Privacy policy

Who handles your personal data when you use Yesian, why, for how long, and what you can ask of us.

Last changed: 29 October 2026

Who we are

Yesian is a craft business (obrt) registered in Croatia: Yesian, obrt za računalne usluge, vl. Jakob Crnogaj, Samoborska 3, 32000 Vukovar, Croatia (Obrtni registar, MBO 98135821). For anything about your data, write to info@yesian.dev.

This policy covers this website (yesian.dev), the Yesian studio (studio.yesian.dev), where our clients have their apps made and changed, and the previews of those apps. For the apps we build and run for our clients, see "Apps we run for our clients" below.

What we keep, and why

When you visit this website

• Technical data (your IP address, your browser): to deliver the pages and to keep the site safe from abuse. It is not used to follow you across sites or to build a profile of you.
• What you send us through the contact form (your name, e-mail address and message): to answer you.
• Cookies: only those the site needs to work (your language, keeping a form safe from forgery). We use no advertising or tracking cookies and no third-party analytics.

When you use the studio

• Your account: your name, e-mail address, a password (stored only as a one-way hash), your settings, and when you signed in. If you sign in with Google, we receive your name, e-mail address and Google's identifier for you; nothing else from your Google account.
• Your projects: what you tell the AI developer, the files you attach, the code and texts of your apps, your tasks and comments, and their history.
• A record of actions (who did what and when, with the IP address): to keep accounts secure and to find out what happened when something goes wrong.

We use this data to provide the service you asked for (Art. 6(1)(b) GDPR), to keep it secure and working (our legitimate interest, Art. 6(1)(f)), and to keep the business records the law requires (Art. 6(1)(c)). We do not sell your data, and we make no decisions about you by automated means that have legal or similarly significant effects.

Who else handles it for us

We use a few providers who process data only on our instructions, under data processing agreements:

• Hetzner Online GmbH (Germany): the servers the studio and the apps run on, and the backups. Your data is stored in the European Union.
• Anthropic (USA): the AI model (Claude) that the studio's AI developer uses. What you write to the AI developer and the code of your project are sent to it to do the work you asked for. Anthropic's commercial terms forbid it to train its models on this, and the transfer to the USA is covered by the EU Standard Contractual Clauses in Anthropic's data processing addendum. If your account uses its own Anthropic key, your own agreement with Anthropic applies.
• Brevo (France): sending e-mails (sign-in links, notifications).
• Google: only if you choose to sign in with Google, under Google's own privacy policy.

How long we keep it

• Your account and projects: as long as you use the studio. When you close your account, we delete them, except what the law requires us to keep.
• The record of actions: one year.
• Contact form messages: until we have answered and no longer need them, at most two years.
• Backups: up to twelve months, after which they are overwritten.
• Invoices and business records: as long as Croatian law requires (eleven years).

Apps we run for our clients

When we build and run an app for a client, the client decides what personal data the app holds about its users; the client is the controller and we process that data on the client's behalf. If you use such an app, the client's own privacy policy applies, and your requests about that data go to the client (we help them answer).

Your rights

You may ask us for a copy of your data, to correct it, to delete it, to limit how we use it, to receive it in a form you can take elsewhere, and you may object to how we use it. Where we rely on your consent, you may withdraw it at any time. Write to info@yesian.dev; we answer within a month.

If you think we handle your data wrongly, you may complain to the Croatian data protection authority: Agencija za zaštitu osobnih podataka (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr.

Changes

When this policy changes, we change the date at the top; for important changes we also tell studio users by e-mail.