Privacy Policy
Last updated: 14 September 2026
Yari Flow (“Yari Flow”, “we”, “us”, or “our”) is a product of Yari Labs, Lda. This Privacy Policy explains how we collect, use, share, and retain personal information when a merchant installs or uses the Yari Flow Shopify app (the “App”) and when someone visits yariflow.com.
This policy is written for Shopify merchants and for shoppers whose data we process on a merchant’s behalf.
1. Who we are
Controller for merchant account, billing, website, and marketing data:
Yari Labs, Lda
Rua Dr. Justino Cruz nr 110, 1st Floor
4700-314 Braga
Portugal
Email: privacy@yariflow.com
For shopper (customer) data processed inside a merchant’s store, the merchant is the controller and Yari Labs, Lda is the processor, acting on the merchant’s instructions and our Data Processing Agreement.
We are established in the European Union. The App is hosted on Google Cloud in europe-west2 (London, United Kingdom).
2. Scope
This policy covers:
- the Yari Flow Shopify app (admin, billing, analytics, automations, and support tools)
- customer-facing subscription experiences we provide for a merchant (My Account / customer portal, plan picker, and related emails)
- yariflow.com, the Help Centre, and related marketing pages
It does not cover Shopify’s own processing. Shopify publishes a separate privacy policy.
3. Information we collect through Shopify APIs
When a merchant installs the App and grants permissions, we may access:
Store / merchant
- shop name, domain, Shopify plan, locale, currency, and timezone
- names and email addresses of staff who open the App
- theme and theme-app-extension status needed to render subscription widgets
Catalogue
- products, variants, images, prices, inventory, collections, and tags
- selling plans and selling plan groups
Orders and subscriptions
- orders that include a selling plan or subscription contract
- subscription contracts, billing cycles, delivery schedules, and related discounts
- order notes, tags, and fulfilment status needed to run renewals
Customers (shoppers of the merchant)
- name, email, phone number, shipping address, and billing address
- customer account identifiers
- subscription preferences and self-service actions (frequency, pause, skip, swap, cancel)
- payment-method metadata available through Shopify (for example card brand, last four digits, and expiry). We do not receive or store full card numbers or CVV. Card vaulting is handled by Shopify and the merchant’s payment provider.
Other
- checkout and customer-account context needed to show plan options and the portal
- webhooks, including install, uninstall, order, subscription, and Shopify’s mandatory privacy webhooks
We request only the access scopes required to operate subscriptions, the customer portal, payment recovery, analytics, and support.
4. Information we collect directly
From merchants and their staff
- name, work email, phone number, and company name
- demo, onboarding, and support messages
- billing plan selection and usage charges processed through Shopify Billing
- App configuration (selling plans, cancellation flows, My Account branding, notification templates, and user roles)
From shoppers, only as needed to run the merchant’s subscription
- portal login and session data
- self-service actions taken in My Account
- emails or in-portal messages if the merchant enables them
Website and product telemetry
- IP address, browser, device type, pages viewed, and referring URL on yariflow.com
- App error and performance events
- aggregated product analytics used to operate dashboards
We do not sell personal information.
5. How we use the information
We use personal information to:
- provide, host, and secure the App
- create and manage selling plans and subscription contracts
- process recurring orders through Shopify
- power My Account / the customer portal and cancellation or save flows
- run dunning and payment-recovery workflows the merchant enables
- show analytics and reporting to the merchant
- provide onboarding, migration, and customer support
- send service emails (install, billing, incidents)
- send product or marketing emails to merchants who have not opted out
- detect abuse, fraud, and security incidents
- meet legal obligations, including access, correction, and deletion requests and Shopify’s mandatory privacy webhooks
We do not use shopper data to advertise Yari Flow to those shoppers.
6. Legal bases (EEA and UK)
Where we act as controller (merchant, website, and billing data):
- Contract — to provide the App and related services the merchant requests
- Legitimate interests — security, product reliability, B2B communications with merchants, and fraud prevention
- Legal obligation — tax, accounting, and privacy requests
- Consent — non-essential marketing emails or non-essential website cookies, where required
Where we act as processor (shopper data in a merchant’s store), we process that data on the merchant’s documented instructions and our DPA.
7. Cookies
Marketing website (yariflow.com)
We use cookies that are strictly necessary to operate the site. If we add non-essential analytics or marketing cookies, we will request consent where the law requires it.
Merchant storefront (My Account and plan picker)
My Account and the plan picker store authentication cookies only. These cookies keep a logged-in shopper session so they can manage their subscription. They are not used for advertising or cross-site tracking.
Blocking authentication cookies will prevent login to My Account.
8. Sharing and subprocessors
We share personal information only with Shopify, the providers below, integrations the merchant chooses to connect, advisers, and authorities when required by law.
We do not share shopper lists for third-party advertising.
9. International transfers
Primary operations are in Portugal. The App is hosted in Google Cloud europe-west2 (United Kingdom). The United Kingdom benefits from an EU adequacy decision.
Postmark may process transactional email in the United States. Where we transfer EEA personal data to a country without an adequacy decision, we rely on Standard Contractual Clauses (and the UK Addendum where required).
10. Retention and Shopify privacy webhooks
- Merchant account and configuration: kept for the life of the install, then deleted or anonymised after privacy webhooks are processed.
- Shopper and subscription data: kept while the App is installed. After uninstall we follow Shopify’s privacy webhook rules and do not keep shop or shopper data longer than 48 hours, except tax, security, or legal-claim records.
- Billing records: kept as required by Portuguese and EU tax law.
Mandatory webhooks:
- customers/data_request — we compile the shopper data we hold
- customers/redact — we delete or anonymise that shopper’s data
- shop/redact — we delete or anonymise the shop’s data after uninstall
11. Security
HTTPS, access controls, least-privilege staff access, encryption in transit. Card PAN and CVV are not stored by Yari Flow.
12. Your rights
Email privacy@yariflow.com for access, correction, deletion, restriction, objection, or portability.
Shoppers should contact the store they subscribed to first. Supervisory authorities: CNPD (Portugal), ICO (UK).
13. Children
The App is for business users. We do not knowingly collect personal information from children.
14. Changes
The “Last updated” date will change when this policy changes.
15. Contact
Yari Labs, Lda
Rua Dr. Justino Cruz nr 110, 1st Floor
4700-314 Braga, Portugal
Privacy: privacy@yariflow.com
Support: hello@yariflow.com
