For your shoppers’ personal data, you decide and we carry out: we process it only to run your store, keep it secure, and delete it when the service ends. This agreement is between you (the store owner, the database owner or controller) and us (the holder or processor). It is part of the terms of service.
What we process
- Whose data: your shoppers, customers with accounts, people who subscribe to your notifications or write to you through your store.
- What data: names, emails, phones, addresses, orders and what was bought, account details (passwords only as hashes), saved addresses, reviews, push notification subscriptions, and technical data such as IP address.
- What for: only to run your store and its features as you set them up and instruct us, including through AI apps you connected.
- How long: for as long as your store exists, then deleted as below.
Our obligations
- We process the data only on your instructions: these terms, your settings, and what you do in the dashboard or through AI apps you connected. If an instruction seems against the law to us, we tell you.
- Everyone at YallaFlow who can reach the data is bound to keep it confidential and reaches it only when needed, for example to answer your support request.
- We keep the security measures described in the privacy policy, as required by the Privacy Protection (Data Security) Regulations, 5777‑2017.
- We help you answer your shoppers’ requests to see, correct or delete their data, where you can’t do it yourself in the dashboard.
- We tell you without undue delay, and within [72] hours of finding it, about a security incident that affects your shoppers’ data, with what we know and what we are doing, so you can meet your own reporting duties.
- We don’t use, sell or share the data for our own purposes.
Sub-processors
You agree that we use the providers listed in the privacy policy (Hostinger, Vercel, Resend, GitHub, Cloudflare) to run your store. Each is bound to protect the data at least as this agreement requires. We tell you at least 30 days before adding or replacing one; if you object for a good reason, you can cancel and get the unused part of your payment back.
Payment providers and AI apps that you connect yourself are not our sub-processors: you choose them, under their own terms.
Data outside Israel
Some providers keep data in the European Union and the United States. We transfer data abroad only as the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761‑2001 allow.
Your obligations
- You have a lawful basis to collect your shoppers’ data and you tell them how you use it (your store’s privacy page, which you review and adapt).
- You register or report your database where the law requires.
- You don’t use the store to collect sensitive data it wasn’t built for, such as medical records or ID numbers, without telling us first.
When the service ends
You can export your shoppers’ data (customers CSV, store copy file) until the store is deleted. We delete the data together with the store, as described in the terms of service, and backups within [30] days after that, except what the law requires us to keep.
Checks
On a reasonable request, we give you the information you need to show that this agreement is kept, such as a description of our security measures. [To decide: whether owners may run audits, and at whose cost.]