Privacy Notice

Information we collect

We collect the following categories of information:

• Account information — your name, email address, organization, and role, provided when an administrator invites you or when you set or reset a password.
• Content you submit — projects, contacts, schedules, checklists, notes, messages, and documents that you or your organization create or upload to your workspace.
• Connected-integration data — when you connect Microsoft 365 / SharePoint, the files and metadata you authorize us to access.
• Usage and log data — IP address, browser and device type, features and pages used, and timestamps, collected automatically for security, debugging, and reliability.
• Cookies and local storage — strictly necessary cookies and browser storage to keep you signed in and remember preferences such as your theme. We do not use advertising or cross-site tracking cookies.

How we use information

• To provide, operate, secure, and maintain the Service, including authenticating you and isolating your data by organization.
• To run the AI analysis and data lookups you request across the deal lifecycle.
• To communicate with you about the Service, including support, security, and administrative messages.
• To monitor, troubleshoot, and improve performance and reliability.
• To comply with applicable law and enforce our terms.

We do not sell your personal information.

AI processing and third-party data sources

To deliver AI features, your prompts and the workspace content relevant to your request are transmitted to third-party AI providers (which may include Anthropic, OpenAI, Google, and xAI) solely to generate the responses you request.

To enrich analysis, the Service retrieves information from third-party data sources, including the U.S. Census Bureau, the Federal Reserve (FRED), HUD, FEMA, the Bureau of Labor Statistics, Zillow, Regrid, RentCast, Google Maps, Brave Search, and Perplexity.

Service providers

We rely on vendors to operate the Service, including Supabase (database hosting), Railway (application hosting), Resend (transactional email), and Microsoft (optional SharePoint integration). These providers process information on our behalf and are permitted to use it only to provide services to us.

How we disclose information

• Within your organization, according to the access and approval controls your administrators configure.
• To the AI providers and service providers described above.
• For legal and safety reasons — to comply with applicable law, legal process, or governmental request, and to enforce our terms or protect the rights, property, or safety of YIMBY, our users, or others.
• In a business transaction — in connection with a merger, acquisition, financing, or sale of assets, subject to this Notice.

Data retention and security

We retain information for as long as your account or organization remains active and as needed for the purposes described above, after which we delete or de-identify it within a commercially reasonable period, unless a longer period is required by law.

We use technical and organizational safeguards, including server-side tenant isolation between organizations and role-based access controls. No method of transmission or storage is completely secure, we cannot guarantee absolute security, and you use the Service at your own risk. Except as required by law, YIMBY is not responsible for unauthorized access to or use of your information that occurs despite reasonable safeguards.

Your choices and rights

You can view and update much of your information directly in the Service. Depending on your location, you may have the right to access, correct, export, or delete your personal information, or to object to or restrict certain processing. Many requests are administered through your organization’s administrator and may be subject to verification and legal limits.

To exercise a right, contact your organization’s administrator or YIMBY at info@yimbysystems.com.

International data transfers

YIMBY operates in the United States, and the information we collect is processed and stored in the United States. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States.

Your responsibilities and our Terms

You are responsible for the Customer Content you submit, including ensuring that you have the rights and any required consents to provide it and that doing so complies with applicable law. Do not upload information you are not authorized to share.

Your use of the Service is also governed by our Terms of Use, including its disclaimers of warranties and limitations of liability, which apply to the practices described in this Notice.

Changes to this Notice

We may update this Privacy Notice from time to time. Material changes will be reflected by the “Effective” date above and, where appropriate, communicated through the Service.

Contact

Questions about this Notice or our privacy practices? Contact us at info@yimbysystems.com.