Privacy notice

Genetic data for your free beta report

Who is responsible. Genetic History S.L.U. is responsible for this processing on yfull.ai. For questions about personal data or to exercise your rights, contact dpo@yfull.ai. In these terms, the donor is the person whose DNA the sample contains; the customer is the person ordering the report. They may be different people.

Purpose and permission. We use the donor's genetic data to prepare the requested ancestry and genealogy report and provide it to the customer in their yfull.ai account. This processing is based on the donor's explicit consent under Articles 6(1)(a) and 9(2)(a) of the GDPR. It includes permission for that customer to receive and read the report. If the customer is not the donor, the customer passes these terms to the donor and confirms that they have obtained that permission. The donor does not need to create an account or confirm separately to yfull.ai.

Providing genetic data is voluntary, but we cannot prepare this report without the required data and permission. The report is for ancestry and genealogy. It is not a medical or diagnostic result, and it should not be used for health, medical, or treatment decisions. This permission does not cover marketing, AI model training, research or optional storage for future features. Any separate optional purpose has its own terms and consent.

Report using a sample on yfull.com. At the customer's request, we receive the selected sample's identifiers and existing Y-DNA and/or mtDNA tree placement from yfull.com, together with the information needed to connect that sample to the order. These data come from yfull.com through the customer's authorised sample connection, not from a new raw DNA file uploaded for this report. We use the existing placement to prepare the report. Where the service updates the placement, we can re-read it only while the sample remains available on yfull.com and the permission remains valid. Removal or transfer of the source sample stops further reads from that source; it does not by itself withdraw the donor's permission for an already delivered report. That report remains subject to the retention limits and rights below.

Report using a chip file. The customer uploads the donor's genetic test file. We read the file and process the Y-DNA and/or mtDNA data needed to determine the available tree placement and prepare the requested report. We also process the file information needed to handle the upload and connect its result to the order. The file may contain autosomal data as well. Permission for this report does not authorise keeping those additional data for future features; that requires the separate optional permission. The file-storage terms for this upload apply, rather than the terms for an existing yfull.com placement.

Report generation and review. We use OpenAI services to create and automatically review your historical and genealogical report. For this purpose, we send the sample's genetic branch designation and the family-origin information selected for the report. We do not send the original genetic test file to OpenAI. If the report concerns another person's sample, processing requires that person's explicit consent, including consent to provide the report to you.

The report is created and reviewed by software agents using OpenAI models. It provides a historical and genealogical interpretation, may contain errors and uncertainties, and is not a medical or diagnostic result. Review by software agents does not mean that a human specialist has reviewed the report.

Who receives the data. The customer receives the report, including its genetic and ancestry information. Our authorised staff and service providers process the information needed to supply and support the service. Hosting and report-generation providers, their roles, locations, applicable international-transfer safeguards and provider retention are described in the Service providers and international transfers section linked with these terms. Raw genetic files are not sent to the external narrative-generation AI service. The report permission is not permission to publish the donor's data or report publicly.

How long we keep the data. We keep the completed report in the customer's account until its deletion is requested. During beta testing, deletion requests are handled manually through dpo@yfull.ai. The donor may request deletion without having an account. For chip uploads, we keep the Y-DNA and mtDNA data needed to determine and re-determine placement for as long as the customer has an account and the relevant consent remains in force, so that placement can be updated when the reference tree changes. Processing and retention based on consent end earlier if the relevant permission is withdrawn or the purpose ends; account deletion also ends ordinary account access and storage. A retry, pause or loss of the source sample does not restart an applicable retention period. The yfull.com route keeps placement and report data, not a raw source file. We do not keep the remaining autosomal data for future features without the separate optional permission. If that permission is given, this additional storage ends when it is withdrawn; withdrawing it does not remove the report or account. A free beta place or its two-year eligibility limit does not set the retention period for a genetic file or report.

When ordinary processing ends, we remove the affected data from ordinary use and instruct the relevant service providers to do the same. Where Spanish law requires blocking, the data remain restricted solely for the possible liabilities arising from processing until the applicable limitation periods expire, and are then destroyed. They are not used to generate reports or maintain customer access during that restriction. Necessary evidence of the customer's declaration and of rights requests has its own limited retention purpose; it is not permission to retain the genetic file or report indefinitely. Controlled backup copies and provider copies follow their applicable deletion schedules. Deletion by yfull.ai does not itself recall a copy the customer has already downloaded.

Your rights. The donor may withdraw consent at any time or request access, correction, deletion, restriction or portability where applicable by writing to dpo@yfull.ai, without a yfull.ai account. The customer may also pass on the donor's request. Please give enough information to locate the affected sample or report; we may ask for additional information where necessary to verify the request. Withdrawal does not affect processing that was lawful before it, but stops further processing and disclosure relying on that permission. It may prevent us from completing or continuing to provide the affected report. It does not automatically close the customer's account, cancel an unrelated report or remove an otherwise valid free-order allowance of the other type. You may object to processing based on legitimate interests where applicable and complain to the Spanish Data Protection Agency or another competent supervisory authority. We respond to rights requests without undue delay, normally within one month; if the GDPR permits an extension, we explain it within that month.

Free beta order. This order is free. It creates no charge, paid subscription or automatic renewal. There is no placement payment to refund. Free participation does not remove data-protection rights or applicable consumer rights. Report preparation may use automated analysis and AI-generated narrative; this service does not make decisions about the donor with legal or similarly significant effects.

Service providers and international transfers

OpenAI and its service providers may process data outside the European Economic Area, including in the United States. Choosing a European storage region does not by itself mean that all processing and technical copies remain in Europe.

What crosses a border, and why. When our forms run an anti-bot check — for example when you join the waitlist or place your sample — our security provider Cloudflare, Inc., in the United States, processes your IP address and interaction signals to keep the service secure against automated bots and fraud. This is not your genetic data and not special-category data, and it does not run on your consent: it rests on our legitimate interest in keeping the service secure (Article 6(1)(f) of the GDPR, recognised by Recital 49).

How the transfer is protected. Because Cloudflare is in the United States, this is a transfer outside the European Union. It is protected by the EU–US Data Privacy Framework (the European Commission's adequacy decision under Article 45 of the GDPR) and, in our contract with Cloudflare, the European Commission's Standard Contractual Clauses (Module 2, under Article 46(2)(c) of the GDPR). You can ask for a copy of those Clauses at any time by emailing our data protection contact at dpo@yfull.ai.

Sending you a service email. When we send you a service email — for example your account-recovery link, a waitlist update or a confirmation message — our email provider Resend (Plus Five Five, Inc.), in the United States, processes your email address and the contents of that message to deliver it. This is not your genetic data and not special-category data.

How that transfer is protected. Because Resend is in the United States, this is a transfer outside the European Union. It is protected by the European Commission's Standard Contractual Clauses (Module 2, under Article 46(2)(c) of the GDPR) in our contract with Resend, together with a transfer impact assessment we have carried out following the Schrems II ruling and the European Data Protection Board's guidance. You can ask for a copy of those Clauses at any time by emailing our data protection contact at dpo@yfull.ai.

Who processes your data on our behalf. A sub-processor is a company we use to carry out part of the service under our instructions and a written data-processing contract. yfull.ai uses the following sub-processors:

If we add or change a sub-processor, we give you at least 30 days' written notice beforehand, so you can review the change.