Privacy

The data controller is Yellow Bear. For any question about this policy or to exercise your rights, write to the address below.

Yellow Bear has no data protection officer: neither its size nor its processing requires one to be designated. The address below reaches the person who decides, who is the founder.

Valha holds four kinds of data, and no more than it needs to run the service:

Valha never receives your whole AI conversation. The session stays in the assistant; authenticated MCP tools receive only the requests, arguments, and private content you authorize Valha to read or change.

There is no advertising and no analytics profiling on this site today. The product sets only session and language-preference cookies. The public landing loads Cal's booking widget. Pages containing a Map may load Mapbox's map runtime when it is enabled; those requests are described below. Booking a call sends the details you type to Cal.

Account and content data are processed to perform the contract you enter when you create an account: without them there is no service to provide.

Technical logs are processed on our legitimate interest in keeping the service secure and working. Transactional email, such as verification and password reset, is likewise necessary to operate the account.

Where we ever rely on consent, we will ask for it separately and you will be able to withdraw it.

Valha uses a small number of providers and third-party services, each with access limited to what its job requires:

Read Mapbox's Product Privacy Policy, DPA, and subprocessor list.

Convex stores accounts, pages, and workspace data in the European Union, in Ireland. Vercel serves the application from the United States. Loops and Cal are United States providers. When enabled, Mapbox may process map requests in the United States and other regions through its infrastructure and listed sub-processors. Where data reaches a country outside the European Economic Area, the transfer relies on the European Commission's standard contractual clauses or an equivalent approved mechanism.

Account and content data are kept while your account is open. When you delete your account, they are removed from the live service, and backups age out on their normal cycle.

Deleting means deleting, not anonymizing. We do not keep a stripped copy of your pages to train anything or to pad our numbers. What can survive a deletion is an aggregate counter that never held your content or your identity in the first place, such as how many pages an organization created in a month.

Valha technical logs are kept for 30 days and then discarded. Providers keep their own technical records under their own policies; Mapbox normally retains IP addresses for 30 days, with purpose-based exceptions. Read Mapbox's Product Privacy Policy and subprocessor information above for provider-specific details.

Under the GDPR you can ask for access to your data, correction of it, deletion of it, a portable copy of it, restriction of its processing, and you can object to processing based on legitimate interest.

Write to contact@valha.link and we will answer within 48 hours, and in any case within the one month the GDPR allows. If our answer does not satisfy you, you can complain to the CNIL, the French data protection authority, or to the authority in your own country.

French law also lets you define directives, general or specific, on what happens to your data after your death. Write your directives to us and we follow them.

Valha takes no decision about you by automated means, and does not profile you. The service processes what you publish in order to index it and retrieve it. It does not score you, rank you, or decide anything that produces a legal effect for you.

Valha sets the cookies your session needs to keep you signed in, and one that remembers the language you chose. Neither is used to track you, and both are exempt from consent: the first because the service cannot work without it, the second because you set it yourself by answering a question. No advertising or audience-measurement cookie is set.

Traffic is served over HTTPS. Passwords are stored hashed, never in readable form. Assistant access runs through OAuth and follows live workspace membership, and disconnecting an assistant revokes it.

Published pages are validated before rendering, and any interactive section runs in a network-isolated sandbox that cannot reach your network, your cookies, or the rest of your workspace.

When the product changes what it collects or who processes it, this page changes in the same release. The date at the top is the current version, and account holders are told by email about material changes.