Who is responsible

Pichu is made by YatoFix (MEDANI Samir, sole proprietor, Poitiers, France). For any question or request: hello@pichubot.com.

Your account

Data: name, email address, password (stored in a form that cannot be reversed), language; if you sign in with Apple, Google or Microsoft, the identifier that service sends us (with “Hide My Email”, Apple gives us a relay address).

Use: signing you in and securing your account. Legal basis: contract.

What you entrust to your Bots

Data: your conversations with the Bots, the files you exchange, what the Bots remember for you (memory), their settings, your routines and reminders; your location only when a Bot asks for it and you tap “Share my location”.

Use: doing the work you ask for. Legal basis: contract.

Your Bots’ computer

Each person has a virtual computer in their name on our servers in France, with its browser, sessions and working files. The credentials you put in the vault stay encrypted and are never sent back into the conversation. An encrypted backup is made every night; the last seven are kept.

When you connect your mail or calendar (Google or Microsoft), the authorization tokens are stored encrypted. You can revoke them at any time with Google or Microsoft.

Artificial intelligence

To do its work, a Bot sends your request and the useful context to the provider of the AI model in use: DeepSeek (China) by default, and OpenAI (United States) for GPT models, image creation and voice features. If you add your own API key (for example Mistral AI, in France), that provider receives this data, under your own terms with it.

YatoFix doesn’t use your conversations to train models.

Notifications and payments

Notifications: your phone’s notification identifier, sent to Apple or Google so that we can tell you when a Bot needs you.

Payments: there are none during the beta. When subscriptions open, a payment on the web will go through Stripe, which processes your card details, and an in-app purchase through Apple or Google; we only keep the subscription identifier and its status.

Security

Encrypted connections (HTTPS), sensitive data encrypted in the database, approvals before sensitive actions, encrypted backups. A log of sign-ins and actions (date, device, IP address) protects your account.

How long data is kept

As long as your account exists. You can delete a conversation or a Bot at any time.

Deleting your account: in the app, “My account” then “Delete my account”. Everything is deleted right away: account, Bots, conversations, files, memory, connections, backups and computer; a running subscription stops. Only the amounts consumed and the anonymised log remain, without personal data. A company account is deleted at the request of its company.

Who receives your data

  • The YatoFix team, each according to their access rights.
  • Hosting: the site and the platform run on servers administered by YatoFix in France.
  • Purelymail hosts and sends our emails, in the United States.
  • The AI model providers described above, Apple or Google for notifications and sign-in, and Stripe for payments once they exist.

Your data is neither sold nor handed over.

Cookies

The website pichubot.com uses no cookies: the theme you choose is only kept in your browser. The app uses one cookie to keep you signed in.

Your rights

You can ask to access, correct, delete, restrict or port your data, and object to its use. Write to hello@pichubot.com: we answer within one month. If you disagree with our answer, you can contact the CNIL, the French data protection authority.