How your data is processed — Yasan AI assistant (chat, search and e-mail)
This notice is published by Let’s Whisper s.r.o. (brand Yasan), the technical provider of the AI assistant, on behalf of the shop operators that use it. It is written generically: it applies to every shop on which you interacted with the Yasan assistant. The shop’s own privacy policy applies in addition and prevails in case of conflict.
Who is responsible for your data
The controller of your personal data is the operator of the shop (website) on which you used the chat, the search or the e-mail communication. You will find its identity and contact details in its terms or privacy policy.
The chat, search and e-mail processing are provided to the operator by Let’s Whisper s.r.o., Křižíkova 148/34, Karlín, 186 00 Prague 8, Czech Republic, company number 23849959 (“Yasan”, “we”), acting as processor under Article 28 GDPR (and UK GDPR, where applicable) and processing your data only on the operator’s instructions. Contact: [email protected].
You are interacting with artificial intelligence
Answers in the chat, in the search and automated e-mail replies are generated by artificial intelligence. This is disclosed directly in the assistant window. The assistant may have a name and personality configured by the shop — it is still an AI and will confirm this if you ask. Answers may be inaccurate or incomplete; for anything binding (price, availability, delivery, returns, your rights) please rely on confirmation from the shop. The assistant does not make decisions producing legal or similarly significant effects on you within the meaning of Article 22 GDPR; its output consists of recommendations and suggestions.
What is processed when you use the chat
- Your conversation: the messages you type, the AI responses, the language and address of the page where you opened the chat, a technical session identifier and any feedback you give (thumbs up/down).
- Your e-mail address — only if you provide it yourself (e.g. to be contacted, or to verify your identity for an order enquiry). One-time verification codes are stored only in hashed (unreadable) form.
- Your order data — after you verify your e-mail address, the assistant may look up your orders in the shop’s systems to answer your question.
- Your shopping basket — the current contents may be used as context for a better answer; they are not stored with the conversation.
What is processed when you search
While you type, the suggestions only read the product catalogue and nothing is stored. Once you pause for a moment, the text of your query together with the names, brands and categories of the candidate products may be sent to an AI model that assesses how well the results match your query — without any identifier of you, your session or the shop; nothing is kept from that assessment except a short-lived technical score without the query text. Only when you submit a search (Enter, the button, or a short pause in typing) do we store:
- the text of your query and any follow-up messages,
- the products we showed you and the assistant’s answer,
- the filters you applied (category, brand, parameter, a price limit written in the query) and which results were on screen,
- the address of the page you searched from, without anything after the question mark,
- a summary of your basket: item count, total value and currency,
- time, language and technical details of the search.
What is processed when you e-mail the shop
If the shop also uses the AI assistant for e-mail support, your e-mail (address, name, content, attachments) may be automatically classified, enriched with context from the shop’s order system, and answered with a suggested or sent reply. The shop operator decides which replies are sent automatically and which are approved by a person. The same caveat as for chat applies: automated replies are generated by AI and may be inaccurate.
Technical security data
Your IP address is used transiently to protect against abuse and automated attacks (rate limiting, bot protection). It is not stored with your conversation or searches. A daily pseudonymous fingerprint is additionally derived from your IP address and browser details to count visitors; its secret key changes every day, so records cannot be linked across days or traced back to you. For this narrow security purpose Yasan acts as a controller on the basis of its legitimate interest in securing the service (Article 6(1)(f) GDPR); security logs are kept for no longer than 12 months.
Why, and on what basis
| Purpose | Legal basis (relied on by the shop operator) |
|---|---|
| Answering your question, showing relevant results, handling your e-mail request | Art. 6(1)(b) GDPR — performance of a contract and pre-contractual steps |
| Preventing abuse and protecting the service | Art. 6(1)(f) GDPR — legitimate interest in security |
| Improving the shop’s catalogue, search and customer care (what people look for and do not find), including an automated daily quality check of search results on a sample of recent queries (without identifiers) | Art. 6(1)(f) GDPR — the shop’s legitimate interest in improving its offering |
| Analytics and linking your visits (visitor identifier) | Art. 6(1)(a) GDPR / UK GDPR — your consent given in the shop’s cookie banner |
Without consent, chat, search and e-mail work normally. The assistant simply does not remember you between visits, and you appear in the shop’s reports as an anonymous record.
What is stored in your browser
The assistant stores information in your browser only after you actually use it — never while you merely browse.
Strictly necessary (no consent required):
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
whisper-chat-active |
cookie | remembers that a chat session is in progress | until the browser is closed |
whisper-chat-… |
local storage | keeps your conversation across page reloads | until you delete it or start a new one |
whisper-chat-ui-… |
local storage | remembers whether the chat window was open | until browser data is cleared |
whisper-chat-invitation-seen-… |
local storage | prevents the invitation from re-appearing | until browser data is cleared |
whisper-chat-consent |
local storage | remembers your choice in the consent banner | until browser data is cleared |
whisper-search-… |
local storage | keeps your search thread (queries, products shown, answers) across page reloads | until you delete it or start a new one |
whisper-search-outbox-… |
local storage | holds an unsent search message until it is sent | until sent or browser data is cleared |
Only with your analytics consent:
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
whisper-chat-visitor-id |
local storage | random identifier linking your visits so the assistant can pick up earlier searches | created only with consent; removed as soon as you withdraw it |
None of these are advertising identifiers and none are shared with advertising networks. You can withdraw consent at any time in the shop’s cookie settings; collection stops immediately and the identifier is deleted.
Who receives the data
The text of your query, message or e-mail, the selected products and the page or order context are sent to large-language-model providers so that an answer can be produced: Google, OpenAI and, as fallback models, Anthropic (run via Amazon Web Services). These providers do not train their models on the data and do not retain it beyond processing the request (and short-term abuse monitoring). To assess how well search results match your query, the query text and the names, brands and categories of the candidate products — without any identifier — are also sent to TypeSafe AI (USA), which does not train its models on them and does not store them after processing the request; the transfer relies on Standard Contractual Clauses. Infrastructure providers also process the data — in particular DigitalOcean (hosting in the EU), Cloudflare (bot protection, involving your IP address), Tinybird (analytics storage) and Postmark (verification e-mails). The current full list with locations: https://yasan.ai/subprocessors.
Processing takes place in the European Union and partly in the United States. Transfers to the US rely on the European Commission’s adequacy decision (EU–U.S. Data Privacy Framework) and its UK Extension, and otherwise on Standard Contractual Clauses (with the UK Addendum for UK data).
How long the data is kept
- Conversations, searches and analytics records: no later than 24 months after they were created. If the shop stops using the assistant, they are deleted within 30 days (subject to backup cycles).
- E-mails: for the period the shop operator sets for its customer support.
- Security logs: 12 months at most.
Searches made without consent and outside a conversation cannot be attributed to a person — they therefore cannot be retrieved on request, but are deleted within the same period.
Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability, and the right to object to processing based on legitimate interest. You may withdraw consent at any time, without affecting processing carried out beforehand.
Contact the shop operator (details in its policy); it will answer within one month. Yasan assists the operator — if you write to us directly at [email protected], we will forward your request to the shop without undue delay and will not handle it ourselves. You may lodge a complaint with the supervisory authority of your country, in the Czech Republic the Office for Personal Data Protection (uoou.gov.cz), or in the United Kingdom the Information Commissioner’s Office (ico.org.uk).
Children
The assistant is not intended for children below the age at which they can consent to online services in their country (between 13 and 16 across the EU; 15 in Czechia, 16 in Germany, 13 in the UK). We do not verify the age of users and do not knowingly collect data from children. If you believe a child has used the assistant, contact the shop operator (or us at [email protected]) and the related data will be deleted where it can be identified.
Sponsored results
If products in the chat or in the search were ever recommended for a reason other than relevance to your query (such as paid placement), they would be labelled as sponsored in the assistant window. As of the effective date of this notice, no paid placement is in operation.
This notice is provided by Let’s Whisper s.r.o. on behalf of the shop operator as a plain-language summary of processing through the Yasan service. It does not describe what the shop itself does with the data afterwards — that is in the shop’s own policy, which prevails in case of conflict.