Privacy Policy

Data Controller (for merchant accounts and website visitors):

EU Operations:

2.1 EU GDPR — Direct Application

Because we offer services to merchants and process data of individuals in the EU/EEA, the EU General Data Protection Regulation (Regulation (EU) 2016/679 — GDPR) applies directly to our processing activities under Article 3(2) GDPR (extra-territorial scope — offering services to data subjects in the Union). Our lead EU supervisory authority is the Autoriteit Persoonsgegevens (AP) in the Netherlands.

2.2 Uganda Data Protection and Privacy Act 2019 (DPPA)

As a company incorporated in Uganda, we are also bound by the Data Protection and Privacy Act, 2019 (Act No. 9 of 2019, Cap. 97) and the Data Protection and Privacy Regulations, 2021 (SI No. 84 of 2021), supervised by the Personal Data Protection Office (PDPO) under NITA-U.

Gaia Holdings Limited is in the process of completing registration with the PDPO and will publish the registration reference upon confirmation.

4.1 Merchant Account and Registration Data

When a Shopify merchant registers for Yield Force, we collect:

• Identity data: Full name, business name, Shopify store URL, country.
• Contact data: Business email address, support contact details.
• Billing data: Subscription tier and, for directly invoiced clients, billing address and VAT/tax identification number. For Shopify merchants, subscription billing is handled by Shopify; Yield Force does not receive or store payment card details.
• Credential vault data: WhatsApp Business Account (WABA) IDs, Phone Number IDs, Meta System User Tokens, Shopify API access tokens, and (where a business connects its Google Ads account) Google OAuth tokens — stored in an encrypted, per-tenant credential vault using a Bring-Your-Own-Key (BYOK) architecture.
• Technical and security logs: IP addresses, browser user-agent strings, login timestamps, API call logs.

4.2 Website Visitor Data

When you visit yieldforce.dev, we may collect:

• Contact form submissions: Name, business email, message content.
• Technical data: Server access logs (IP address, referrer, page path, timestamp) retained for security purposes. We do not deploy analytics trackers, marketing pixels, or behavioural cookies.

4.3 Children

Our website and merchant dashboard are intended for businesses and are not directed at children. We do not knowingly collect personal data from children through them. Messages that shoppers send to a merchant are controlled by that merchant (see Section 3). If you believe a child has given us personal data, email dev@yieldforce.dev and we will delete it.

5.1 Under EU GDPR (Article 6)

5.2 Under Uganda DPPA (Section 7)

Processing of personal data of Ugandan data subjects is based on:

• Section 7(2)(b) DPPA: Contractual necessity — for performance of our service agreements with Ugandan merchant clients.
• Section 7(2)(a) DPPA: Legal authorisation — where processing is required or authorised by Ugandan law.
• Section 7(1) DPPA: Informed consent — where none of the above grounds apply.

5.3 We never sell data

We never sell data. This applies to all data we hold, including data received through our Meta, Shopify and Google integrations.

6.1 AI Models Used

Yield Force uses Google Vertex AI, with processing in the United States, to power intent classification, natural language response generation, sentiment analysis, and escalation detection.

6.2 No Training on Customer Data

6.3 GDPR Article 22 — Automated Decision-Making

Yield Force's AI engine assists merchants with automated conversational routing and draft response generation. It does not make automated decisions that produce legal effects or similarly significantly affect individuals within the meaning of GDPR Article 22(1). Merchant administrators retain full supervisory control and override capability over all automated outputs via the Zone 5 Governance Portal.

10.1 Netherlands (EU) → Uganda

Uganda has not received an adequacy decision from the European Commission (GDPR Art. 45). Transfers of EU personal data to Gaia Holdings Limited in Uganda are therefore governed by:

• EU Standard Contractual Clauses (SCCs) — Commission Implementing Decision (EU) 2021/914, Module 2 (Controller-to-Processor) or Module 1 (Controller-to-Controller) as applicable; and
• A documented Transfer Impact Assessment (TIA) in accordance with Schrems II (Case C-311/18) and EDPB Recommendations 01/2020, including encryption in transit (TLS 1.3) and at rest (AES-256), with cryptographic keys managed within the EU or by an independent EU custodian.

10.2 Uganda → Netherlands (EU)

Transfers of personal data from Uganda to the Netherlands are authorised under Section 19(a) of the DPPA 2019, on the basis that the Netherlands (as an EU Member State subject to the GDPR and UAVG) provides data protection standards that meet or exceed those of the DPPA. We maintain a documented adequacy assessment on file for PDPO inspection purposes (DPPR Reg. 30(5)).

10.3 Where Data Is Hosted

Servers: Paris, France. Database: Stockholm, Sweden. AI processing (Google Vertex AI) and document staging (Google Cloud Storage): United States. Cross-border processing to Uganda consists primarily of operational access for platform administration, subject to the safeguards in §10.1.

13.1 Rights Under EU GDPR (Articles 15–22) — EU/EEA Data Subjects

13.2 Rights Under Uganda DPPA — Ugandan Data Subjects

• Right to prevent processing causing damage or distress (DPPA ss.20–21)
• Right to object to direct marketing processing (DPPA s.22)
• Right to rectification, blocking, erasure, or destruction of inaccurate or unlawfully held data (DPPA s.23)
• Right of access to personal data held (DPPA s.24)

14.1 No Tracking Cookies

Yield Force does not use advertising cookies, marketing pixels, tracking beacons, Google Analytics, Meta Pixel, or any third-party behavioural analytics tools on our website or platform.

Because we do not store non-essential cookies, no cookie consent banner is required under Article 11.7a of the Dutch Telecommunications Act (Telecommunicatiewet — Tw) or the EU ePrivacy framework. Enforcement in the Netherlands falls under the Autoriteit Consument & Markt (ACM) and the Autoriteit Persoonsgegevens (AP).

14.2 Strictly Necessary Storage Only

We use only the following essential session technologies: