Draft — pending legal review. These documents are provided for transparency and are not yet in force. They must be reviewed by a qualified solicitor before Yonto takes any payment. Do not rely on them until then.

Privacy Policy

Last updated: 31 July 2026

This explains what data Yonto collects and why — described from what the product actually does, not boilerplate. It covers your account data and the visitor data we process on your behalf.

What Yonto is built not to do

We do not build cross-site profiles of shoppers, we do not collect their names, emails, addresses or the items they bought, and we do not store IP addresses to identify people. Attribution runs on a single random identifier and a small set of commercial figures.

1. Two roles: your account vs. your visitors

For your account data (your name, email, business details, billing), Yonto Sales Ltd is the data controller.

For the visitor and order data we process so you can attribute sales on your own store, you are the controller and Yonto is your processor, acting on your instructions. Business customers should also read the Data Processing Addendum.

2. The tracked link and the 30-day click cookie

When a shopper follows a creator's tracked link, we:

generate a random click identifier (a "click_id") — an opaque random string, not derived from the person;
store that click_id in a first-party cookie that lasts 30 days so a later purchase can be linked to the click;
record the click event and which campaign it belongs to.

We do notstore the visitor's IP address as an identifier, and we do not combine the click_id with data from other sites to build a profile. The cookie is first-party and single-purpose.

3. The pixel is a no-op for everyone else

On sites that install our optional pixel, the script does nothingfor visitors who did not arrive through a creator's tracked link. If there is no Yonto referral present, the conversion function simply returns and sends no data. Only visitors a creator actually referred are ever measured.

4. Shopify data we receive

Limited to order totals and discount codes

When you connect Shopify, we request read access to orders and receive, for each order, the order total, currency, and any discount code used — the minimum needed to attribute a sale. We do not receive or store customer names, emails, addresses, or line-item / product details.

5. Account and billing data

To run your account we process your name, work email, business name, and settings. Payments are handled by our payment provider acting as merchant of record; they process your billing details — we do not store card numbers.

6. Legal bases (UK/EU GDPR)

Contract — to provide the Service you signed up for.
Legitimate interests — to secure, maintain and improve the Service, and to measure attribution on your instruction as your processor.
Legal obligation — to meet tax and accounting requirements.

Where your own site relies on visitor consent for cookies, you are responsible for obtaining it. See the Cookie Notice.

7. Retention and deletion

Click and conversion records are retained while your account is active and for a reasonable period afterwards for reporting continuity, then deleted or anonymised. The 30-day click cookie expires automatically. You can request deletion of your account data, and we will delete or anonymise it except where we must keep records (for example, billing records for tax).

8. Sharing

We share data only with the processors that run the Service — our hosting/database provider, our email provider, and our payment provider — under contract, and where required by law. We do not sell personal data.

9. International transfers

Data may be processed outside your country by our providers. Where required, transfers are covered by appropriate safeguards such as the UK/EU Standard Contractual Clauses or an adequacy decision.

10. Your rights — UK & EU (GDPR / UK GDPR)

You have the right to access, correct, delete, restrict, or object to processing of your personal data, to data portability, and to withdraw consent. You can complain to your supervisory authority (in the UK, the ICO). To exercise these rights, contact privacy@yontosales.com.

11. Your rights — United States (CCPA / CPRA)

If you are a California resident, you have the right to know what personal information we collect, to access and delete it, to correct it, and to opt out of "sale" or "sharing". We do not sell or share personal information as those terms are defined under the CCPA/CPRA, and we do not use it for cross-context behavioural advertising. We will not discriminate against you for exercising your rights.

12. Other regions

Customers and visitors in Canada, Australia, and New Zealand have rights under their local laws (PIPEDA, the Australian Privacy Act, and the New Zealand Privacy Act). Contact us to exercise any of them and we will respond as those laws require.

13. Contact

Privacy questions or requests: privacy@yontosales.com.