Data Handling Disclosure
This technical disclosure outlines the architecture, channels, data flows, storage security, access controls, and deletion mechanisms implemented by Yield Force for compliance review with Meta, TikTok, LinkedIn, and Shopify platform partner programs.
1. Data Collected Per Connected Channel
Yield Force ingests only scopes strictly required for real-time customer conversation resolution and order lookup:
WhatsApp & Meta Channels
Scope: WhatsApp Cloud API, Instagram Messaging, FB Messenger
- Inbound customer message bodies, media attachments, timestamps
- Delivery receipts and message status updates (sent, delivered, read)
- Customer telephone numbers (hashed/masked in audit logs) and sender IDs
- Merchant WhatsApp Business Account (WABA) IDs and phone number IDs
Shopify Storefront & Admin
Scope: read_orders, read_products, read_inventory
- Order identifiers, fulfillment status, and carrier tracking links
- Product catalog details (titles, variants, pricing, inventory levels)
- Store policy URLs (returns, shipping terms, FAQ guidelines)
- Zero payment credentials or credit card PANs are ever accessed or stored
TikTok For Business
Scope: Lead Generation API, Campaign Reporting
- Aggregated campaign ad metrics (impressions, clicks, conversions)
- Instant Lead Form webhook payloads for automated conversation dispatch
- Lead timestamps and basic lead submission attributes
LinkedIn Marketing Solutions
Scope: Lead Gen Forms API, Ad Analytics
- Aggregated campaign performance metrics and engagement figures
- Lead Gen Form submission data for automated routing to merchant CRM
- Form metadata and consent timestamps
2. Storage, Cryptography & Encryption Standards
Encryption at Rest
All relational databases, conversational transcripts, vectors, and backups are encrypted at rest using industry-standard AES-256 encryption via hardware security modules (HSM) managed within our Supabase EU infrastructure.
Encryption in Transit
All data in transit across public networks is enforced via modern TLS (TLS 1.2 / TLS 1.3) cryptographic protocols with Perfect Forward Secrecy (PFS). Unencrypted plaintext HTTP traffic is strictly prohibited and automatically redirected.
Geographic Region
Database and backend hosting cluster: European Union (Frankfurt / Ireland). LLM inference: Google Cloud Vertex AI (europe-west1).
3. Access Controls & Sovereign Multi-Tenancy
Yield Force enforces database-level isolation between merchants through PostgreSQL Row-Level Security (RLS):
- Tenant Partitioning via
sovereign_key: Every database query is scoped by an immutable, cryptographically generated sovereign key. Cross-tenant queries are rejected at the PostgreSQL query engine layer. - Zero Cross-Tenant Access: Merchant A's conversational threads, orders, and knowledge embeddings can never be accessed, queried, or leaked to Merchant B.
- Zero Model Training on Merchant Data: Merchant conversations and customer queries are never used to train or fine-tune public baseline LLMs. Prompts are ephemeral and processed in isolated inference containers.
4. Data Deletion & GDPR Cascade Purge
We provide automated, end-to-end data erasure capabilities honoring merchant control and individual data subject requests:
- Merchant App Uninstall: Receipt of Shopify's
app/uninstalledwebhook triggers an automated GDPR cascade delete. All merchant credentials, active sessions, conversation logs, and catalog cache are permanently purged within 48 hours. - Shopify Mandatory GDPR Webhooks: Yield Force natively processes
customers/data_request,customers/redact, andshop/redactwebhooks with cryptographic receipt logging. - Configurable Retention: Conversations expire and are permanently purged after 90 days by default, or immediately upon ticket resolution if configured by the merchant.
5. Subprocessors Reference
Below is the verified registry of infrastructure partners utilized by Yield Force:
| Subprocessor Name | Function & Purpose | Hosting Region | DPA Reference |
|---|---|---|---|
| Supabase Inc. | Primary relational database, tenant auth, row-level security | EU Region (Frankfurt / Ireland) | supabase.com/legal/dpa |
| Google Cloud (Vertex AI) | LLM inference, embeddings generation (Stateless processing) | europe-west1 (Belgium) | cloud.google.com/terms/dpa |
| Resend Inc. | Transactional system notifications and merchant alerts | US / Global (Standard Contractual Clauses) | resend.com/legal/dpa |
| Cloudflare Inc. | Edge routing, Web Application Firewall (WAF), DNS, DDoS protection | Global Edge Network (EU Data Localization) | cloudflare.com/dpa |
6. Security & Vulnerability Reporting Contact
For security audits, platform compliance documentation, or vulnerability disclosure under responsible disclosure guidelines, please contact our security team directly:
Security & Data Protection Officer Contact: dev@yieldforce.dev
Operating Company: Gaia Holdings Limited
Governing Law: England and Wales
PGP encryption key available upon email request.