Privacy Policy

Data controller / app provider: Wuhan Yaoyu Technology Co., Ltd. (“Termswell”, “we”, “us”)
Contact: contact@yaoyulabs.com

1. Scope

This policy explains how the Termswell Shopify app processes personal data of a merchant's customers, prospective customers (wholesale applicants), and store visitors. Termswell is a B2B wholesale pricing, credit-control, and receivables app installed by merchants on their Shopify stores. We process personal data only to provide the merchant-requested functionality and act as a data processor on behalf of the installing merchant (the data controller for their customers' data).

2. What personal data we process

We process the minimum data required for the app's functionality:

We do not collect payment card data, bank-account data, or government-issued identity documents. Payments and checkout remain within Shopify.

3. Why we process it

• App functionality: verify wholesale applicants, provision approved applicants as Shopify Companies / Company Contacts / Company Locations, apply group pricing and payment terms.
• Store management: calculate receivables and credit exposure, and support merchant review of B2B orders.

We do not use personal data for advertising, behavioral profiling, resale, or training public machine-learning models.

4. Legal basis and consent

We process personal data on behalf of the installing merchant to provide contracted functionality. We respect and honor customer consent and opt-out decisions communicated to us by the merchant or through Shopify, including do-not-sell requests (we do not sell data in any case).

5. Data sharing (subprocessors)

We share data only with subprocessors necessary to operate the service:

• Fly.io — application hosting and managed PostgreSQL database (data storage, encrypted in transit and at rest).
• Resend — transactional email delivery (application receipts, approval notices, verification codes).

We do not sell personal data or share it with any party for advertising.

6. Data retention

• Unverified wholesale applications are automatically deleted after 72 hours.
• Verified application and operational data is retained while the app is installed and the merchant uses the related functionality.
• On a Shopify customers/redact or shop/redact request, we delete or irreversibly anonymize app-controlled personal data.
• One-time verification codes are never stored in plaintext (stored as salted SHA-256 hashes) and are short-lived.

7. Security

• Data encrypted in transit (HTTPS/TLS enforced) and at rest (managed database encryption).
• Verification codes stored only as salted hashes; never logged in plaintext.
• Access to production data is limited to authorized personnel; production and development/test data are kept separate.
• Anti-abuse controls on the application endpoint (rate limiting; IP stored only as SHA-256 hash).

8. Your rights / requests

Merchants and their customers may request access, export, correction, or deletion of personal data. We support Shopify's mandatory data-request and redaction webhooks (customers/data_request, customers/redact, shop/redact) and provide merchant data export. Requests can be sent to the contact email and are processed within applicable legal deadlines.

9. International transfers

Data is hosted on Fly.io infrastructure (primary region: Singapore). Where data is transferred across borders, it is protected by the security measures described above and the terms agreed with our subprocessors.

10. Changes

We may update this policy; the “Last updated” date reflects the latest version. Material changes will be communicated to installing merchants.

11. Contact

Wuhan Yaoyu Technology Co., Ltd. — contact@yaoyulabs.com