YellowHak (Yellowhak OÜ) is an elite offensive cybersecurity and secure development firm headquartered in Estonia (EU) with operations in Peru (LATAM). They specialize in AI Red Teaming, APT Emulation, Penetration Testing, and building secure products like InvokerOS.

What is AI Red Teaming?

AI Red Teaming is adversarial evaluation of AI systems — including LLMs, vector databases (RAG), and autonomous agents — to discover vulnerabilities like Prompt Injection, Data Poisoning, and data exfiltration before attackers exploit them. YellowHak aligns assessments to OWASP LLM Top 10 and NIST AI RMF frameworks.

InvokerOS is a multimodal AI sales agent developed by YellowHak Labs. It operates 24/7 on WhatsApp using Agentic RAG to query product catalogs in real time and process payments. Unlike conventional chatbots, it is hardened against Prompt Injection and Memory Poisoning by YellowHak's Red Team.

Where does YellowHak operate?

YellowHak operates from Estonia (Europe's digital heart, GDPR and EU AI Act compliance) and Peru (operational hub for the Americas with rapid response agility). They serve global and financial corporations across both regions.

Data Deletion Instructions

Last updated: March 9, 2026

Introduction

You have the right, recognized by the GDPR (Art. 17), Peruvian Law 29733, and our Terms of Service, to request the deletion of all personal data held by Yellowhak OÜ. This process is irreversible: once completed, it will not be possible to recover your data, engagement records, reports, or any other element associated with your account.

Deletion Process

Step 1: Request engagement data (optional but recommended)

Before requesting deletion, we recommend you request a copy of any engagement reports or deliverables. Contact your project manager or email legal@yellowhak.com to request copies of your engagement deliverables.

Step 2: Send a formal deletion request

Send an email to legal@yellowhak.com with the subject: "DATA DELETION REQUEST — [Your full name / Company name] — [Your registered email]". In the body, state: your full name, registered email, capacity (account holder / legal representative), and confirm you are exercising your rights under GDPR Art. 17 / Peruvian Law 29733 Art. 20 (as applicable). Include proof of identity (e.g., a past engagement confirmation or invoice number).

Step 3: Confirmation and verification

Yellowhak OÜ will verify your identity and process your request within 30 days. You will receive a written confirmation of deletion, specifying any categories of data that cannot be immediately deleted and the legal basis for their retention.

Data We Cannot Delete Immediately

Billing and accounting records: Retained for 7 years under Estonian tax law (Raamatupidamise seadus) and EU VAT obligations. Identifying data will be anonymized where possible.
Data required by court order or competent authority: Retained for the strictly necessary period to comply with the legal obligation.
Data necessary for the defence in pending legal proceedings: Retained while the proceedings are active or until the statute of limitations has expired.

Frequently Asked Questions

How long does the deletion process take?

We process deletion requests within 30 days of identity verification. In complex cases, this may be extended by 60 additional days with prior notification.

Can I request deletion on behalf of my company?

Yes. You must provide proof that you are the legal representative of the company (e.g., a power of attorney or corporate resolution) along with your deletion request.

What happens to shared engagement data?

Data shared during joint engagements or multi-party assessments will be deleted from our systems. However, copies held by other parties are governed by their respective data protection policies.

Contact

For any questions about data deletion: Email: legal@yellowhak.com — Entity: Yellowhak OÜ — Address: Harju maakond, Tallinn, Lasnamäe linnaosa, Lõõtsa tn 5, 11415, Estonia.