Privacy Policy
Last updated: July 17, 2026
Yerly (“Yerly”, “we”, “us”, “our”) is a software-as-a-service product, operated by the Yerly team, that helps local businesses manage their Google Business Profile with the help of AI. This Privacy Policy explains what personal data we collect, why we collect it, the legal bases we rely on, who we share it with, and the rights you have. It applies to the Yerly website at yerlyai.com and to the Yerly application.
For any privacy question or to exercise your rights, contact us at support@yerlyai.com.
1. Who is responsible for your data
For the purposes of the EU/UK General Data Protection Regulation (“GDPR”) and the Turkish Personal Data Protection Law No. 6698 (“KVKK”), the data controller for the personal data described here is Yerly. You can reach us at any time at support@yerlyai.com.
2. Data we collect
- Account data: your name, email address, and authentication credentials (managed and secured by our authentication provider, Clerk)
- Business data: information about the business locations you connect, including business name, address, phone number, opening hours, photos, attributes, and Google Place ID
- Google Business Profile data: reviews, posts, questions and answers, and profile content accessed on your behalf so we can display, analyze, and help you manage your profile
- Performance and analytics data: impressions, interactions, search queries, and ranking/visibility data relating to your business
- Usage data: sign-in timestamps, IP address, browser type, device information, and log/diagnostic data
- Payment data: handled by LemonSqueezy, our merchant of record. We do not receive or store your full card details
- Communications: messages you send us, including support and feedback emails
3. How we use your data and our legal bases (GDPR)
We process personal data for the following purposes and on the following lawful bases:
- To provide the service (operate your account, connect locations, display and manage your Google Business Profile, generate AI-assisted replies and content, produce analytics) — performance of a contract (Art. 6(1)(b) GDPR)
- To keep the service secure and reliable (rate limiting, fraud and abuse prevention, error monitoring, diagnostics) — our legitimate interests in operating a safe, functioning service (Art. 6(1)(f) GDPR)
- To improve the service (understand how features are used, fix problems, develop new functionality) — our legitimate interests (Art. 6(1)(f) GDPR)
- To communicate with you (service notifications, support responses, and important account messages) — performance of a contract and our legitimate interests
- To comply with the law (tax, accounting, and legal obligations) — compliance with a legal obligation (Art. 6(1)(c) GDPR)
- Optional analytics or marketing cookies/messages — your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time
4. Google user data and Limited Use
When you connect a Google Business Profile, Yerly accesses certain Google user data (such as your business profile information, reviews, posts, and performance data) solely to provide and improve the features you see in the Yerly application.
Yerly’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we:
- only use Google user data to provide or improve user-facing features that are prominent in the Yerly application;
- do not use Google user data for advertising purposes;
- do not sell Google user data;
- do not transfer Google user data to third parties except as necessary to provide or improve the service, to comply with applicable law, as part of a merger or acquisition with appropriate notice, or for security purposes (for example, investigating abuse); and
- do not allow humans to read Google user data unless we have your affirmative agreement for specific messages, it is necessary for security or to comply with the law, or the data has been aggregated and anonymized.
We process Google user data with the help of the subprocessors listed below, who are bound to use it only to deliver their service to us.
5. Subprocessors
We rely on the following trusted third parties (subprocessors) to operate Yerly. Each is bound by a data processing agreement and may only process personal data on our instructions. Some of these providers are located outside your country (including in the United States), so your data may be processed abroad under appropriate safeguards such as Standard Contractual Clauses (see section 6).
- Clerk — authentication and account management
- Neon (PostgreSQL) — primary database
- Vercel — application hosting and content delivery
- Upstash Redis — rate limiting and caching
- Sentry — error and performance monitoring
- OpenAI — AI-assisted content generation
- DataForSEO — search and SERP data
- Zernio — authorized Google Business Profile connectivity: manages the secure connection to your profile and publishes the content you approve
- Google — Google Business Profile data
- LemonSqueezy — payments and merchant of record
- Resend — transactional email delivery
6. International data transfers
Yerly is operated from Turkey and uses subprocessors located in various countries, including the United States and the European Union. Where personal data is transferred outside your country or outside the EEA/UK/Turkey, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, the equivalent UK and Turkish (KVKK) standard contracts, or transfers to countries recognized as providing an adequate level of protection. You may request more detail about these safeguards at support@yerlyai.com.
7. Data retention
We retain your personal data for as long as your account is active. When you delete your account, we permanently delete or anonymize your data within 30 days, except where we are required to retain certain records (for example, invoices and tax records) for longer under applicable law.
8. Security
We protect your data with industry-standard measures, including encryption in transit (TLS) and at rest, access controls, and monitoring. No method of transmission or storage is completely secure, but we work continuously to safeguard your data and to notify you and the relevant authorities if a breach affecting your personal data occurs, as required by law.
9. Your rights
If you are in the EEA, UK, Turkey, or another region with similar laws, you have the right to:
- access the personal data we hold about you and obtain a copy;
- have inaccurate or incomplete data corrected (rectification);
- request deletion of your data (erasure);
- receive your data in a portable, machine-readable format (data portability);
- object to or restrict certain processing;
- withdraw consent at any time, where processing is based on consent (without affecting prior processing).
To exercise any of these rights, email support@yerlyai.com. We will respond within the timeframe required by applicable law. You also have the right to lodge a complaint with your local data protection or supervisory authority. If you are a resident of Turkey, you have specific rights under Article 11 of the KVKK — see our KVKK notice for details.
10. Cookies
Yerly uses strictly necessary cookies for sign-in, session management, and core functionality. We only set optional analytics cookies with your consent, and you can withdraw that consent at any time.
11. Children
Yerly is a business tool intended for users aged 18 and over. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, contact us and we will delete it.
12. Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the application. The “Last updated” date above reflects the latest version.
13. Contact
Data controller: Yerly. For any privacy question or request: support@yerlyai.com.