Legal

Privacy Policy

Last updated 18 July 2026

1. Who we are and how to contact us

AskYara ("AskYara", "we", "us", "our") is an AI-powered business command centre for Shopify store owners, provided at askyara.io.

AskYara is operated by AskYara Ltd, a company registered in England and Wales under company number 17276111, with its registered address at 36 The Larches, London, United Kingdom, N13 5AX.

For any question about this Privacy Policy or how we handle your data, contact us at hello@askyara.io.

Our ICO registration has been submitted (application reference C1986999); the final registration number will be added here once issued.

2. What data we collect and why

We collect different categories of data depending on how you use AskYara.

2.1 Account and subscription data

• Full name and email address, collected to create and manage your account (lawful basis: performance of a contract, UK GDPR Article 6(1)(b)).
• Business name and Shopify store URL, collected to connect your store (Article 6(1)(b)).
• Payment card details, processed and stored by our payment processor. We do not store your raw card data ourselves (Article 6(1)(b)).
• Subscription tier and billing history, used to administer your account (Article 6(1)(b)).

2.2 Business and operational data

When you connect a third-party tool to AskYara, we process data from that tool on your behalf so that Yara can answer your questions and generate your briefings. This includes, depending on which integrations you enable — some available today, others planned:

• Shopify (available): orders, revenue, inventory levels, disputes, fulfilment status, discount codes, and customer data contained in order records.
• Gmail (planned, via OAuth): email content from your inbox, such as supplier threads and customer escalations.
• Meta Graph API (planned): Instagram and Facebook ad performance data.
• Klaviyo or Omnisend (planned): email marketing campaign and list data.
• Google Calendar (planned): event titles, dates, and descriptions.
• Google Analytics 4 (planned): website traffic and conversion data.

We process this data as a data processor on your behalf (see Section 4 and the Data Processing Agreement in our Terms of Service). You remain the data controller for this data.

2.3 Usage and technical data

• Log data such as your IP address, browser type, pages visited, and timestamps, collected to operate and secure the service (Article 6(1)(f), legitimate interests).
• Device identifiers, collected for the same reason.
• In-app activity, such as questions you ask Yara, features you use, and briefings you view, collected to operate and improve the service (Article 6(1)(f)).

We do not knowingly collect special category data under Article 9 of the UK GDPR. If special category data is present within data you connect to AskYara (for example, in email content), we process it only as your processor, on your instructions, and take no independent action on it.

3. How we use data

We use the data described above to:

• Provide, operate, and maintain the AskYara service.
• Generate your daily briefing and answer questions you ask Yara.
• Process payments and manage your subscription.
• Communicate with you about your account, including service and billing notices.
• Monitor, secure, and improve the service.
• Comply with our legal obligations.

4. Who we share data with

We share data with the following sub-processors, each of whom is bound by contractual obligations to protect your data:

We do not sell your personal data. We may disclose data where required by law, to protect our rights, or in connection with a merger, acquisition, or sale of assets, in which case we will notify you.

5. International data transfers

Anthropic, Shopify, Apple, and Google are based in the United States. Because the United Kingdom is not part of the European Union, transfers of personal data from the UK to these providers are governed by the UK International Data Transfer Agreement (IDTA) or equivalent Standard Contractual Clauses. We put appropriate safeguards in place before any such transfer occurs.

6. How long we keep data

We retain personal data for as long as your account is active, and for 90 days afterwards, unless a longer period is required by law (for example, for tax or accounting records). Business and operational data processed on your behalf is retained according to your instructions and deleted or returned in line with the Data Processing Agreement in our Terms of Service.

7. Your rights

Under the UK GDPR, you have the right to:

1. Access the personal data we hold about you.
2. Request rectification of inaccurate data.
3. Request erasure of your data, subject to legal exceptions.
4. Request restriction of processing.
5. Request portability of your data in a structured, commonly used format.
6. Object to processing based on legitimate interests.
7. Withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, contact us at hello@askyara.io.

8. How to complain

If you are unhappy with how we handle your data, please contact us first at hello@askyara.io so we can try to resolve it. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, or at ico.org.uk.

9. Cookies

askyara.io does not currently use third-party advertising or tracking cookies. If we add analytics (such as Google Analytics 4) in future, this section will be updated to describe those cookies and how you can manage your preferences.

10. How we protect data

We use industry-standard technical and organisational measures to protect your data, including encryption in transit, access controls, and regular security review.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or in-app notice before they take effect. The "Last updated" date at the top of this policy reflects the date of the most recent version.