifications to our team
Telegram (Telegram FZ-LLC, UAE) — used internally by our team to receive notifications about incoming calls and messages. Telegram processes the structured summary of your call (your name, company, contact details, summary of your enquiry) for the purpose of notifying our team. See Telegram Privacy Policy.

Forms and security

Cloudflare, Inc. (USA) — Turnstile CAPTCHA on our website forms; certified under the EU–U.S. Data Privacy Framework

Communication

Meta Platforms, Inc. (WhatsApp) — when you contact us via WhatsApp; certified under the EU–U.S. Data Privacy Framework. See WhatsApp Privacy Policy.

Other circumstances

We may also share your information:

When required by law or legal process
With professional advisors (accountants, lawyers) under confidentiality obligations
To protect our rights, property, or safety, or that of our clients
With your explicit consent

All our processors are bound by data processing agreements that require them to handle your data in accordance with GDPR.

8. Communication Channels

We offer the following communication channels:

Email (hello@yam.ie) — hosted on Google Workspace; replies typically within one business day
Phone (+353 61 788 110) — answered by an AI voice assistant; see Section 18 for details
WhatsApp (+353 85 146 4070) — processed by Meta Platforms, Inc. under their Privacy Policy
Website contact form — see Section 3.1

If you prefer not to interact with our AI voice assistant, please use email, the contact form, or WhatsApp instead.

9. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the following rights:

Right to Access: Request a copy of your personal data
Right to Rectification: Request correction of inaccurate data
Right to Erasure: Request deletion of your data
Right to Restriction: Request limitation of processing
Right to Data Portability: Receive your data in a structured, machine-readable format (JSON or CSV)
Right to Object: Object to certain types of processing
Right to Withdraw Consent: Withdraw consent at any time without affecting the lawfulness of processing before withdrawal

To exercise any of these rights, please contact us at hello@yam.ie. We will respond to your request within one month of receipt, as required by GDPR Article 12(3).

10. Cookies and Local Storage

Our website uses the following cookies and browser storage:

Strictly Necessary (no consent required)

laravel_session: Session cookie required for website functionality and form security (CSRF protection). Expires when the browser is closed or after 2 hours of inactivity.
XSRF-TOKEN: Security token that protects against cross-site request forgery. Expires with the session.

Functional (consent required)

cookie_consent (localStorage): Stores your cookie preference (accepted/declined). Persists until you clear browser data. This storage is used to remember your choice and avoid showing the cookie banner repeatedly.

We do not use any analytics, advertising, or third-party tracking cookies. You can manage your cookie preferences at any time by clicking "Cookie Settings" in the website footer, or by clearing your browser data.

11. International Data Transfers

Some of our service providers are based outside the European Economic Area (EEA), specifically:

Twilio Inc. — United States; certified under the EU–U.S. Data Privacy Framework
ElevenLabs Inc. — United States; transfers governed by Standard Contractual Clauses (SCCs) approved by the European Commission
Google LLC — United States; certified under the EU–U.S. Data Privacy Framework
Anthropic, PBC — United States; transfers governed by Standard Contractual Clauses (SCCs) approved by the European Commission
Cloudflare, Inc. — United States; certified under the EU–U.S. Data Privacy Framework
Meta Platforms, Inc. (WhatsApp) — United States; certified under the EU–U.S. Data Privacy Framework
Telegram FZ-LLC — United Arab Emirates; transfers based on appropriate safeguards under GDPR Article 46

Where transfers occur outside the EEA, we ensure appropriate safeguards are in place in compliance with GDPR Chapter V (Articles 44–50), including Standard Contractual Clauses (SCCs) approved by the European Commission, adequacy decisions under Article 45, or certification under recognised frameworks.

You may request a copy of the safeguards in place for any specific transfer by contacting hello@yam.ie.

12. Automated Decision-Making

We use AI tools to assist with handling your enquiries, but we do not make automated decisions that produce legal or similarly significant effects about you, as defined under Article 22 GDPR.

Specifically:

When you call our business line, an AI assistant answers, takes details of your enquiry, and routes the call to a specialist AI agent (sales, support, or message-taking). The AI assistant may also extract structured information from the call (e.g., your name, contact details, project type, urgency) and classify the priority of the enquiry to help our human team respond efficiently.
All such classifications and summaries are advisory only. Final decisions about whether and how to engage with you (for example, whether to enter into a service agreement) are made by humans on our team, taking the AI summary as input alongside other context.
You have the right to request that any classification or summary made about you be reviewed by a human, corrected, or deleted. Contact hello@yam.ie to exercise this right.

If you prefer not to interact with our AI voice assistant, you may contact us via email (hello@yam.ie), the contact form on our website, or WhatsApp (+353 85 146 4070).

13. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Data Protection Commission within 72 hours of becoming aware of the breach, as required by Article 33 GDPR. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay (Article 34 GDPR).

14. Children's Privacy

Our website is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.

16. Contact Information

If you have any questions about this Privacy Policy or our data practices, please contact us:

Email: hello@yam.ie
Phone: +353 61 788 110
Website: https://yam.ie
Address: YAM Digital Limited, 18 Mallow Street Upper, Limerick, V94 N12Y, Ireland
Company Registration: CRO 812950

17. Complaints

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the Data Protection Commission (DPC) in Ireland:

Data Protection Commission
21 Fitzwilliam Square South
Dublin 2, D02 RD28
Ireland
Website: www.dataprotection.ie

18. AI Voice Agents

When you call our business line (+353 61 788 110), the call is answered by an AI voice assistant rather than a human. We are transparent about this and provide the following information so you can make an informed decision about whether to continue the call.

What happens when you call

Greeting and identification: An AI assistant introduces themselves and discloses that they are an AI on our team.
Routing: Based on the reason for your call, the AI may transfer you to a different specialist AI agent (e.g., for new project enquiries, existing client support, or to take a message).
Recording and transcription: The full audio of the call is recorded and a transcript is generated automatically by our AI voice platform. Our AI agents use industry-leading large language models from third-party providers based in the United States. This is necessary for the AI to function and for us to follow up on your enquiry accurately. Full details of all processors involved, including international transfers and safeguards, are listed in Sections 7 and 11.
Information extraction: The AI agent extracts key information from the call (such as your name, contact details, project description, and urgency) and generates a summary for our team.
Notification: A summary of your call, including any contact details you provided, is sent to our internal team through a secure messaging channel so the right person can follow up.

Lawful basis

We process your data during phone calls on the basis of:

Legitimate interest (Article 6(1)(f) GDPR) — to operate a business communication channel and respond to your enquiry. We have assessed that this processing is necessary, proportionate, and that your rights are protected.
Performance of a contract or pre-contractual measures (Article 6(1)(b) GDPR) — when you are an existing client or are taking steps to enter into a contract with us.

Your rights regarding phone calls

In addition to the rights listed in Section 9, you have the right to:

Be informed that the call is recorded and handled by an AI (this disclosure is provided at the start of every call)
Request a copy of any recording or transcript of your own call
Request deletion of any recording, transcript, or extracted summary
Object to the processing of your data on legitimate interest grounds (Article 21 GDPR)
Use an alternative communication channel that does not involve AI processing (email, contact form, or WhatsApp)

To exercise any of these rights regarding phone calls, contact hello@yam.ie with your phone number and the approximate date and time of the call.

Limitations

Our AI assistants speak English only
The AI does not make decisions with legal effects on you (see Section 12)
We do not use AI-extracted call data for purposes beyond responding to your enquiry, internal team notification, and complying with our legal obligations
We do not use call recordings or transcripts to train AI models — your data is processed only for the purposes described above

Data Protection Impact Assessment

We have conducted an internal review of the data protection risks associated with using AI voice agents and have implemented appropriate safeguards. A more formal Data Protection Impact Assessment (DPIA) is available on request to qualified data subjects, supervisory authorities, or our processors' compliance teams.