Draft — pending legal review. These documents are provided for transparency and are not yet in force. They must be reviewed by a qualified solicitor before Yonto takes any payment. Do not rely on them until then.

Privacy Policy

Last updated: 22 October 2026 · v2026-10-22

This explains what data Yonto collects and why — described from what the product actually does, not boilerplate. It covers your account data, the creator details you supply, and the visitor data we process on your behalf.

Yonto is operated by Mohamed Shill, trading as Yonto Sales — see the Terms for full operator details.

What Yonto is built not to do

We do not build cross-site profiles of shoppers, we do not collect their names, emails, addresses or the items they bought, and we do not store IP addresses to identify people. Attribution runs on a single random identifier and a small set of commercial figures.

1. Two roles: your account vs. your visitors

For your account data (your name, email, business details, billing), Mohamed Shill, trading as Yonto Sales is the data controller.

For the visitor, order and creator data we process so you can attribute sales on your own store, you are the controller and Yonto is your processor, acting on your instructions. Business customers should also read the Data Processing Addendum.

When a shopper follows a creator's tracked link, we record the click:

a random click identifier (a "click_id") — an opaque random string, not derived from the person;
which campaign the link belongs to, and the time;
the shopper's browser type (the "user agent" their browser sends) and the page they came from (the "referrer"), as their browser reported them.

We then send the shopper on to your store with the click identifier added to the address. The tracked link itself sets no cookie. What happens to the identifier next depends on your store:

On stores that run our pixel, the pixel keeps it in a first-party cookie on your website for 30 days, so a later purchase can be linked to the click.
On Shopify stores using our custom pixel, it is kept in your store's browser storage — and only if the shopper has allowed analytics.
Otherwise it travels with the order itself (on Shopify, in the address the shopper landed on) and nothing is stored on the shopper's device.

We do not record the shopper's IP address with the click, and we do not combine the click with data from other sites to build a profile. Like any website, our hosting provider's request logs briefly record IP addresses for security and operations. Every cookie and stored item is listed in the Cookie Notice.

3. The pixel is a no-op for everyone else

On sites that install our optional pixel, the script does nothing for visitors who did not arrive through a creator's tracked link. If there is no Yonto referral present, the conversion function simply returns and sends no data. Only visitors a creator actually referred are ever measured.

For a visitor who did arrive through a tracked link, the pixel sends us one message as they land: the campaign's code and the click identifier we issued for that click, and nothing about the page or the visitor. We keep only the time it arrived, against the campaign, so your dashboard can show that the pixel is installed and working.

4. Shopify data we receive, and what we keep

Shopify sends us the whole order. We keep only what credits a creator, and discard the rest.

When you connect Shopify, it notifies us of every new order in your store, and of every refund. Shopify decides what that notification contains, and it is the full order: the customer's name, email address, phone number, billing and shipping addresses, the items bought, the order total, any discount codes, the page the shopper landed on, and technical details such as their IP address.

We use the discount code and the landing page to work out whether a creator sent that shopper. Then:

If the order came through a creator, we keep the order number as your store shows it (such as #1012) and Shopify's own ID for the order, the order total and its currency, which creator's campaign it was credited to, and — when the shopper arrived through the creator's tracked link — the random click identifier from that link (see clause 2).
If it did not, we keep nothing from that order. We note only the time Shopify's notification arrived, one value per store that each new order overwrites, so your dashboard can show when your store last sent us an order. Refund notifications are timed the same way.
For a refund of a creator's sale, we keep the refund's number and amount, and which sale it reverses.

Everything else in the notification — the customer's name, email, phone, addresses, the items and their IP address — is discarded as soon as the order has been checked. It is not stored, not written to our logs, and not passed to anyone.

Separately, to show how many of your store's orders were credited to a creator, we ask Shopify how many orders your store has received since you connected it. That is a single number, with no detail about any order or customer.

5. Data your own systems send us

If you report conversions from your own backend using our server-side API, rather than from a shopper's browser, the request carries only five things: the campaign's tracking code, your own order identifier, the order value, the currency, and — where you captured it — the click identifier from the tracked link.

No shopper personal data travels on this route. The endpoint has no field for a customer's name, email address, postal address or payment details; there is nowhere to put them, so they cannot reach us this way even by mistake. Your order identifier is your own reference for an order, not an identifier of the person who placed it.

Because the call comes from your server and not from a shopper's device, this route sets no cookie and reads none, and the IP address it arrives from is your server's rather than any shopper's. We process that address only to secure the endpoint and apply rate limits.

6. Creator details you give us

When you create a campaign you supply details about the creator you are working with. We store the creator's name, their handle and platform, a normalised copy of that handle used to recognise the same creator across your own campaigns, and — optionally — their email address.

The email address is used for one thing: sending that creator their tracked link and discount code, when you choose to send it. It is never shown on a report. The creator's name and handle are, because a report about a creator's performance has to say which creator it is about.

These are details about someone who is usually not our customer, so you are responsible for having a lawful basis to give them to us. A creator who wants to know what we hold, or wants it removed, can contact us at privacy@yontosales.com and we will pass the request to the business that entered them, which is the controller.

7. Account and billing data

To run your account we process your name, work email, business name, and settings. Payments are handled by our payment provider acting as merchant of record; they process your billing details — we do not store card numbers.

We send the account owner three kinds of email, and no others: a welcome email when the account is created, a reminder before a free trial turns into a paid subscription, and a notice if a payment fails. They go to the email address you sign in with. For each one sent we keep a short record — which email, the address it went to, and when — so that the same email is never sent twice. We do not send marketing email, and nothing is sent per click or per sale.

8. Reports and PDF exports

A report is a page at an unguessable link that you choose who to send to. It shows the creator's name and handle, the campaign name, and that campaign's attributed figures. Anyone holding the link can see it until you revoke it, at which point it stops working immediately. Report links are never indexed by search engines.

When a report is downloaded as a PDF, the page is rendered by a third-party document renderer. It is given a short-lived signed link rather than your share link, it receives only what the report displays, and it retains nothing afterwards. It is named in the DPA.

9. Legal bases (UK/EU GDPR)

Contract — to provide the Service you signed up for.
Legitimate interests — to secure, maintain and improve the Service, and to measure attribution on your instruction as your processor.
Legal obligation — to meet tax and accounting requirements.

Where your own site relies on visitor consent for cookies, you are responsible for obtaining it. See the Cookie Notice.

10. Retention and deletion

We keep your records until you delete them

Campaigns, clicks and conversions are kept for as long as your account exists, including after you cancel a subscription, so that your attribution history is still there if you come back. Nothing is deleted automatically after a set period. Records are deleted when you, or the business that entered them, ask for that:

One business at a time: deleting a business in Settings permanently deletes its campaigns, clicks, conversions, report links and tracking domain, straight away.
Your whole account: email privacy@yontosales.com and we will delete it, and everything in it, within one month.

We keep billing and tax records for as long as the law requires even after an account is deleted. Deleted data can persist in our hosting provider's routine backups until those backups expire on its own schedule; it is not restored from them.

Revoking a report link takes effect on the next request, not on a schedule. The click cookie, on stores that use our pixel, expires on the shopper's device after 30 days.

11. How we protect it

Encryption in transit; access scoped so each business can only reach its own data; least-privilege access to production; and secrets held outside the codebase. Report links use high-entropy tokens that are not enumerable, and are revocable.

The strongest protection is what we decided not to collect. Because there are no shopper names, emails, addresses, card numbers or line items in the system, the data at risk in a worst case is small by design rather than by policy.

We share data only with the processors that run the Service — our hosting/database provider, our email provider, our payment provider, and the document-rendering provider that produces a PDF when a report is downloaded — under contract, and where required by law. They are listed by name in our DPA. We do not sell personal data.

13. International transfers

Data may be processed outside your country by our providers. Where required, transfers are covered by appropriate safeguards such as the UK/EU Standard Contractual Clauses or an adequacy decision.

14. No automated decision-making

We do not carry out automated decision-making producing legal or similarly significant effects, and we do not profile individuals. Yonto counts what happened and reports it; any decision about a creator, a campaign or a budget is made by you.

15. Children

The Service is for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child's data has reached us — for example as a creator on a campaign — contact us and we will delete it.

16. Your rights — UK & EU (GDPR / UK GDPR)

You have the right to access, correct, delete, restrict, or object to processing of your personal data, to data portability, and to withdraw consent. You can complain to your supervisory authority (in the UK, the ICO). To exercise these rights, contact privacy@yontosales.com. We aim to respond within one month, which is the period the GDPR allows.

17. Your rights — United States (CCPA / CPRA)

If you are a California resident, you have the right to know what personal information we collect, to access and delete it, to correct it, and to opt out of "sale" or "sharing". We do not sell or share personal information as those terms are defined under the CCPA/CPRA, and we do not use it for cross-context behavioural advertising. Where we act for a business customer we do so as a service provider under the CCPA, processing only on that customer's documented instructions. We will not discriminate against you for exercising your rights.

18. Other regions

Customers and visitors in Canada, Australia, and New Zealand have rights under their local laws (PIPEDA, the Australian Privacy Act, and the New Zealand Privacy Act). Contact us to exercise any of them and we will respond as those laws require.

19. Changes to this policy

If we change what we collect or why, this page changes and the date at the top moves. Where a change is material we will take reasonable steps to tell you before it takes effect, rather than relying on you to re-read the page.

20. Contact

Privacy questions or requests: privacy@yontosales.com. The data controller for your account data is Mohamed Shill, trading as Yonto Sales, a sole trader, of 4 Utopia Court, Station Road, Harrow HA2 6BT, United Kingdom.