Privacy

Privacy policy

Last updated 17 October 2026 · Effective 17 October 2026

Yotra keeps a team's email, requests, tasks, deadlines and meetings in one place. To do that it handles personal data, some of it sensitive to the people involved. This page says what we collect, why, who else touches it, and what you can ask of us.

Who we are

Yotra is a work management service for professional services firms and for teams inside companies. It is made in India and is currently in early access. In this policy, "Yotra", "we" and "us" mean the business that runs Yotra. "Your organisation" means the firm or company that set up a Yotra workspace, and "you" means anyone who visits our website or uses Yotra.

You can reach us at hello@yotrahq.com about anything in this policy.

The short version

• This website sets no cookies and runs no analytics.
• Your organisation owns the data in its workspace. We process it on your organisation's behalf, to run Yotra for it, and for nothing else.
• We connect to a mailbox or calendar only when someone chooses to connect it, and they can disconnect it at any time.
• Each organisation's data is kept apart from every other organisation's at the database level.
• We do not sell personal data, use it for advertising, or let anyone train AI models on it.
• Data from Google and Microsoft accounts is used only to provide the features you see in Yotra.

What we collect

When you visit this website

When you simply visit the website, we do not collect anything ourselves. The site has no sign-up tracking, no analytics and no advertising tags, and it sets no cookies. Pages load fonts from Google Fonts and two small animation libraries from public content networks (cdnjs, run by Cloudflare, and unpkg). Your browser asks those services for the files directly, so they receive the usual request details, such as your IP address and browser type, under their own privacy policies. The server that hosts the website may keep standard access logs for security and troubleshooting.

When you ask for early access

The early-access form asks for your name, your firm or company, your work email, the size of your team and, if you choose, a phone number. Pressing the button sends these details to Yotra, where they are kept in our own records and seen only by Yotra's team. We don't keep your IP address or anything else about your visit with them. If our server can't be reached, the form opens a new email in your own email app instead, addressed to hello@yotrahq.com, and we receive it only if you send it. We use these details to reply to you, to decide who to invite, and to set up your workspace if you join.

When you use Yotra

Your organisation's admin invites you, or you sign in with your Microsoft or Google work account. We keep:

• Account details: your name, work email, initials, role and level in your organisation, who you report to, your team, and your email signature if you set one.
• Sign-in identity: when you sign in with Microsoft or Google, we receive your name, email address and an account identifier, so we can recognise you next time. We never see your Microsoft or Google password.
• Sessions: the date and time you signed in and were last active, the IP address and the browser you used, so you can see and end your sessions and so we can protect your account.
• Activity log: a record of changes made in the workspace (who changed what, and when), which your organisation's leaders can read.

Work your organisation puts in Yotra

Clients or internal stakeholders and their contacts, tasks, comments, recurring work, deadlines, pages and notes, chat messages, files people upload, and engagement letters or statements of work. When the India compliance add-on is on, this can include tax and company registrations such as PAN, GSTIN and CIN. What goes in is up to your organisation.

Connected mailboxes and calendars

A person can connect their own Microsoft 365 or Google mailbox and calendar, and, where they already have access, shared or group mailboxes. Signing in to Yotra does not connect a mailbox; that is a separate step with its own consent screen. Once connected, Yotra:

• Reads email from the mailbox: for Microsoft 365, the Inbox and Sent Items; for Gmail, mail other than chats and drafts. On first connection it reads the last 14 days, and after that, new and changed mail. It keeps each message's sender, recipients, subject, body, date and the details needed to keep threads together.
• Lists attachments, and downloads one from the provider the first time someone opens it in Yotra.
• Sends the replies and forwards that people write in Yotra, from the connected mailbox, and sends a person's own Yotra notices to themselves from their own mailbox.
• Reads calendar events (title, time, place, meeting link, organiser and attendees), and creates, changes or removes an event only when someone does that in Yotra.
• Does not delete email from your mailbox. When mail is deleted in the mailbox, Yotra removes its copy at the next sync.

Mail in a personal mailbox is private to its owner in Yotra. It becomes visible to a colleague only when the owner, or someone allowed to, assigns that conversation to them or brings them into it.

Meeting notes

A person can connect their own note-taker account: Fireflies, Read AI or Otter. Yotra then receives their meetings' titles, times, attendees, summaries, action items and, where the note-taker provides it, the transcript. A meeting stays private to the person whose note-taker brought it in until they file it under a client or project.

Sakha, the assistant

When you use Sakha we keep your conversations with it, which are private to you, and a record of any changes it made for you so you can undo them. We also record how much each AI request cost, against your organisation's monthly AI limit. See Sakha and the AI.

Voice

If your organisation turns on voice, your browser turns your speech into text, and Yotra receives only the text. How your browser does that is governed by your browser's own terms.

How we use it

• To run Yotra for your organisation: show the right work to the right people, track how long client email has waited for a reply, turn requests and meeting action items into tasks, keep deadlines, and send the emails and calendar changes people make.
• To sign you in, keep your account secure, and stop misuse.
• To answer you when you write to us, and to support your organisation.
• To keep the service working: fixing faults and understanding load. Where we look at how the service is used, we use counts and other aggregated figures, not the content of your work.
• To meet our legal obligations.

We do not sell personal data, rent it, or use it for advertising.

Consent and legal basis

We follow India's Digital Personal Data Protection Act, 2023. For data we handle for our own purposes, such as early-access requests, website contact and account security, we rely on the consent you give when you send the form, write to us or sign in, or on a legitimate use the Act allows, such as complying with law.

For data in a workspace, your organisation decides the purpose and is responsible for having a valid basis for it, including telling its staff and clients about Yotra where the law requires. Each person who connects a mailbox, calendar or note-taker gives consent on the provider's own screen, and can withdraw it at any time by disconnecting it in Yotra or removing Yotra's access in their Microsoft, Google or note-taker account. Withdrawing consent does not affect what was done before.

Your organisation's data: who decides

For everything in a workspace, including connected mail, calendars and meeting notes, your organisation is the data fiduciary (in other laws, the controller), and Yotra is its data processor. We process that data only on your organisation's instructions, to provide Yotra. Requests from people about workspace data, such as a client asking to see or erase what a firm holds about them, should go to that organisation first. We will help it respond.

For website visitors, early-access requests and the account and security data we need to run the service, Yotra is the data fiduciary.

Google user data

When you connect a Google account, Yotra asks for these permissions:

• openid, email and profile: to know who you are and which address you connected.
• https://www.googleapis.com/auth/gmail.readonly: to read your email and attachments so they appear in Yotra with an owner and a reply clock. Yotra never changes or deletes anything in your Gmail.
• https://www.googleapis.com/auth/gmail.send: to send the replies and forwards you write in Yotra from your Gmail address, in the same thread.
• https://www.googleapis.com/auth/calendar.events: to show your events alongside your work, and to create or change an event when you do that in Yotra.

Signing in to Yotra with Google asks only for openid, email and profile.

In particular, for data we receive from Google APIs, including Google Workspace APIs:

• We use it only to provide and improve the user-facing features of Yotra that you can see and use, as described in this policy.
• We do not transfer it to anyone else, except as needed to provide or improve those features, to comply with applicable law, for security purposes, or as part of a merger, acquisition or sale of assets, with notice to you.
• We do not use it, or transfer it, for serving advertisements, including retargeting, personalised or interest-based advertising.
• We do not sell it, and we do not use it to determine creditworthiness or for lending purposes.
• We do not allow humans to read it, unless we have your affirmative agreement for specific messages, it is necessary for security purposes such as investigating abuse, it is necessary to comply with applicable law, or the data has been aggregated and anonymised and is used for internal operations in line with applicable law.
• We do not use it, or transfer it, to develop, improve or train generalised or non-personalised artificial intelligence or machine learning models.

When you ask Sakha about your work, the parts of your email it needs to answer are sent to our AI provider to produce that answer for you. That is a user-facing feature, and the provider may not use the data to train its models. See Sakha and the AI.

Gmail can tell Yotra that new mail has arrived through Google Cloud Pub/Sub. That notice contains no message content; Yotra then fetches the new mail itself.

You can remove Yotra's access at any time in Yotra, or from your Google Account at myaccount.google.com/permissions.

Microsoft data

When you connect a Microsoft 365 account, Yotra asks Microsoft for these delegated permissions through Microsoft Graph:

• openid, profile, email, User.Read: to know who you are.
• offline_access: to keep syncing without asking you to sign in again each hour.
• Mail.ReadWrite and Mail.Send: to read your email and send the replies and forwards you write in Yotra. Write access is needed to prepare a reply as a draft in your mailbox before it is sent, so it threads correctly.
• Calendars.ReadWrite: to show your events and create or change an event when you do that in Yotra.
• Mail.ReadWrite.Shared, Mail.Send.Shared, Calendars.ReadWrite.Shared: for shared mailboxes you already have access to in Exchange, if you connect them.
• Group-Conversation.Read.All: asked for only if someone connects a Microsoft 365 group mailbox, and only with an admin's approval.

Signing in to Yotra with Microsoft asks only for openid, profile, email and User.Read. An admin of your Microsoft 365 tenant can also approve Yotra once for everyone in the organisation.

We treat data from Microsoft Graph the same way as Google data above: only to provide Yotra's features to you, never for advertising, never sold, not read by people except as described there, and not used to train AI models. Your admin, or you, can remove Yotra's access at any time in Yotra or in your Microsoft account and Microsoft Entra settings.

Sakha and the AI

Sakha is Yotra's assistant. Our AI provider is Anthropic, and Sakha runs on its Claude models.

What is sent. When you ask Sakha something, we send Anthropic your message, the screen you are on, recent turns of your conversation, and the results of the lookups Sakha makes to answer you. Those lookups can include tasks, clients, deadlines, pages, people and email conversations, but only what you yourself are allowed to see in Yotra. When someone uploads an engagement letter or statement of work for Yotra to read, the document is sent to Anthropic so it can propose the services, dates and fees in it for a person to review.

What is not. Nothing goes to the AI unless someone uses one of these features. Your organisation's admin can turn AI off entirely, or feature by feature, in Settings, and set a monthly limit on its cost.

Training. We use Anthropic under its commercial terms, which do not allow it to train its models on our customers' data. Anthropic may keep requests for a limited time under those terms, for example to detect misuse.

People stay in charge. Sakha acts only with your own permissions. It does not send an email, share anything or make a large change until you tap to confirm, and text inside an email cannot do that for you. Most changes it makes can be undone. AI can be wrong, so check what it tells you before relying on it.

Who we share it with

We share personal data only with service providers who help us run Yotra (sub-processors), with the services you choose to connect, and where the law requires. Each sub-processor gets only what it needs for its part of the job.

• Hosting and storage: a cloud hosting provider runs our servers, database and file storage.
• AI: Anthropic, for Sakha and for reading uploaded engagement letters.
• Microsoft: for sign-in and, when you connect them, Outlook mail and calendars through Microsoft Graph.
• Google: for sign-in and, when you connect them, Gmail and Google Calendar, including Google Cloud Pub/Sub for new-mail notices.
• Meeting note-takers you connect: Fireflies, Read AI and Otter, from which Yotra reads your meetings.
• Email: the provider that hosts our own mailbox, hello@yotrahq.com, for messages you send us.
• Website delivery: Google Fonts, cdnjs (Cloudflare) and unpkg, as described above.

The services you connect, such as Microsoft, Google and note-takers, also hold your data under their own terms and privacy policies; we do not control them. We may disclose data if the law requires it, for example to answer a valid order from a court or government authority, and we will tell your organisation where we lawfully can. If Yotra's business is sold or merged, data would pass to the new owner under the same protections, and we would tell you first.

Your organisation can ask us for the current list of sub-processors at any time.

Where it is processed

Some of the services above, including Anthropic and the note-takers, process data outside India, mainly in the United States. Microsoft and Google process data in the regions their own terms set for your account. We transfer personal data outside India only as the Digital Personal Data Protection Act allows, and not to any country the Government of India restricts. We use providers with strong security commitments and contracts that limit their use of the data.

How long we keep it

• Workspace data is kept for as long as your organisation uses Yotra, unless it deletes something sooner. When the account closes, your organisation can export its data first, and we then delete it, except anything the law requires us to keep, and except copies in backups, which are overwritten over time.
• Connected mailboxes: when someone disconnects a mailbox, Yotra deletes its access tokens at once and stops syncing. Email already brought in stays in the workspace as part of your organisation's records, until your organisation asks us to remove it.
• Sessions end after 14 days without use and after 30 days at most. Unfinished sign-in attempts are deleted after 15 minutes.
• Early-access requests are kept while we are in touch with you, and deleted on request.
• Deactivated people: they can no longer sign in, but their name stays on the work they did, so your organisation's records stay complete.

How we keep it safe

• Each organisation's data is kept apart from every other's by row-level security in the database, so one organisation's requests cannot read another's rows.
• Access tokens for Microsoft, Google and note-takers, and other secrets, are encrypted at rest with AES-256-GCM, and are never sent to your browser.
• Sign-in uses OAuth with PKCE through Microsoft or Google. Your session cookie is signed and not readable by scripts, and we store only a hash of its token, so a copy of our database could not be used to sign in.
• Inside a workspace, people see what their role allows. Personal mailboxes, Sakha conversations and unfiled meeting notes are private to their owner.
• Changes are written to an activity log your organisation's leaders can review.
• Data travels over encrypted connections (HTTPS).

No system is perfectly secure. If a personal data breach affects you, we will tell your organisation and the Data Protection Board of India as the law requires, without undue delay.

Cookies

This website sets no cookies. The Yotra app sets one cookie, which keeps you signed in. It is strictly necessary, so we do not ask for consent for it. The app also remembers a few display choices, such as how you like your task list and mail laid out, in your own browser's storage; these never leave your device. We do not use advertising or tracking cookies.

Your rights

Under the Digital Personal Data Protection Act, 2023, you have the right to:

• Access: a summary of the personal data we process about you and how we process it, and who we have shared it with.
• Correction and erasure: have inaccurate or incomplete data corrected, completed or updated, and have data erased when it is no longer needed, unless the law requires us to keep it.
• Withdraw consent: at any time, as easily as you gave it.
• Grievance redressal: complain to us and get an answer, and if you are not satisfied, complain to the Data Protection Board of India.
• Nominate: name another person to use these rights for you if you die or become unable to.

Write to hello@yotrahq.com to use any of these. We may need to confirm who you are. If your request is about data your organisation holds in its workspace, we will pass it to your organisation, which decides on it, and help it respond. Some things you can do yourself in Yotra: see and end your other sessions, disconnect a mailbox, delete your Sakha conversations, and export the clients, contacts and tasks you can see to Excel from Settings.

If you live outside India, you may have similar rights under your local law. Write to us and we will help.

Grievance officer

For any question or complaint about how we handle personal data, write to our Grievance Officer at hello@yotrahq.com, with "Grievance" in the subject. We will acknowledge it promptly and aim to resolve it within 30 days.

Children

Yotra is a tool for work. It is not meant for anyone under 18, and we do not knowingly collect personal data from children. If you think a child has given us personal data, tell us and we will delete it.

Changes to this policy

We will update this policy as Yotra changes. The date at the top shows the latest version. If a change matters, such as a new kind of data or a new sub-processor, we will tell your organisation's admins before it takes effect.

Contact

Yotra · hello@yotrahq.com

See also our terms.