Data Processing Agreement
Last updated: 14 September 2026
This DPA forms part of the Yari Flow Terms of Service between Yari Labs, Lda (Processor) and the merchant that uses the App (Controller). If it conflicts with the Terms, this DPA controls for personal-data processing.
Roles. Merchant = controller of shopper/store data. Yari Labs, Lda = processor of that data. Yari Labs, Lda = controller of merchant account, App billing, and website data (see the Privacy Policy).
Address. Rua Dr. Justino Cruz nr 110, 1st Floor, 4700-314 Braga, Portugal. Privacy: privacy@yariflow.com
Purpose. Operate Yari Flow: selling plans, subscription contracts, My Account, billing recovery, merchant analytics, support, and Shopify privacy webhooks. No shopper advertising for Yari Flow.
Data. Name, email, phone, address, customer/order IDs, subscription preferences, order metadata, Shopify payment-method metadata (not full PAN/CVV), technical logs.
People. Merchant customers and staff who use the App.
Our duties. Process only on documented instructions; confidentiality; appropriate security (HTTPS, access control, Google Cloud europe-west2); authorised subprocessors only; help with data-subject requests and breaches; delete as below; provide compliance information.
Subprocessors. Google Cloud (hosting, europe-west2); Postmark (email, US); AppSignal (errors, NL); ClickHouse (analytics). Material changes will appear on the Privacy Policy. Merchant may uninstall if it objects.
Transfers. EU company, UK hosting (adequacy). US email via SCCs where needed.
Breach. Notify the merchant without undue delay.
Deletion. After uninstall / shop/redact / customers/redact, delete or anonymise. Shop and shopper personal data is not kept longer than 48 hours after uninstall, except legal tax or claims records.
Audits. Security summary on request; questionnaire at most yearly unless a breach or regulator requires more.
Liability. Follows the Terms, except where GDPR / mandatory law says otherwise.
