Department 9
Security, privacy and legal
- 9.1Privacy policyThe final policy, in plain wordsOur privacy page is a short preview, and the code does moreDraft
- 9.2Terms of serviceThe final termsSeven preview paragraphs today, full terms drafted and waiting for a lawyerDraft
- 9.3Data processing agreementFor partner brandsNo partner has a data processing agreement, so we drafted oneNeeds you
- 9.4SubprocessorsEvery vendor that touches data, why, whereTen outside companies touch brand data; the privacy page names someDraft
- 9.5Retention and deletionWhat we keep, how long, how to deleteMost brand data is kept until someone asks us to delete itDraft
- 9.6Access rulesWho opens what: domains, invites, guests, staffA brand opens only to its own people, and staff see everythingDraft
- 9.7Platform complianceShopify app review, Meta app review, Google OAuth scopesGoogle is verified, Shopify and Meta are still waiting on reviewersDraft
- 9.8Claims policyWhat claims a brand may make and whyA draft may promise only what the brand can already proveDraft
- 9.9Security practicesAuth, sessions, secrets, least access, audits doneLocks are solid for five partners; four loose ends remainDraft
- 9.10Incident responseBreach steps, who to tell, timelinesNo breach runbook exists, so we drafted one with 72 hoursNeeds you
- 9.11Trademark and IPThe name, the characters, rights to generated artNothing is trademarked yet, and the public name is still openNeeds you
- 9.12Company entity and filingsThe legal entity, registrations, GST, annual filings, who holds whatYellow Monk Technologies LLP is on record; its filings mostly are notNeeds you
- 9.13Contracts registerEvery signed agreement: partners, vendors, contractors, NDAs, with renewal datesNo signed agreement is on record with anyone, only online termsNeeds you