Draft for review by ALIAO GROUP LTD. Not yet final.
Draft for review. Yeya is software operated by ALIAO GROUP LTD, a company registered in England and Wales (“we”). This notice explains what personal data the Yeya platform and the Yeya terminal app handle and why. We act as a processor for the Yeya partners and merchants who use the service, and as a controller for our own account, billing and security records.
What we hold
- Account details for partner, merchant and staff users: name, work email, company, role, hashed password and two-step sign-in settings.
- Records of payments taken through Yeya: amounts, tips, times, references, outcomes (approved, declined, cancelled, refunded), the device that took them, fees and the card scheme, last four digits and issuing bank reported by Viva.com. We never receive or store full card numbers, expiry dates or PINs.
- Security and audit records: sign-ins, IP addresses and the actions users take in the portals.
The Yeya terminal app
The Yeya app runs on card terminals used by businesses. Customers tap, insert or swipe their card in the viva.com Terminal app, which is provided by Viva Wallet.com Ltd; card data goes straight to Viva and never passes through the Yeya app or our servers. The Yeya app collects:
- Device identifiers: the terminal’s model and manufacturer serial number, and a Yeya device token issued when the terminal is paired with a business.
- Device health reports sent while the app runs: app and Android versions, battery level and charging state, network state, kiosk state, uptime and the installed viva.com Terminal app version.
- Sale details entered on the terminal: the amount, tip, optional reference and the outcome Viva reports back.
- Manager PINs used to approve refunds, which we store only as one-way (bcrypt) hashes.
- A customer’s email address or mobile number, only when the customer asks for a receipt that way.
The app contains no advertising and no third-party analytics or tracking SDKs. It does not use location, the camera, the microphone or contacts.
Why we hold it
To provide the platform under our contract with the partner (UK GDPR Article 6(1)(b)), to keep terminals and accounts secure and detect faults (our legitimate interests, Article 6(1)(f)), to bill partners, and to meet our legal and accounting obligations (Article 6(1)(c)).
Who else is involved
Card payments are processed by Viva Wallet.com Ltd, authorised by the FCA as an Electronic Money Institution (FRN 989273), which is responsible for card data and settlement under its own terms. We use these providers to run the service:
- Neon (database hosting, London region)
- Fly.io (application servers)
- Vercel (web portal hosting)
- Cloudflare (DNS and network security)
- Resend (email delivery for receipts, invoices and sign-in)
- Viva.com (card payment processing, as above)
Where a provider processes data outside the UK we rely on UK adequacy regulations or the ICO’s International Data Transfer Addendum. We do not sell personal data.
How long we keep it
Payment and billing records: six years after the end of the financial year they relate to, for tax and accounting. Device health reports and security logs: up to 12 months. Account details: while the account is active, then deleted or anonymised within 90 days of closure unless the law requires us to keep them longer.
Your rights
Under UK GDPR you can ask for access to, correction of, deletion of or a copy of your data, and object to or restrict how we use it. If your data was collected by a business using Yeya, you can also ask that business. Contact us at hello@yeya.co.uk. You can complain to the Information Commissioner’s Office at ico.org.uk.