Privacy Policy

This Privacy Policy is from Shipton Light Industries ("we", "us", "our"), a business based in British Columbia, Canada. It explains what personal information we collect, why, who we share it with, and the choices you have when you:

• Visit yven.ca or any other site of ours that links here
• Use Yven, our service for solo web shops (the "Service")
• Download a free template, email us, or send us feedback

Questions? Email [email protected]. If you disagree with this policy, please don't use the Service.

Summary

Two roles. For your account details, we decide how the information is used, so we are the "controller". For the client records you enter into Yven (your clients' names, contacts, sites, work entries), you decide what goes in and we only store and process it for you, so we are your "processor" (in Quebec terms, a service provider). Section 1 explains the difference.

Sensitive information. We don't ask for it, and you shouldn't put it in. Yven is built to hold a pointer to where a credential lives, never the credential.

Where it lives. Our servers are in Canada. Some of the service providers listed in section 4 may process data outside Canada.

Selling data. We don't sell personal information or use it for targeted advertising.

Your rights. You can export your data and delete your account from inside the app, or ask us by email. Details are in section 8.

Table of Contents

1. What we collect, and our role
2. How we use it
3. Legal bases and consent
4. Who we share it with
5. Where your data is stored and transferred
6. How long we keep it
7. How we protect it
8. Your rights
9. Cookies and analytics
10. Children
11. US state privacy rights
12. Other regions
13. Changes to this policy
14. Contact and complaints

1. What we collect, and our role

Information about you (we are the controller)

• Account details: your name, email address, password (stored only as a one-way hash), business name and contact details, and your settings and preferences.
• Billing details: your plan and subscription status. Card numbers are entered directly with Stripe and never reach our servers; we keep only the references Stripe gives us.
• Usage and log data: IP address, browser and device type, pages and actions, timestamps, and error reports, which our servers record for security and troubleshooting.
• Messages and feedback: anything you send us by email or through the in-app feedback form.
• Free template downloads: if you give us a name and email address to receive a template, we keep them to send what you asked for and, if you opted in, occasional product updates.

Information you store about your clients (we are your processor)

The Service holds the records you create: client names and contacts, sites, domains, hosting and renewal details, service records, work entries, invoices, and notes. You are responsible for having the right to enter that information. We use it only to run the Service for you, we don't use it for our own purposes, and the account-level tools our staff use show counts and settings, not the content of your registry or work log.

Please don't store passwords, keys, health information, government ID numbers, or other sensitive data. Yven's "credential pointer" field is meant to hold a note about where something is kept (for example, the name of a vault), not the secret itself.

Information from connected services

If you connect QuickBooks or FreshBooks, we receive customer and invoice data from that service under the permissions you grant, and we send invoices to it on your instruction. If you connect Slack, we send your renewal digest to the webhook you give us. You can disconnect any of these at any time. When you add a domain, we query public domain registration records (RDAP/WHOIS) to find its expiry date.

Shared work logs

If you turn on a shared work log link for a client, anyone with that link can see the entries you marked as visible, so share it only with that client. You can turn the link off or replace it at any time.

2. How we use it

• Create and secure your account and provide the Service, including renewal reminders and digests.
• Bill you and manage your subscription.
• Respond to support requests and feedback.
• Send service messages: verification, receipts, renewal digests, and changes to our terms or this policy.
• Send product updates and marketing, only to people who have opted in. Every message has an unsubscribe link.
• Keep the Service secure, prevent fraud and abuse, and fix faults.
• Understand in aggregate how our website is used (section 9).
• Meet legal obligations.

We don't make decisions about you that have legal or similarly significant effects by automated means.

3. Legal bases and consent

Canada

We collect, use, and disclose your personal information with your consent, express or implied depending on the sensitivity of the information and what you would reasonably expect, or where the law allows or requires it without consent. You can withdraw consent at any time, subject to legal and contractual limits, by contacting us. Withdrawing may mean we can no longer provide the Service.

EU and UK

Under GDPR and UK GDPR we rely on: contract (to provide the Service you signed up for); legitimate interests (security, fraud prevention, improving the Service, and responding to you, balanced against your rights); consent (marketing emails and any non-essential cookies, withdrawable at any time); and legal obligation (for example tax and accounting records).

4. Who we share it with

We share personal information only with service providers who help us run the Service, and only as needed for that purpose:

• Hosting: DigitalOcean (and, for some environments, WHC) host our servers and backups.
• Payments: Stripe processes subscription payments and holds your card details.
• Email delivery: Resend (or our host's mail server) sends account and service emails.
• Integrations you enable: QuickBooks (Intuit) and FreshBooks, and Slack, only when you connect them.
• Internal notifications: we use Slack to alert ourselves to new sign-ups, which includes your name and email address.
• Fonts: our public website loads fonts from Google Fonts, which means your browser requests them from Google and Google receives your IP address.

We may also disclose information if the law requires it (for example, a valid court order), to protect our rights, users, or the public from harm, or as part of a merger, sale, or financing, in which case we'll require the recipient to honour this policy. We don't sell personal information.

5. Where your data is stored and transferred

Our primary servers are in Canada. Some providers in section 4, such as Stripe, Google, Intuit, and Slack, may process information in other countries, including the United States, where privacy laws differ and local authorities may be able to access it. We choose providers that offer contractual privacy and security commitments. If you are in the EU or UK, your information is transferred to Canada, and to those providers, under the safeguards the law provides for such transfers. You can ask us for more detail using the contact details in section 14.

6. How long we keep it

• Account and client records: for as long as your account is open. When you delete your account in Settings, we cancel any active subscription, permanently delete your registry, work log, invoices, connections, and other content, and anonymize your account record. We keep a minimal record (an identifier and deletion date) to prevent fraud and keep our billing history accurate.
• Backups: deleted data can remain in encrypted backups for up to 90 days, after which it is removed on our normal backup schedule.
• Billing records: kept as long as tax and accounting law requires.
• Template-download contacts and support emails: until you ask us to delete them, or until they are no longer needed.
• Server logs: kept for a limited period for security and troubleshooting, then removed.

7. How we protect it

We use encryption in transit, encrypted storage and backups, hashed passwords, strict separation between accounts, and restricted server access. See our Security page for detail. No system is perfectly secure. If a security incident involving your personal information creates a real risk of significant harm, we'll notify you and the regulators the law requires, and we keep a record of incidents.

8. Your rights

Depending on where you live (including Canada, Quebec, the EU, and the UK), you may have the right to:

• Access your personal information and get a copy, including in a commonly used technical format where the law provides for it;
• Correct inaccurate information;
• Delete it, or ask us to stop using it or restrict how we use it;
• Object to processing based on legitimate interests or to direct marketing;
• Withdraw consent;
• Ask how your information was used and who has seen it; and
• Complain to a regulator (section 14).

How to exercise them: most of this you can do yourself. Update your details in Settings, export your data from within the app, and delete your account under Settings. For anything else, email [email protected]. We may need to confirm it's you, and we'll respond within 30 days. If you are one of your clients' contacts and your information is in a Yven account, please contact the web shop that owns the account first, because they decide what is held about you. If you contact us instead, we'll pass your request on to them.

To unsubscribe from marketing, use the link in any email. We'll still send messages needed to run your account.

9. Cookies and analytics

We use cookies and similar technologies that are necessary for the Service to work: keeping you logged in, protecting forms from forgery, and remembering preferences such as dark mode. We also run our own Matomo analytics instance on our own domain to count visits and see which pages are useful. Matomo data stays with us and isn't shared with an advertising network. Browser "Do Not Track" signals aren't treated as a consent choice because no common standard exists for them.

10. Children

The Service is for businesses and isn't directed at people under 18. We don't knowingly collect their personal information. If you believe a child has given us information, contact us and we'll delete it.

11. US state privacy rights

If you live in a US state with a consumer privacy law (for example California, Colorado, Connecticut, Texas, Utah, or Virginia), you may have the rights below, to the extent the law applies to us.

What we collected in the past 12 months, by the categories those laws use: identifiers (name, email, IP address, account name); customer records (contact and business details, billing references); commercial information (plan and subscription history); and internet or network activity (logs and website analytics). We collected no sensitive personal information, biometric data, geolocation, or education data. We collect it from you, from services you connect, and automatically from your device, for the purposes in section 2, and disclose it to the service providers in section 4.

We don't sell your personal information or share it for cross-context behavioural advertising, and we don't use it to profile you in ways that produce legal or similarly significant effects. We haven't knowingly sold or shared the personal information of anyone under 16.

Your rights: to know and access what we hold, to correct it, to delete it, to get a portable copy, to opt out of sale, targeted advertising, and certain profiling (we don't do any of these), and not to be discriminated against for using these rights.

To exercise them, use the in-app tools or email [email protected]. We'll verify it's you and respond within 45 days, and tell you if we need more time. You may use an authorized agent. If we decline your request, you may appeal by replying to our response, and if the appeal is denied you may contact your state attorney general. We don't respond to browser "Do Not Track" signals, because no common standard exists for them.

12. Other regions

This policy is written for users in Canada, the United States, the EU, and the UK. If you live elsewhere, you may have additional rights under your local law. Contact us and we'll honour them where they apply to us.

13. Changes to this policy

We'll update the "Last updated" date at the top when this policy changes. For material changes, we'll notify account holders by email or in the app before they take effect.

14. Contact and complaints

Our privacy officer, Darren Harkness, is responsible for how we handle personal information. Contact:

Darren Harkness, Privacy Officer, Shipton Light Industries
[email protected]
4048 Ayling St, Port Coquitlam, British Columbia V3B 5W4, Canada

If we haven't resolved your concern, you can complain to the Office of the Privacy Commissioner of Canada, to the Commission d'accès à l'information du Québec if you live in Quebec, or to your local data protection authority if you live in the EU or UK.