Privacy Policy
Effective Date: April 26, 2026
This Privacy Policy ("Policy") describes how YakLedger ("Company," "we," "us," or "our") collects, uses, discloses, and protects personal information in connection with the YakLedger platform, including the websites located at yakledger.com, app.yakledger.com, and api.yakledger.com (collectively, the "Service"). By accessing or using the Service, you ("User," "you," or "your") consent to the practices described in this Policy.
Section 1 — Definitions
"Personal Information" means any information that identifies, relates to, describes, or could reasonably be linked to you or your household, including but not limited to name, email address, IP address, and financial transaction data.
"Third-Party Platforms" means external services you connect to the Service, including but not limited to Shopify, Klarna, NetSuite, and Global-e.
"Tenant" means the organizational entity under which your account is registered.
Section 2 — Information We Collect
2.1 Information You Provide Directly
- Account registration information: name, email address, password, and company name.
- Demo request information: name, email address, and company name.
- Integration credentials: API keys and access tokens for Third-Party Platforms, which are encrypted at rest.
- Communications: information you provide when contacting us for support or feedback.
- Payment information: billing details processed by our payment provider (we do not store full payment card numbers).
2.2 Information Collected Automatically
- Usage data: pages visited, features accessed, actions performed, and timestamps.
- Device information: browser type, operating system, IP address, and device identifiers.
- Server logs: request URLs, HTTP methods, response codes, and error messages.
2.3 Information from Third-Party Platforms
When you connect Third-Party Platforms to the Service, we access and store data from those platforms solely as necessary to provide the Service, including:
- Shopify: payout records, order data, transaction details, line items, and balance transactions.
- Global-e: cross-border transaction records, payout data, and settlement details.
- BNPL providers (e.g., Klarna): settlement records, payout amounts, fees, and payment references.
- NetSuite: journal entries, bank deposits, and GL account mapping configurations.
Section 3 — Use of Information
We use the information we collect for the following purposes:
- To provide, operate, maintain, and improve the Service.
- To synchronize and reconcile payment data across your connected platforms.
- To generate reports, CSV exports, and email notifications at your request.
- To authenticate your identity, manage access controls, and enforce role-based permissions.
- To send transactional communications, including export download links, sync notifications, and demo request confirmations.
- To respond to your support requests and other communications.
- To monitor usage patterns and analyze performance for service improvement.
- To detect, investigate, and prevent security incidents, fraud, and abuse.
- To comply with applicable legal obligations, regulations, and legal processes.
Section 4 — Disclosure of Information
We do not sell, rent, or trade your Personal Information. We may disclose your information in the following circumstances:
- Service Providers. We share information with third-party vendors who perform services on our behalf, including Google Cloud Platform (hosting, storage, artificial intelligence), SendGrid (email delivery), and Vercel (website hosting). These providers are bound by contractual obligations to protect your data and use it solely to provide services to us.
- Third-Party Platforms. When you connect Third-Party Platforms, we transmit data to and from those platforms as directed by you and solely to provide the Service.
- Legal Requirements. We may disclose information when required by law, regulation, subpoena, court order, or other governmental authority.
- Business Transfers. In connection with a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of the transaction. We will notify you of any such transfer.
- Protection of Rights. We may disclose information to enforce our Terms of Service, protect our rights and property, or protect the safety of our users or the public.
Section 5 — Data Security
We implement commercially reasonable administrative, technical, and physical safeguards to protect your Personal Information, including but not limited to:
- Encryption of data in transit (TLS 1.2+) and at rest (AES-256).
- Storage of API credentials and secrets in Google Cloud Secret Manager.
- Multi-tenant architecture with strict database-level tenant isolation.
- Role-based access controls with four permission levels: owner, admin, member, and viewer.
- Optional two-factor authentication (TOTP) for all user accounts.
- JWT-based session management with configurable token expiration.
Notwithstanding the foregoing, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security of your information.
Section 6 — Data Retention
- Account data: retained for the duration of your active account. Deleted upon written request following account closure.
- Financial data: payout, settlement, and reconciliation records retained for the duration of your subscription plus ninety (90) days.
- CSV exports: stored in Google Cloud Storage for thirty (30) days, then automatically and permanently deleted.
- Server logs: retained for up to twelve (12) months for security, debugging, and audit purposes.
- Demo request data: retained for up to twenty-four (24) months or until you request deletion, whichever occurs first.
Section 7 — Your Rights
Subject to applicable law, you may exercise the following rights with respect to your Personal Information:
- Right of Access. Request a copy of the Personal Information we hold about you.
- Right of Rectification. Request correction of inaccurate or incomplete information.
- Right of Erasure. Request deletion of your Personal Information, subject to legal retention obligations.
- Right of Portability. Request your data in a structured, commonly used, machine-readable format.
- Right to Restrict Processing. Request that we limit the processing of your information in certain circumstances.
- Right to Object. Object to the processing of your information for specific purposes.
- Right to Withdraw Consent. Where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, submit a written request to hello@yakledger.com with the subject line "Privacy Request." We will verify your identity and respond within thirty (30) days.
Section 8 — Do Not Sell or Share My Personal Information
YakLedger does not sell, rent, or share your Personal Information with third parties for their direct marketing purposes. We do not participate in data brokering activities.
Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA"), California residents have the right to opt out of the "sale" or "sharing" of their Personal Information. Because YakLedger does not engage in such activities as defined under the CCPA, no opt-out mechanism is required. Notwithstanding, you may submit inquiries or requests to hello@yakledger.com.
Section 9 — Cookies and Tracking Technologies
The Service uses minimal client-side storage for essential functionality:
- Authentication token: stored in browser localStorage to maintain your authenticated session.
- Theme preference: stored in browser localStorage to persist your display mode selection (light, dark, or system).
We do not deploy third-party advertising cookies, cross-site tracking technologies, or behavioral analytics pixels.
Section 10 — International Data Transfers
Your information may be transferred to, stored in, and processed in countries other than your country of residence, including the United States, where our infrastructure is hosted on Google Cloud Platform. We ensure that appropriate safeguards are in place, including Standard Contractual Clauses where required, to protect your information in accordance with applicable data protection laws.
Section 11 — Children's Privacy
The Service is not directed to individuals under the age of eighteen (18). We do not knowingly collect Personal Information from children. If we become aware that we have collected Personal Information from a child under 18, we will take reasonable steps to delete such information promptly.
Section 12 — Amendments
We reserve the right to amend this Policy at any time. Material changes will be communicated by posting the revised Policy on our website and updating the Effective Date above. Your continued use of the Service following the posting of changes constitutes your acceptance of such changes.
Section 13 — Contact Information
For questions, concerns, or requests relating to this Policy, contact:
YakLedger
Email: hello@yakledger.com
Web: yakledger.com