Version 1.1 — last updated: 2026-10-09. In case of discrepancy between language versions, the French version prevails.
1. Data controller
The controller of the personal data collected through the Ya.puka Hub platform and the products attached to it is:
[TO FILL IN: name or company name], [TO FILL IN: legal form], [TO FILL IN: full address], Québec, Canada Email: [TO FILL IN: privacy email]
No Data Protection Officer (DPO) is currently appointed. Any request must be sent to the address above.
2. Applicable regulatory framework
The processing of personal data is governed by:
- in Québec, the Act respecting the protection of personal information in the private sector (“Law 25”)
- in the European Union, the EEA and the United Kingdom, the General Data Protection Regulation (GDPR) and national implementing laws
- in Switzerland, the Federal Act on Data Protection (nFADP)
- in Canada outside Québec, PIPEDA
Ya.puka applies a single baseline aligned with these requirements.
3. Data collected
3.1 Identity and account data
- Last name, first name (optional at sign-up, required for billing)
- Email address (required)
- Password (stored as an irreversible hash, never in clear text)
- Preferred language
- Profile picture (optional)
3.2 Billing data
- Billing address
- Transaction and invoice history
- Type of payment method (card data is never stored by Ya.puka — it is handled exclusively by the payment provider, see §5)
3.3 Connection and usage data
- IP address, timestamp, device type, browser, operating system
- Technical and security logs
- Pages viewed, actions performed in the Hub
- Technical data sent to the Google reCAPTCHA anti-robot service when an account is created (see §5.1)
3.4 Product-specific data
Each product collects data of its own. It is detailed in the privacy annex of the product concerned (see §12).
4. Purposes and legal bases
| Purpose | Legal basis (GDPR / Law 25) |
|---|---|
| Provide the subscribed service (account, SSO, access to products) | Performance of the contract |
| Invoice and collect payments | Performance of the contract + legal obligation (accounting, tax) |
| Ensure security (logs, fraud detection) | Legitimate interest |
| Protect account creation against automated submissions (reCAPTCHA) | Legitimate interest |
| Respond to requests to exercise rights | Legal obligation |
| Improve the services (aggregated, anonymised statistics) | Legitimate interest |
| Send marketing communications | Consent (opt-in, withdrawable at any time) |
5. Processors and recipients
Data may be shared with the following processors, each bound by a processing agreement compliant with Art. 28 GDPR and Law 25:
| Processor | Role | Location |
|---|---|---|
| Hostinger International Ltd | Hosting of the websites and application data | Servers in the United States (Boston) — company based in Cyprus |
| [TO FILL IN: payment provider] | Payment processing | [United States / EU depending on provider] |
| [TO FILL IN: email provider] | Sending of transactional emails and reminders | [EU / United States] |
| [SUPPORT — e.g. Crisp, Freshdesk] | Customer support, chat | [Location] |
| [ANALYTICS — e.g. Plausible / Matomo] | Anonymised traffic statistics | [EU, if applicable] |
| Google LLC (reCAPTCHA) | Protection of the sign-up form against robots | United States |
The up-to-date list of processors is available at any time on request at [TO FILL IN: privacy email].
Processors specific to product data (for example: the AI provider for Ya.puka Trader) are listed in the annex of the product concerned.
5.1 Protection against robots (Google reCAPTCHA)
To protect account creation against automated submissions, the sign-up form uses Google’s reCAPTCHA service. When you create an account, your browser sends Google certain technical information (including your IP address, information about your browser and device, and how you interact with the page) so that Google can determine whether the request comes from a person. Google processes this information under its privacy policy and terms of service. Ya.puka only receives the result of the check (passed or not) and does not keep this technical information. This check is necessary to keep the service secure (legitimate interest).
6. International data transfers
6.1 Ya.puka is established in Québec
Ya.puka operates from Québec. Personal data may be accessed there by Ya.puka for support and maintenance.
6.2 Servers in the United States
Data hosting is provided by Hostinger on servers located in Boston (United States). For Users residing in the EU / EEA, this constitutes a transfer of data outside the European Economic Area.
This transfer is governed by: – the standard contractual clauses (SCCs) adopted by the European Commission, incorporated into the contract with Hostinger – additional technical and organisational measures (encryption at rest and in transit, access control)
6.3 Other transfers
Some processors (payment, email, support) may be established outside the EU. Each of them applies equivalent safeguards (SCCs, adequacy decision or equivalent mechanism).
7. Retention periods
| Data category | Period |
|---|---|
| Active user account | For the whole life of the account |
| Closed user account | Deletion within 30 days, unless the law requires otherwise |
| Connection and security logs | 12 months |
| Invoices and accounting records | Minimum legal retention period (6 years in Québec / 10 years in the EU) |
| Proof of consent (accepted terms, cookies, marketing) | Account lifetime + 5 years |
| Contact data outside an account (form, support) | 3 years from the last contact |
| Marketing communications (subscribers) | Until consent is withdrawn |
8. Security
Ya.puka implements reasonable technical and organisational measures:
- End-to-end HTTPS/TLS encryption for all exchanges
- Encryption at rest of sensitive data (broker API identifiers, access tokens for AI providers — see Trader annex)
- Passwords stored as hashes (suitable algorithm, salting)
- Strict access control, limited to authorised staff
- Logging of administrator access
- Regular backups
- Software component update policy
Ya.puka cannot, however, guarantee absolute security. In the event of a breach likely to result in a risk to the rights and freedoms of individuals, Ya.puka notifies the competent authority and, where necessary, the persons concerned within the time limits set by the applicable law.
9. Your rights
Subject to the applicable framework (GDPR, Law 25, PIPEDA…), the User has the following rights, among others:
- Access — obtain confirmation that their data is being processed and obtain a copy
- Rectification — correct inaccurate or incomplete data
- Erasure — request deletion (within the limits of legal retention obligations)
- Objection — object to processing based on legitimate interest or to marketing communications
- Restriction — request restriction of processing under certain conditions
- Portability — receive their data in a structured, commonly used format
- Withdrawal of consent — for processing based on consent, at any time
- Post-mortem directives — what happens to the data after death (Law 25, GDPR)
- Automated decisions — not be subject to a decision based solely on automated processing that produces legal effects
Exercising a right
Send a request to [TO FILL IN: privacy email] with proof of identity. Reply within 30 days (extendable if the request is complex).
Remedies
In case of disagreement, the User may: – in Québec: refer the matter to the Commission d’accès à l’information (CAI) – in the European Union: refer the matter to the supervisory authority of their country (in France: the CNIL) – in the United Kingdom: refer the matter to the ICO – in Switzerland: refer the matter to the FDPIC
10. Cookies and trackers
The use of cookies is detailed in the Cookies section below.
11. Changes
Ya.puka may amend this policy. Substantial changes are notified by email at least 30 days before they take effect.
12. Product annexes
Data specific to each product and product-specific processors are detailed in:
Cookies
1. What is a cookie?
A cookie is a small text file placed on your device (computer, smartphone, tablet) when you visit a website or use an application. It allows a site to recognise your device and remember certain information, for example to:
- keep you signed in
- remember your language or preferences
- keep your session secure
- measure site traffic
This policy covers cookies and similar technologies (local storage, sessionStorage, invisible indicators, etc.) used by Ya.puka sites and services (“Cookies”).
2. Cookies used
2.1 Strictly necessary cookies (always active)
These cookies are essential for the service to work. Without them, you could neither sign in, nor keep your session, nor use the Hub. They do not require consent.
| Name / Type | Purpose | Duration |
|---|---|---|
| Session cookie | Keep your connection active during a session | Session (deleted when the browser is closed) |
| Authentication cookie (JWT or equivalent) | Keep you signed in between visits | [e.g. 30 days] |
| CSRF cookie | Protection against cross-site request forgery attacks | Session |
| Language preference cookie | Remember the chosen language | [e.g. 1 year] |
| Consent cookie | Remember your choices about non-essential cookies | 6 months |
2.2 Audience measurement cookies (subject to consent if used)
Ya.puka [uses / does not yet use] audience measurement tools. If such a tool is used, a privacy-friendly tool is preferred (such as [Plausible / Matomo in anonymised configuration]) that does not set any non-essential cookie and does not send any personal data to third parties.
If a tool requiring consent is deployed in the future, this policy will be updated and a consent banner will be shown on entering the site.
2.3 Advertising or third-party tracking cookies
Ya.puka does not use advertising cookies or third-party trackers for profiling or retargeting purposes.
3. Managing cookies
3.1 From Ya.puka
You can change your preferences at any time by clicking the “Manage my cookies” link at the bottom of the site.
3.2 From your browser
You can configure your browser to: – accept or refuse all cookies – accept only cookies from the site you are visiting – be warned before a cookie is set – delete cookies already set
Please note: refusing strictly necessary cookies may prevent the service from working properly (in particular, you may be unable to sign in).
Links to the cookie settings of the main browsers: – Chrome — https://support.google.com/chrome/answer/95647 – Firefox — https://support.mozilla.org/kb/enhanced-tracking-protection-firefox-desktop – Safari — https://support.apple.com/guide/safari/manage-cookies-sfri11471 – Edge — https://support.microsoft.com/microsoft-edge
4. Legal basis
- Strictly necessary cookies: performance of the contract / legitimate interest
- Other cookies (non-anonymised audience measurement, marketing, etc.): free, informed, specific and unambiguous consent, withdrawable at any time
5. Changes
This policy may be amended at any time to reflect technical or regulatory developments. In the event of a substantial change, you may be asked for new consent.
6. Contact
For any question: [TO FILL IN: privacy email].