Last updated: January 30, 2025
This Privacy Policy explains how Wild Walnut Technology Inc. ("Wild Walnut," "we," "our," or "us") collects, uses, discloses, and safeguards your information when you visit our website or use any related products or services (collectively, the "Service"). It applies to users in the United States and Canada and is drafted to align with the California Consumer Privacy Rights Act ("CPRA"), Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA"), and Québec's Law 25. By accessing the Service, you agree to the practices described below.
| Category | Examples | Source |
|---|---|---|
| Account Identifiers | Name, email address, hashed password | Provided by you |
| Transactional Data | Payment ID, last four digits of card, billing ZIP/postal code | Provided by you / Stripe |
| Uploaded Content | Books, documents, file metadata (title, page count, language) | Provided by you |
| Usage Data | IP address, device type, browser fingerprint, pages viewed, time on page | Collected automatically |
| Cookies & Similar Tech | Session token, analytics cookie, preference cookie | Collected automatically |
| In-Service Communications | Support requests, feedback, error logs | Provided by you / Collected automatically |
⚠️ We do not knowingly collect information from children under 13. Parents or guardians who believe a child has provided personal data should contact us (see §11).
| Purpose | Legal Basis* |
|---|---|
| Create and manage accounts, authenticate log-ins, process payments | Contract performance |
| Generate page-level summaries and deliver them to you | Contract performance |
| Provide customer support, respond to inquiries | Legitimate interest |
| Improve, debug, and secure the Service (including AI model tuning) | Legitimate interest |
| Send transactional notices (receipts, policy updates) | Legal obligation / Contract |
| Optional marketing or feature updates (with opt-out) | Consent |
| Detect and prevent fraud or abuse | Legitimate interest / Legal obligation |
*"Legal basis" language addresses CPRA, PIPEDA, and—where applicable—GDPR visitors.
We use:
🍪 You may disable non-essential cookies via our banner or your browser settings. The Service honors Global Privacy Control (GPC) signals where technically feasible.
We disclose personal information only:
| Recipient / Service | Reason |
|---|---|
| Stripe (payments) | Process credit-card transactions |
| AWS S3 & Cloudflare CDN | Store and deliver uploaded files and AI outputs |
| OpenAI or other AI processors | Generate summaries/explanations |
| Google Analytics | Site usage measurement |
| Service Providers | Email delivery, error monitoring, penetration testing |
| Legal or Safety Authorities | When required to comply with law or protect rights |
| Corporate Transactions | In connection with a merger, acquisition, or asset sale (with notice to you) |
All vendors are contractually bound to use data only for the enlisted purpose and to apply industry-standard security.
🌍 Our servers are located in the United States. When Canadian users' information is transferred outside Canada, it is protected by contractual clauses and technical safeguards offering a level of protection comparable to PIPEDA and Law 25 requirements.
| Data Type | Retention Period |
|---|---|
| Account data | While account remains open + 90 days |
| Uploaded files | 30 days after processing (unless you delete sooner) |
| Payment records | 7 years (tax & accounting compliance) |
| Logs & analytics | 12 months, then aggregated or deleted |
We may retain data longer if required to establish or defend legal claims.
🔒 We implement comprehensive security measures:
You may request to access, delete, correct, or restrict your personal information and opt out of "sale/share" (we do not sell personal data, but CPRA opt-out link is provided). We respond within 45 days.
You may request access or rectification of your data and withdraw consent at any time. Québec residents may also request information on automated decision-making logic.
Identity verification is required. Requests are free up to two per 12-month period; additional requests may incur a reasonable fee.
🤖 Page summaries are generated by large-language-model algorithms. Outputs may occasionally be inaccurate or incomplete.
You can request human review by emailing support, and you should not rely solely on outputs for critical decisions.
We may revise this Policy from time to time. Material changes will be announced via email or Service banner 30 days before they take effect, with the "Last updated" date at the top revised accordingly.
Attn: Privacy Officer
1942 Broadway St Ste 314C
Boulder, CO 80302, USA
Email:
For Québec users, our designated "Person in Charge of the Protection of Personal Information" is reachable at the same address and email.
Une version française de cette politique sera disponible sous peu. Pour toute question, veuillez communiquer avec nous à privacy@yehetao.com.
This Privacy Policy is provided for general informational purposes and does not constitute legal advice. You should consult counsel to ensure full compliance with applicable laws.