YOM Intent Addendum

Version 1.0. This YOM Intent Addendum (“Intent Addendum”) adds to the Data Processing Addendum (“DPA”) and the Terms of Service. It covers the processing YOM Intent needs: per-customer profiles, interest scores, segments, hot leads, on-site personalisation, assisted-conversion reports and audience exports to your own accounts. It applies only if you turn on YOM Intent. YOM Intent is not yet available to customers; once it is, it stays off unless you turn it on. It is not offered to customers of Aapastech OÜ (customers in the European Union and the United Kingdom).

Who this addendum is with and when it applies

YOM is run by three companies in the same group. Which one you deal with depends on where you are. For a business account, that is the country of the business's billing address.

• India: Aapastech Private Limited (CIN U72900DL2022PTC395508; registered office 8/3, 2nd Floor, Roop Nagar, Delhi 110007, India). It is the data fiduciary for your personal data under Indian law.
• European Union and United Kingdom: Aapastech OÜ (registry code 16453146, VAT EE102489493, Tornimäe tn 3 // 5 // 7, 10145 Tallinn, Estonia). It is the controller of your personal data under the GDPR and the UK GDPR.
• Everywhere else: 14818032 Canada Inc. (Burlington, Ontario, Canada). It is the controller of your personal data.

The three companies share engineering, hosting and support, and each processes personal data for the others under a written intra-group agreement. In this document “YOM”, “we” and “us” mean whichever of them you deal with.

This Intent Addendum is between that company and the customer (“Customer”, “you”), which means Aapastech Private Limited or 14818032 Canada Inc.: YOM Intent is not offered to customers of Aapastech OÜ, and this Intent Addendum does not apply to them. It applies when you turn on any YOM Intent feature, and only to the processing those features do. If it conflicts with the DPA about that processing, this Intent Addendum wins. Words defined in the DPA or the Terms have the same meaning here. It does not create any pooled data: your Profiles are yours alone.

1. Definitions

• Intent Features: the features of YOM Intent, such as profiles, interest scores, stages, Segments, Hot Leads, on-site personalisation, assisted-conversion reports and Audience Exports, as each becomes available.
• Intent Data: Customer Personal Data processed for Intent Features.
• Profile: a record, held for you alone, that groups events from your own properties about one visitor or customer under an identifier scoped to you, with interest scores per product category, a purchase stage, recency and consent state.
• Segment: a set of Profiles you define or select (for example “considering sofas, last 14 days”).
• Hot Lead: a Profile linked to a lead or account you hold (for example a lead form submission), ranked by how engaged that person has been since.
• Audience Export: sending a Segment to a Destination Account, as Hashed Identifiers (ad platforms and CSV files) or as your own user ids with segment properties (email and CRM tools such as Klaviyo).
• Destination Account: an advertising, email or CRM account that you hold and connect to YOM (for example Meta Ads, Google Ads or Klaviyo), or a CSV file you download.
• Hashed Identifier: a SHA-256 hash of a normalised email address (trimmed, lower-cased) or phone number (E.164).
• Excluded Categories: the categories in Annex 2.
• Excluded Regions: the European Economic Area, the United Kingdom, Switzerland and the Canadian province of Quebec.

2. Roles

2.1 For Intent Data you are the controller, data fiduciary and “business”. For building Profiles, scores, Segments and Hot Leads, for on-site personalisation and for reports, YOM is your processor, data processor and “service provider” (Cal. Civ. Code §1798.140(ag)). Where you act for your own client, YOM is your sub-processor.

2.2 Audience Exports. Under the California regulations, sending a customer list to an advertising platform so that it can find those people and show them ads is cross-context behavioural advertising, which a service provider cannot provide (11 CCR §7050(b)). So for Audience Exports, and for the CCPA and similar US state laws only, YOM acts as a third party to which you make personal information available, and Schedule 1 sets out the contract terms 11 CCR §7053 requires. Under every other law YOM remains your processor for Audience Exports too.

2.3 Each Destination Account is a recipient you choose under your own agreement with its provider. Meta, Google, Klaviyo and similar services are not YOM’s sub-processors (as in DPA section 6).

2.4 Under India’s Digital Personal Data Protection Act, 2023, this Intent Addendum and the DPA are the contract section 8(2) requires for YOM to process Intent Data on your behalf.

3. Your instructions

You instruct YOM to:

• (a) build Profiles from events your own properties and connectors send to your YOM projects;
• (b) score interest per product category and assign stages, using the event weights and decay settings shown in the dashboard;
• (c) build the Segments and Hot Leads you define;
• (d) personalise content on your own properties using your Profiles;
• (e) send Audience Exports to the Destination Accounts you connect, on the schedule you set;
• (f) report assisted conversions across your own properties;
• (g) delete Profiles and stop exporting people as clause 8 sets out.

4. YOM’s own purposes: none

4.1 YOM processes Intent Data only to provide the Intent Features to you. YOM will not:

• (a) use Intent Data for YOM’s own advertising, for any other customer’s advertising, or for any media product of YOM’s or its affiliates;
• (b) add Intent Data to any dataset shared across customers, unless you have separately agreed to that in writing and the visitor has chosen to take part;
• (c) combine Intent Data with personal data from any other customer or from YOM’s own interactions with people, or link your Profiles to another customer’s Profiles (Cal. Civ. Code §1798.140(e)(6); 11 CCR §7050(a));
• (d) sell or share Intent Data, or disclose it to anyone except your Destination Accounts and YOM’s sub-processors;
• (e) use Intent Data to train or tune any model used for another customer.

4.2 YOM may use statistics about how Intent performs (for example match rates, or how quickly interest decays in a product category) only as aggregated, de-identified data under section 6 of the Terms, and never from Shopify-Sourced Data.

5. Your obligations

5.1 Notice and consent. Before Intent Data is collected, your privacy notice tells people that you build interest profiles from their activity on your properties and use them to personalise your site; that you score how engaged your leads are, if you use Hot Leads; and that you send their email address or phone number in scrambled (hashed) form to the advertising and marketing services you use, naming each of Meta, Google and Klaviyo that you use, so they can show those people your ads or messages. You obtain the consent the law requires:

• India: explicit, specific consent to personalisation before profiling, and to advertising before export (Digital Personal Data Protection Act, 2023, section 6), through YOM’s consent features or an equivalent consent you record;
• United States: you offer the opt-out of “sale” and “sharing” (or targeted advertising) that applies, including a “Do Not Sell or Share My Personal Information” link where the CCPA requires one, and honour Global Privacy Control (Cal. Civ. Code §1798.120, §1798.135; 11 CCR §7025);
• Canada outside Quebec: express consent before profiling for advertising and before sending hashed lists to ad platforms (PIPEDA Schedule 1, clause 4.3; the federal Privacy Commissioner found in 2023 that a retailer sharing hashed emails with Meta needed express consent and could not rely on its privacy policy, PIPEDA Findings #2023-001).

5.2 Platform terms. You accept Meta’s Customer List Custom Audiences Terms (in effect from 3 December 2025), Google’s Customer Match policy, Klaviyo’s terms and any equivalent terms of other Destination Accounts, and you keep your accounts in good standing. Those terms make you represent that you have the rights and lawful basis to use the data, require you to exclude people who opted out, and forbid audiences based on children’s, health or financial data. Google allows Customer Match targeting only for accounts with 90 days of history and more than USD 50,000 lifetime spend; smaller accounts can use lists only for observation and exclusions, so a Google export may not let you target anyone.

5.3 US opt-out display. If you sell or share personal information, California’s regulations require you to show visitors whether you honoured their opt-out preference signal (11 CCR §7025(c)(6)). Showing that message is your responsibility.

5.4 What you don’t send. You do not send data in the Excluded Categories, data about anyone you know to be under 18 in India, under 16 in the US or a child under COPPA, or government identifiers, card numbers or passwords (Acceptable Use Policy).

5.5 Health-sector customers. If you are a health-sector business (Annex 2, part 2), you may use Profiles for analytics and on-site content, but you may not export Segments that reflect health interest. YOM blocks every export from a project you mark as a health-sector site.

5.6 Excluded Regions. You do not use Intent Features for people you know to be in an Excluded Region (clause 12).

6. YOM’s safeguards for Intent

6.1 Consent gating. A Profile is built and scored only from events that carry the person’s consent to analytics and to personalisation, in every region. An Audience Export includes only people whose latest stored consent grants advertising (seen within the previous 180 days), who were active in the previous 180 days, and who have no Global Privacy Control signal, opt-out or withdrawal on record. A Global Privacy Control signal, opt-out or withdrawal seen on any browser or device linked to a Profile applies to the whole Profile, including a logged-in person’s other devices (11 CCR §7025(c)(1) covers “any consumer profile associated with that browser or device, including pseudonymous profiles”). From then on the Profile is left out of every export and its scores stop changing. You can require explicit (not regional-default) advertising consent for any export.

6.2 Hashed identifiers only. Emails and phone numbers reach YOM already hashed (SHA-256) in the browser or on your server. YOM’s ingest rejects any value that is not a SHA-256 digest, so raw identifiers are refused and not stored. If a YOM connector ever receives raw values from a platform (for example an order notification), it hashes them in memory on receipt and never stores or logs the raw value. Hashed Identifiers are still personal data and are treated as such. They are shown only to your owners and admins, and a CSV export file is kept for at most 7 days.

6.3 No fingerprinting for identity. Profiles never use a device fingerprint, IP address or similar signal as an identifier.

6.4 Excluded Categories. YOM blocks the Annex 2 taxonomy nodes from scoring, Segments and exports, and refuses Segment rules that target them.

6.5 Minimum export size. YOM does not send an Audience Export of fewer than 100 people, counted after every rule in clause 6.1, so a single person can’t be singled out in an ad account. If a run would send fewer, nothing is sent and the Destination Account is left unchanged.

6.6 Separation. Profiles are stored per customer project, keyed by identifiers scoped to you, and are never joined with another customer’s data.

6.7 Excluded Regions. YOM leaves out of Profiles, scores, Segments and Audience Exports the events it locates in an Excluded Region from the country and region of the request.

6.8 Records. YOM records every Audience Export run: when it ran, the Segment, the Destination Account, how many people were sent, and what the platform reported back, such as match counts or audience size. Creating, changing, running and deleting an export are written to your audit log with the user who did it.

7. Shopify-Sourced Data

7.1 Data YOM obtains through Shopify APIs, webhooks, web pixels, app proxies or app extensions (“Shopify-Sourced Data”) is used only for that merchant’s own Intent Features.

7.2 Shopify-Sourced Data never enters benchmarks, any dataset shared across customers, or any model used for another merchant.

7.3 Intent scoring is rule-based: it uses the event weights and decay settings shown in your dashboard and does not train a model on Shopify-Sourced Data. We will update this clause, with notice under the Terms, before any learned weights use Shopify-Sourced Data.

8. Withdrawal, deletion and audiences in your accounts

8.1 When a person withdraws consent to analytics or personalisation, or is deleted at your request, YOM erases every Profile linked to them. When a person opts out of advertising or sends a Global Privacy Control signal, YOM keeps them out of every later export. Meta and Google audiences are replaced on every run, so the person leaves them at the next run of that export. Klaviyo lists are only added to, so you remove the person from a Klaviyo list yourself.

8.2 When you turn YOM Intent off, YOM stops building and scoring Profiles at once. On your written request YOM deletes your Profiles within 30 days; otherwise they are deleted as clause 8.3 sets out. Audiences already in your Destination Accounts belong to you; on request, before you disconnect them, YOM deletes the audiences it created there.

8.3 Profiles are deleted when they have had no activity for the Intent retention period: 180 days by default. You can change it, but it is never longer than your project’s retention period or 13 months, whichever is shorter.

8.4 DPA section 13 (return and deletion after termination) also applies to Intent Data, including its exception for copies the law requires us to keep. For people in India, from 13 May 2027 Indian law will also require us to keep personal data, related traffic data and processing logs for one year from processing. From then, when we delete Intent Data from our systems we will keep a sealed copy for the rest of that year, which nobody uses except to meet that legal duty, and then destroy it.

8.5 Consent receipts (records of what a person chose, when and on which page) are kept for your project’s retention period, like other events. If you need to keep them longer, export them before that period ends.

9. Breach notice

DPA section 8 applies to Intent Data. YOM will notify you of a Personal Data Breach affecting Intent Data without undue delay and in any case within 24 hours of becoming aware of it, with the details the Digital Personal Data Protection Rules, 2025 require you to give the Data Protection Board of India (Rule 7) as far as YOM knows them, and updates as they become available.

10. Rights requests

YOM’s data-subject request tools cover Intent Data: an access request includes the person’s Profiles (scores, stages, consent and linked identifiers), and an erasure deletes every Profile linked to the person’s visitor ids, user id or hashed email. For anything those tools do not do, such as correcting a Profile, YOM acts on your written request within 10 business days, so that you can answer within the times the law sets (DPDP Rules, Rule 14; CCPA 45 days, Cal. Civ. Code §1798.130; PIPEDA 30 days, section 8(3)).

11. US state laws (adds to DPA section 12)

11.1 For Intent processing other than Audience Exports, YOM is your service provider and DPA section 12 applies.

11.2 For Audience Exports, YOM is a third party (clause 2.2) and Schedule 1 applies. You treat each Audience Export as a sale or sharing of personal information (or targeted advertising, under other state laws) and give the notices and opt-out rights those laws require.

11.3 YOM will not combine the personal information of people who opted out of sale or sharing with personal information from any other source.

11.4 YOM certifies that it understands and will comply with these restrictions.

12. EEA, UK, Switzerland and Quebec

YOM Intent is not available for End Users in the European Economic Area, the United Kingdom, Switzerland or Quebec. This Intent Addendum gives YOM no instructions for their personal data, and clauses 5.6 and 6.7 keep them out. If that changes, we will update this Intent Addendum first, with notice under the Terms, and for Quebec we will offer French versions of these terms before you accept them.

13. Sub-processors

The sub-processors on our sub-processors page apply, including our group companies Aapastech Private Limited and 14818032 Canada Inc.. YOM Intent runs on Cloudflare (Durable Objects, R2 and Queues), which is already listed.

Schedule 1: CCPA third-party terms (11 CCR §7053)

This schedule applies to Audience Exports where the CCPA applies. It is the contract 11 CCR §7053(a) and Cal. Civ. Code §1798.100(d) require between a business that sells or shares personal information and the third party that receives it.

1. Purpose. You make Intent Data available to YOM only for one limited and specified purpose: to send the Segments you choose from your own Profiles to the Destination Accounts you connect, on the schedule you set, so that you can show your own advertising and marketing to the people in them.
2. Use only for that purpose. YOM uses that personal information only for the purpose in paragraph 1. It does not sell or share it onward, or disclose it to anyone except your Destination Accounts and YOM’s sub-processors.
3. Same level of protection. YOM complies with all applicable sections of the CCPA and its regulations and, for the personal information you make available to it, provides the same level of privacy protection that the CCPA and its regulations require of businesses. In particular, YOM honours every request to opt out of sale or sharing that you forward to it (and treats a Global Privacy Control signal as clause 6.1 describes), and keeps reasonable security procedures and practices appropriate to the nature of the personal information, as Cal. Civ. Code §1798.81.5 requires.
4. Your right to check. For the personal information you make available to YOM, you may take reasonable and appropriate steps to ensure that YOM uses it in a manner consistent with your obligations under the CCPA and its regulations, for example by requiring YOM to attest that it treats that information as you are obliged to treat it, or by asking for the export records in clause 6.8.
5. Your right to stop and remediate. On notice, you may take reasonable and appropriate steps to stop and remediate unauthorised use of the personal information you made available to YOM, including turning off or deleting an export, requiring YOM to stop the processing, and requiring documentation that verifies YOM no longer keeps or uses the personal information of people whose opt-outs you forwarded.
6. Notice if YOM cannot comply. YOM will notify you after it determines that it can no longer meet its obligations under the CCPA and its regulations.

Annex 1: Details of processing (Intent)

• Subject matter: the Intent Features.
• Duration: while YOM Intent is on, then deletion under clause 8.
• Nature and purpose: collecting, scoring, segmenting, personalising, hashing, exporting to Destination Accounts and measuring assisted conversions, all for your own marketing.
• Data subjects: visitors, customers and leads of your own properties, outside the Excluded Regions.
• Categories of data: Hashed Identifiers; visitor ids scoped to you; your own user or lead ids; product-category interest scores and stages; event types and times (page, 3D view, configure, dimension check, AR launch, add to cart, checkout, lead, purchase); order ids and values; approximate location (country); device class; consent state and receipts. Hot Leads also link to the lead’s name and email in your own CRM or lead store, which are not copied into YOM unless you send them.
• Special categories: none; Excluded Categories are blocked (Annex 2).
• Retention: Profiles 180 days after last activity by default, at most 13 months or your project’s retention period (clause 8.3); consent receipts for your project’s retention period (clause 8.5); CSV export files 7 days; export run records while the export exists; audit records for your plan’s audit-log period.
• Recipients: your Destination Accounts; YOM’s sub-processors.

Annex 2: Excluded Categories and health-sector rule

Part 1, never scored, segmented or exported: health, medical conditions, disability, pregnancy, reproductive or sexual health, mental health; religion or beliefs; sexual orientation, sex life, gender identity; political opinions or affiliations; trade-union membership; racial or ethnic origin, caste or tribe; financial hardship, credit, debt or insurance status; criminal history; biometric or genetic data; government identifiers; precise geolocation; children.

YOM blocks these Google Product Taxonomy nodes and all their descendants: Health Care (491), Business & Industrial > Medical (2496), Mature (772, including Erotic and Weapons), Religious & Ceremonial (5605), Religious Ceremonial Clothing (5483), Maternity Belts & Support Bands (502987), Breast Pumps (565), Breast Pump Accessories (505366) and Breast Milk Storage (7234). You can add nodes but never remove these. Categories that relate to finances, politics or the other Part 1 topics have no product node today; Segment rules that target them are refused. We review the list every quarter.

Part 2, health-sector businesses: hospitals, clinics, physiotherapy and other providers, pharmacies, telehealth, medical devices and diagnostics, health insurers, and wellness businesses whose products relate to a health condition. Analytics and on-site use only; no health-interest exports.