Privacy Policy

Ayako (“Ayako,” “we,” “us,” or “our”) is operated by Andrea Donatsch, a sole proprietorship (Einzelfirma) registered in Switzerland.

• Operator: Andrea Donatsch, trading as Ayako
• Address: Seftigenstrasse 47, 3007 Berne, Switzerland
• Email: hello@ayako.io
• VAT/UID: Not currently registered (Einzelfirma below the CHF 100,000 turnover threshold for mandatory commercial registry / VAT registration)

This Privacy Policy explains what personal data Ayako collects, why, how it’s used, who it’s shared with, and what rights you have over it. It applies to everyone who uses the Ayako website or product (“Service”).

1. What Ayako does, in brief

Ayako connects to a customer’s LinkedIn Ads account (via LinkedIn’s official OAuth, read-only) and syncs campaign performance data into our own database, then presents analytics, health checks, AI-generated recommendations, and a conversational assistant on top of that data. Ayako never modifies, pauses, or changes anything in a customer’s LinkedIn account — see our Terms of Service for the full scope of the Service.

2. What personal data we collect

2.1 Account data. When you sign up, we collect your email address and a password (stored as a salted hash via our authentication provider, Supabase — we never see or store your password in plain text). If you invite a teammate, we collect their email address to send the invitation.

2.2 LinkedIn Ads data. Once you connect your LinkedIn Ads account, we receive and store:

• Your LinkedIn ad account ID and name, and an access token (encrypted at rest) that lets us read (never write) your campaign data.
• Campaign and ad performance metrics: impressions, clicks, spend, leads, conversions, click-through rate, and similar aggregate performance numbers, at the campaign and ad-creative level.
• Aggregated audience demographic data: which companies, job functions, seniority levels, and job titles your ads reached, as aggregate counts (e.g. “1,200 impressions to people in Marketing seniority: Manager”) — this is not individually identifiable data about specific LinkedIn members, and LinkedIn does not provide Ayako with the identity of specific individuals who saw or clicked an ad.

We do not receive or store any LinkedIn data beyond what’s needed to power the product features described in this Service — no personal messages, connections, personal profile browsing activity, or anything outside your own ad account’s performance data.

2.3 Content you provide. If you use Ayako’s AI assistant (chatbot) or define an Ideal Customer Profile, the questions and inputs you type are processed to generate a response, as described in Section 4.

2.4 Billing data. Subscription payments are handled entirely by Paddle.com Market Ltd, our payment provider and merchant of record. Ayako does not receive or store your full card number or other raw payment details — Paddle handles that directly, and acts as the seller of record for tax purposes. We do receive limited billing status data from Paddle (e.g. subscription status, plan, renewal date) to manage your account access.

2.5 Technical & usage data. Standard web server logs (IP address, browser type, timestamps) are generated by our hosting provider (Vercel) as part of normal operation, and a session cookie is used to keep you logged in. See Section 8 (Cookies).

We also collect basic product usage data — which pages you visit and a small number of specific actions (e.g. signing up, sending a chatbot message) — to understand how the Service is actually used and where people get stuck, via our product analytics provider, PostHog. This does not use a cookie (see Section 8) and does not include session recordings, click heatmaps, or any content of what you type.

3. Why we process your data (purpose & legal basis)

We do not sell your personal data, and we do not use it for third-party advertising.

4. Sub-processors — who else handles your data

Ayako uses the following third-party services to operate. Each only receives the data it needs to perform its function:

Other than the consent-gated LinkedIn Insight Tag described in Section 8, we do not use any advertising trackers, and we do not share your data with data brokers.

Data Processing Agreement for business customers: where Ayako processes personal data on behalf of a business customer, Article 28 GDPR (and the Swiss FADP) require a processor contract. EU and Swiss business customers can request our Data Processing Agreement by emailing hello@ayako.io.

5. International data transfers

Some of our sub-processors (including Vercel and Anthropic) process data on servers located in the United States. Where this occurs, we rely on the following transfer mechanisms:

• EU-US and Swiss-US Data Privacy Framework (DPF): Vercel and Anthropic are both certified under the EU-US Data Privacy Framework and its Swiss extension. Switzerland recognized the adequacy of DPF-certified US recipients with effect from 15 September 2024.
• Standard Contractual Clauses (SCCs) as fallback: where the DPF does not apply (or should its adequacy status change), we rely on the EU Standard Contractual Clauses, supplemented by the Swiss addendum recognized by the FDPIC, as incorporated in each sub-processor’s data processing agreement.

Data processing agreements are in place with these sub-processors: Anthropic’s DPA (including SCCs and a Swiss addendum) is incorporated into its Commercial Terms of Service for API customers, and Vercel’s DPA is part of its customer terms.

6. How long we keep your data

• While your subscription is active (including during a free trial): your data is retained to provide the Service.
• After cancellation or an expired trial: your account is frozen (access paused, data untouched) for a grace period of 60 days, after which your data is permanently deleted, unless you resubscribe first.
• Daily-granularity campaign metrics are automatically pruned after roughly 90 days as part of normal operation (aggregated weekly/monthly summaries and the underlying campaign records are retained separately, subject to the above).
• You can request deletion of your data at any time before the automatic deletion above — see Section 7.

7. Your rights

Depending on where you’re located, you have some or all of the following rights over your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — ask us to delete your data (subject to any legal retention obligations, e.g. billing records).
• Restriction / objection — ask us to limit or stop certain processing.
• Portability — request your data in a portable format.
• Withdraw consent — where processing is based on consent, withdraw it at any time.
• Complain — lodge a complaint with a supervisory authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); if you’re in the EU, your local data protection authority.

To exercise any of these rights, email hello@ayako.io.

8. Cookies

Ayako uses two kinds of cookies:

Strictly necessary — always on, no consent needed:

• A session/authentication cookie, so you stay logged in.
• An internal demo mode cookie, used only by Ayako’s own team for product demonstrations — this never affects real customer accounts.

Advertising — only on our marketing pages (ayako.io), only with your consent:

• The LinkedIn Insight Tag, used to measure and improve Ayako’s own LinkedIn ad campaigns (conversion tracking and retargeting). It’s provided by LinkedIn and sets a cookie, governed by LinkedIn’s own privacy policy. When you first visit ayako.io, a banner asks you to Accept or Reject this cookie — it only loads if you Accept, and if you Reject or don’t respond, it never loads. You can change your choice anytime via the “Cookie preferences” link in the site footer.

Product analytics (PostHog), no cookie used: our product usage analytics (Section 2.5) is configured not to set a cookie or store anything in your browser — it’s tied to your logged-in account instead. If we ever change this configuration to use a cookie, we’ll update this section and, if required, add a cookie consent banner first.

9. Security

Access tokens for your LinkedIn Ads account are encrypted at rest. Access to customer data within Ayako is limited to what’s needed to operate and support the Service. No method of transmission or storage is 100% secure, but we take reasonable technical and organizational measures appropriate to a product of this size to protect your data.

10. EU representative (GDPR Article 27)

Ayako has not appointed an EU representative under Article 27 GDPR at this time. If you are in the EU/EEA, you can direct any privacy inquiry or rights request directly to us at hello@ayako.io (see Section 7), and you retain the right to lodge a complaint with your local data protection authority.

11. Children’s privacy

Ayako is a B2B product intended for business use and is not directed at, or knowingly used by, anyone under 18.

12. Changes to this policy

We may update this policy as the Service evolves. Material changes will be communicated by email or an in-product notice. Continued use of the Service after a change takes effect means you accept the updated policy.

13. Contact

Questions about this policy or your data: hello@ayako.io.