Legal
Data Processing
How YeloScale processes customer data on a merchant's behalf.
Effective date
These terms are effective as of September 2026. Some merchants may additionally require a signed Data Processing Agreement; contact us to arrange one.
1. Roles
When a merchant uses YeloScale to run a store, the merchant is the controller of their customers' personal data, and YeloScale acts as a processor that handles that data on the merchant's instructions to provide the Service.
2. Scope of processing
We process the customer personal data needed to operate stores — for example order details, contact information for delivery, and payment status for cash-on-delivery — for the purpose of providing the Service to the merchant.
3. Sub-processors
We use vetted sub-processors (for example hosting and infrastructure) to deliver the Service. We require them to provide appropriate protections, and we remain responsible for their handling of data on our behalf.
4. Security measures
- HTTPS in transit and access controls.
- Encryption of sensitive credentials at rest.
- Permissioned, scoped access — including for MCP/AI tools.
- Logging and monitoring to detect and respond to issues.
5. Data subject requests
We assist merchants in responding to requests from their customers (such as access or deletion) to the extent the Service allows.
6. Breach notification
If we become aware of a personal-data breach affecting merchant customer data, we will notify the affected merchant without undue delay and support reasonable response steps.
7. Return and deletion
On termination, we delete or return merchant customer data in line with our retention practices and applicable law, except where retention is legally required.
8. Contact
For data-processing questions or to request an agreement, use the contact page.
