This policy explains what personal data Yessort collects, why, who we share it with, and the choices you have. It covers the Yessort website and web app (yessort.com) and the Yessort Warehouse Companion app for iPhone.
1. Who we are
YesSort is run by Backface Limited, a company registered in England and Wales (company number 09999485), registered office Crosby Court, 28 George Street, Birmingham, B3 1QG, United Kingdom. For data about our own customers and website visitors, we are the data controller.
Our customers (the businesses that use YesSort) put their own data into it — products, stock, orders and their customers' delivery details. For that data the business is the controller and we process it on their behalf, under our terms of service and data processing agreement. If you ordered from a business that uses YesSort and have a question about your order data, please contact that business.
2. What we collect
Account details. Your name, email address and password (stored only as a hash). If you sign in with Google or a passkey, we receive what's needed to sign you in. If you turn on two-factor authentication, we store its secret. If your organisation uses warehouse key cards, we store which card belongs to you.
Organisation data. What you and your colleagues enter or sync from connected services: products, stock, locations, orders, customers' delivery details, suppliers, purchase documents, invoices and the like.
Usage and device data. Pages and screens you visit, actions you take, your browser or device type, app version, IP address and request logs, used for security, troubleshooting and improving YesSort. The iPhone app also stores a random device identifier so your organisation can manage how many devices are signed in.
Crash and performance data. If the iPhone app or our servers hit an error, we receive a crash or error report (what went wrong, the device and app version, and your internal user ID — not your name or email).
Messages to Dot. If your organisation uses Dot, our assistant, we store the questions you ask and Dot's replies.
Billing. If you subscribe, Stripe collects your payment details; we never see or store full card numbers.
3. The iPhone app
The YesSort Warehouse Companion app needs a YesSort account; there is no sign-up in the app. It only asks for these permissions, and only when you use the feature:
• Camera — to scan product and location barcodes. Images are read on your phone and not stored or uploaded.
• Bluetooth — to connect a barcode scanner.
• NFC — to read and program warehouse key cards for signing in.
• Microphone and speech recognition — to dictate messages to Dot. Speech is turned into text on your phone; audio is not uploaded. Only the text you send reaches Dot.
The app keeps a copy of your organisation's data on the phone so it works offline. Signing out removes your session; the local copy is protected by the phone's own encryption.
4. How we use your data
• To provide YesSort and the iPhone app, and keep your account secure.
• To send emails the service needs (sign-in codes, invitations, receipts, notifications you choose).
• To process payments (Stripe).
• To understand how YesSort is used and fix problems (analytics and crash reports).
• To answer your questions in Dot and to read supplier invoices you upload or email in.
Our legal bases under UK GDPR are performance of our contract with you or your organisation, our legitimate interests in running and improving a secure service, and your consent for non-essential cookies on our website.
We do not sell personal data, use it for advertising, or track you across other companies' apps and websites.
5. Artificial intelligence
Some features use third-party AI models. When you use them, the relevant data is sent to the provider to produce the result:
• Dot (assistant) — your question, the conversation so far, and the organisation data Dot needs to answer (for example products, stock or orders) are sent to Anthropic (Claude).
• Invoice reading — supplier invoices and delivery documents you upload or email in are sent to Anthropic to extract their details.
• Help search — the text of questions to Dot's help search is sent to OpenAI to find relevant help articles.
These providers process the data on our behalf under contract, do not use it to train their models, and are located in the United States (see section 7). Dot is switched on per organisation; if your organisation would rather not use AI features, an administrator can ask us at support@yessort.com to turn them off.
6. Who we share it with
We use these service providers (processors) to run YesSort:
• Vercel — website and web app hosting (UK / EU)
• Railway — API and background processing (EU)
• Neon — database (EU, Germany)
• PowerSync — syncing data to the iPhone app (EU, Ireland)
• Amazon Web Services — file storage, image delivery, sending and receiving email (EU, Ireland)
• Stripe — payments and billing (UK / EU / US)
• Sentry — crash and error reports (EU, Germany)
• PostHog — product analytics (EU)
• Google (Analytics, Firebase) — website and app analytics (US)
• Anthropic — Dot and invoice reading, AI (US)
• OpenAI — help search, AI (US)
Services you connect. If your organisation connects Shopify, Amazon, Xero, a carrier (such as Royal Mail, DPD or FedEx) or another integration, we exchange the data needed with that service at your organisation's instruction; their own privacy policies apply.
We may also disclose data if the law requires it, or to a buyer if the business is sold (in which case this policy continues to apply).
7. International transfers
Some providers are in the United States. Where data leaves the UK or EU we rely on the UK International Data Transfer Addendum, the EU Standard Contractual Clauses or the UK–US data bridge, as appropriate.
8. How long we keep it
• Your account — while it is active. If you delete your account it is permanently removed after a 14-day grace period (you can cancel within that time).
• Organisation data — for as long as your organisation uses YesSort, then deleted within 90 days of the account closing, unless the law requires us to keep it longer (for example financial records). Your organisation can export its data before then.
• Dot conversations — kept with your organisation's data, and deleted with it.
• Server logs — up to 30 days.
• Crash and error reports — up to 90 days.
• Analytics — up to 14 months.
• Backups — our database keeps point-in-time backups for up to 30 days, so deleted data leaves them within 30 days.
9. Cookies and analytics on our website
We use PostHog for product analytics, including session replay that masks all inputs and on-screen text, and Google Analytics 4 to understand how visitors find YesSort. Analytics and advertising cookies are only set if you accept them in the cookie banner (we use Google Consent Mode), and you can change your choice at any time from the cookie settings. For signed-in customers, product analytics is part of the service. Advertising signals are always off in the iPhone app.
10. Your rights
Under UK GDPR you can ask to access, correct, delete, restrict or move your data, and object to how we use it. You can:
• edit your profile and email, and download your data, from Settings;
• delete your account from Settings (web);
• email support@yessort.com for anything else, including deletion requests from the iPhone app.
If we process your data for a business that uses YesSort, we'll pass your request to them. You can also complain to the UK Information Commissioner's Office (ico.org.uk).
11. Security
Passwords are hashed, data is encrypted in transit (HTTPS) and at rest, access is limited by role and site, sessions are signed and can be signed out remotely, and we use rate limiting, security headers and CSRF protection.
12. Children
YesSort is a business tool and is not intended for anyone under 16.
13. Changes
We'll update this page when our practices change and change the date at the top. For significant changes we'll tell account holders by email or in the app.