01 / Trust & safety
Trust needs receipts.
How Yonoo handles information, model choice, and the limits of AI.
Our operating posture
Yonoo is operated by Collegium.House GmbH. We aim to make data flows and AI limitations understandable rather than obscure them.
Your data, in context
A request travels from your device over encrypted transport to Yonoo’s routing layer and, when needed, to the selected AI provider. If you are signed in, your conversations are stored in our database against your account so your history follows you across devices. You can delete a conversation yourself; deleting your account and its whole history is done by us on request, as there is no self-service delete in the product yet. If you are not signed in, the conversation stays in your browser. Enterprise deployments have a separate audit trail with optional question/answer text and configurable automatic retention. A distinct legacy enterprise-source log always stores content when its legacy identifier is supplied and has no automatic expiry. Account data is secured in our database, and payment data is handled by Stripe.
We do not sell data or use tracking cookies for advertising. Do not submit passwords, account credentials, or information you are not permitted to share.
Providers can change
Yonoo routes requests to available third-party model providers. The full current list with entities, processing locations and transfer bases is Annex 3 of our enterprise data processing agreement.
The models are not all processed in the same place. Six of the published 14 have a confirmed US location. Two, DeepSeek V4 and GLM-4.7, are operated by providers in China, for which no adequacy decision exists. The other six are served by nscale, which publishes sites in Norway, the United Kingdom and the United States; the route used for Yonoo’s account is unconfirmed pending written attestation. Infercom supplies an additional route outside the published 14 and states that it runs in Munich. The shared interface has no customer-admin model policy. A partner API credential can be locked to the fixed nscale/Infercom roster, but that label does not prove nscale’s serving region and does not move the application layer into the EU.
nscale and Infercom are integrated and live, and neither is contracted yet. Infercom is engaged on published terms that include an Article 28 data processing agreement; nscale has no identified Article 28 agreement and may not process enterprise personal data under the reviewed DPA. That DPA stays unsigned until Article 28 terms with nscale are in place or a narrower demonstrated lock excludes nscale. Written hosting attestations are being sought from both and are not yet in place.
AI Act cross-reference
Yonoo is ordinarily the provider of an AI system that orchestrates third-party models; it does not train foundation models. A customer that uses Yonoo within its own organisation is ordinarily the deployer. The precise allocation of roles depends on the configuration and use case, and is settled for each deployment in the enterprise contract and data processing agreement. We do not market enterprise assistance or document analysis for prohibited Article 5 practices or high-risk Annex III purposes unless a deployment is specifically scoped and assessed in contract.
Users are told they are interacting with AI; output is identifiable and attributed in-product. Output is decision support, not an automated decision. Human review remains available and customers are responsible for final decisions. Models can err; evidence and traceability are provided where available for checking.
Enterprise source content remains within its agreed deployment boundary. The Act applies in stages: the prohibited-practice rules in Article 5 have applied since 2 February 2025, the obligations for providers of general-purpose AI models since 2 August 2025, and the Article 50 transparency duties for AI systems from 2 August 2026, with further high-risk provisions following from 2 August 2026 and 2 August 2027. We track these dates as they apply to each deployment. Read the fuller summaries in our Privacy Policy and Terms, or contact hello@yonoo.ai.
AI is not an authority
Models can generate plausible but incorrect information, miss context, reflect bias, or produce flawed reasoning. Verify output before acting on it. Yonoo must not be used for illegal activity, deception, malicious content, or automated high-stakes decisions without meaningful human oversight.
Reach the right team
Privacy: privacy@yonoo.ai
Security: security@yonoo.ai
Support: support@yonoo.ai