This agreement forms part of the Terms of Service between Yield ("processor", "service provider") and the customer ("controller", "business"). It applies when we process personal data for you, mainly data about visitors to your store.
1. Subject matter and duration
We process visitor and order data to measure revenue per visitor, run tests and build pages, for as long as you use the service plus the deletion period in section 9.
2. Data and people
- People: visitors to your store and landing pages, and your customers who place orders.
- Data: visit and session IDs, pages viewed, scroll, section views, clicks, page speed, device, browser, country, UTM and ad tags, cart and checkout events, and order details without names, emails, addresses or phone numbers.
- No special category data is intended or needed.
3. Our duties
- Process the data only on your documented instructions, which are these terms and your settings, unless the law requires otherwise (we'll tell you first if allowed).
- Make sure everyone who handles it is bound by confidentiality.
- Keep appropriate security measures in place (section 6).
- Help you answer requests from individuals and with security, breach notices and impact assessments, as far as reasonably possible.
- Make available the information needed to show we comply, and allow reasonable audits on 30 days' notice, no more than once a year unless a breach or regulator requires it.
4. US state privacy laws (including CCPA/CPRA)
We act as your service provider or processor. We won't sell or share the personal data, keep, use or disclose it outside our direct business relationship with you or for any purpose other than providing the service, or combine it with personal data from other sources or customers, except as those laws allow. We'll tell you if we can no longer meet these duties.
5. Sub-processors
You authorise the sub-processors listed in our privacy policy. We'll give you at least 14 days' notice by email before adding or replacing one, and you can object on reasonable data protection grounds. We bind each sub-processor to data protection terms at least as protective as these and remain responsible for them.
6. Security
Encryption in transit (TLS) and at rest; encrypted storage of access tokens; separation of each customer's data in the database; least-privilege staff access; no collection of IP addresses, form entries or payment data; raw event retention of 90 days.
7. Breaches
We'll notify you without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting your data, with the information you need to meet your own obligations.
8. International transfers
We process data in the United States. For personal data from the EU/EEA, the Standard Contractual Clauses (Module 2, controller to processor) are incorporated by reference; for the UK, the UK International Data Transfer Addendum applies.
9. Deletion and return
When the service ends you can export your reports for 30 days. After that we delete your personal data, unless the law requires us to keep it, and confirm on request.
10. Your duties
You're responsible for having a lawful basis and giving notice to your visitors, including a cookie banner where required and a privacy policy that names us as a service provider.