Skip to content
← Ylon

Privacy Policy

Revised 02.11.2026

1. Personal data operator (controller)

The operator of personal data and owner of the Ylon service (the ylon.ru and ylon.am websites and the Ylon mobile app) is Davit Koryuni Mandalyan, a private individual.

Location and address (place of residence): 40/1 Dzorapi St., Yerevan, Republic of Armenia. Written requests and legally significant notices are accepted at this address.

Email for personal-data requests and legally significant notices: support@ylon.ru (Russia), support@ylon.am (Armenia).

2. General provisions

This Privacy Policy (the “Policy”) has been prepared in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” and the Law of the Republic of Armenia “On Protection of Personal Data”, and sets out how personal data is processed and the measures taken to keep it secure.

The Policy applies to all personal data that the Operator receives from users of the ylon.ru and ylon.am websites and the Ylon mobile app (the “Service”). Details of the Operator are in the “Personal data operator (controller)” section.

Specifics of how the data of users in the Republic of Armenia is processed are in the “Users in the Republic of Armenia” section.

3. Purposes of processing

The Operator processes personal data for the following purposes:

  • — Registering and authenticating users
  • — Providing the Service's features: posting listings, publications and stories (including the author's story archive), searching for goods and services, exchanging messages between participants
  • — Processing orders and making payments
  • — Communicating with users: notifications about orders, about the arrival of goods you have subscribed to, about changes in how the Service works, replies to enquiries
  • — Reminders about items left in your cart — only if you have turned on marketing mailings in your notification settings
  • — Passing to a shop the requests that a visitor sends through the form on the shop's links page
  • — Transcribing voice messages — on the terms of the “AI features” section
  • — Preparing a product description and listing at the seller's request — on the terms of the same section
  • — Reviewing shop connection applications and showing shop owners — on the terms of the “Seller application” and “Showing shop owners” sections
  • — Collecting the Service's own visit statistics and statistics on clicks through collaboration links — with the user's consent
  • — Collecting the Service's visit statistics with Yandex Metrica and assessing advertising effectiveness — with the user's consent
  • — Collecting visit statistics for shops' links pages, if the shop has connected a counter — with the consent of the page visitor
  • — Keeping the Service working and secure: detecting and fixing errors and failures, protecting against unauthorised access
  • — Improving the quality of the Service and developing new features
  • — Performing obligations under the legislation of the Russian Federation and the Republic of Armenia

4. Categories of data processed

The Operator processes the following personal data.

Account and profile:

  • — name, email, phone number, profile photo and cover, username, “about me” description, city, address, social network links, password as a hash. If no email is given when signing up by phone number or through an external account, we create a service address for the account on the noreply.ylon.ru or pending.ylon.local domain;
  • — earlier profile photos — only you can see their list;
  • — at your option: first and last name in the profile, gender, date of birth;
  • — when you sign in with Yandex ID, VK ID or Sber ID: the account identifier in that service, name, email, phone number and a link to the profile photo. We do not store the access tokens of those services;
  • — confirmation that you are 18 or older;
  • — the consent log: which consent you gave or withdrew, the version of the text, when and where it happened (on the website or in the app: at sign-up and sign-in, in settings, in a separate prompt, at checkout, in a seller application, in a shop team), the IP address in shortened form and browser details; the current state of consents to individual features;
  • — settings: language, theme, notifications, privacy, map and others;
  • — two-factor verification: the secret — encrypted, backup codes — as a hash; the devices you marked as trusted;
  • — if you go through identity verification — a photo of an identity document. The file is stored closed: it is seen by you and by Service staff who review requests; after the decision on the request the file is deleted;
  • — service marks: account block and its reason, restriction of content display, trust and spam scores; time of last visit and “online” status — you choose in settings who can see them.

Orders:

  • — address book: address, apartment, entrance, floor, intercom, city, region, postcode, coordinates and landmark;
  • — cart: items, their variants and quantity, and when we reminded you about the items in it;
  • — favourite listings;
  • — order data: the recipient's name, phone number, email and address or pick-up point, order comment, contents and amount of the order;
  • — promo codes you applied and gift-card payments;
  • — item reservations and price offers to the seller;
  • — delivery confirmation: a photo, coordinates and a note added by the seller;
  • — for pick-up — the time and place of the meeting, a message and a QR code; coordinates — if you marked that you have arrived and allowed location detection; coordinates are not passed to the shop;
  • — returns and disputes: reason, description, photos, amounts, tracking number;
  • — back-in-stock notification subscription: email and phone number, including without signing in. At present the notification is sent only by email or push notification; no notifications are sent to the phone number;
  • — sticker pack purchases;
  • — the bank card number is entered on the payment service's page; the Operator does not receive or store bank card numbers.

Devices and use of the Service:

  • — sign-in sessions: IP address, browser details, device name and identifier, the last significant action in the session (creating a listing, post or order);
  • — sign-in log: IP address in shortened form, browser details, device identifier;
  • — logs of actions by shop and Service staff, logs of access to conversations and support requests — with the IP address;
  • — the app's push token and the browser subscription address — for delivering notifications;
  • — if you are signed in — product views, adding to favourites, taps on the buttons to contact the seller (message, showing the phone number) and the “Share” button: which product, which action and the date;
  • — views of collaborations of shops and authors and clicks through their links: with your consent to statistics — the account or a random visitor identifier and the site you came from; without consent only the click on the link itself and the site you came from are counted;
  • — search queries, time spent in sections of the Service and actions in the interface;
  • — where you came from when you registered by email (advertising tags, if you consented to statistics), the number and amount of your orders, time of last activity;
  • — city determined by IP address: we determine it from a database on our own server, without contacting third-party services;
  • — visit statistics — only with your consent (on the website — in the banner, in the app — in a separate prompt): page views and actions on pages, product views, adding to the cart and starting checkout with the amount; in the app — also how profile video covers are shown. They record a random visitor identifier (the “Cookies” section) and, if you are signed in, the account identifier;
  • — records of orders and carts for sales statistics — kept regardless of your choice in the banner: payment of an order and a failed payment (order and payment identifiers, shop, amount, the buyer's account identifier and, for a failed payment, its reason); a cart from which no order was placed (cart, shop, number of items and the names of up to three of them, account identifier); an order for a product after a click from a collaboration (product, collaboration, shop, the buyer's account identifier);
  • — technical error information — in the “Recipients” section.

Content and communication:

  • — messages, including voice messages and attachments; reviews; posts, stories and comments; questions about products and the answers to them; answers to polls and questions in stories; listings;
  • — likes on posts, stories and comments, reactions to messages, “helpful” marks on reviews;
  • — saved posts, bookmarks and collections, including shared ones: their participants, roles and invitations with a message;
  • — installed sticker packs;
  • — in conversations — when you read messages, and also pinned, archived and hidden chats and chats with notifications turned off. Your correspondents see that you have read their message as long as “Read receipts” is on in settings; it is on by default;
  • — the notifications you receive: about what and from whom;
  • — follows of users and shops, the close-friends list, blocks, story views, authors whose stories you have hidden. The lists of your followers and of who you follow are visible to other users; in settings you can hide only their number;
  • — complaints: the reason, the text and what the complaint is about;
  • — support requests;
  • — in the app, a copy of recent messages is stored on your device; it is deleted when you sign out of the account.

Sellers and shops:

  • — details: the legal name and the bank are stored openly; INN, KPP, OGRN, BIK, accounts, the legal address and the full name of the manager — encrypted. If a shop has turned on showing of details, its page shows the legal name, INN, KPP and OGRN, and, with a separate setting, the legal address; the other details are not shown;
  • — when withdrawing funds and verifying details — the IP address and browser details;
  • — the shop owner's personal wallet: balance and transactions;
  • — the shop team: roles and permissions of staff, who invited them, until when access is valid;
  • — keys of services connected by the shop (payment services, online cash registers, delivery services and others) — encrypted;
  • — the shop's plan: the plan, terms and status;
  • — collaborations of shops and authors: the terms; who invited, confirmed, declined or cancelled a collaboration or withdrew from it; the advertising marking identifier, if the author provided it;
  • — the shop's addresses and contacts (address, coordinates, phone number, email), including for display to buyers;
  • — the place where a service is provided in a listing (address and coordinates) — it is shown on a map;
  • — the name, quote and photo of the shop's founder — shown only if the shop has marked consent to display;
  • — the shop's notes about buyers;
  • — a seller application and showing of shop owners — in the “Seller application” and “Showing shop owners” sections.

Visitors to shops' links pages (an address like /language/page-name on the Ylon website, or the shop's own domain):

  • — a request through the form: name, email, phone number, message and advertising tag; the IP address and browser details are saved by us and are not shown to the shop;
  • — view statistics — in the “Cookies” section.

People who do not use the Service:

  • — the email of a person whom a shop invites to its team — we receive it from the shop;
  • — brand representatives and authors (bloggers) whom we offer to cooperate: name, company, email, phone number, Telegram, website and social network pages, nickname and number of followers, region, staff notes. We take this information from open sources (marketplaces, social networks), receive it from the person themselves, at events, by recommendation, from partners and agencies. Only Service staff see it. It can be deleted on request — the “Your rights” section.

Special categories of personal data. The Operator does not ask for information that belongs to special categories of personal data (in the Russian Federation — Article 10 of Federal Law No. 152-FZ; for users in the Republic of Armenia — the “Users in the Republic of Armenia” section). Such information can enter processing only if the user has stated it in a message, a post or a review.

5. Legal grounds for processing

Personal data is processed on the following legal grounds:

  • — The data subject's consent (Article 6(1)(1) of Law 152-FZ) — given with a separate checkbox; its text is on the “Consent to the processing of personal data by a Ylon user” page
  • — Separate consents — to analytics cookies, marketing mailings (the switch in notification settings), transcription of voice messages, passing your contacts to a shop when you order with payment outside Ylon, showing shop owners, and a seller application; each is given and withdrawn independently of the others
  • — Performance of a contract to which the data subject is a party (Article 6(1)(5) of Law 152-FZ) — when placing and fulfilling orders, and also when posting publications and stories and keeping their archive under the Terms of Use
  • — Performance of duties imposed on the Operator by the legislation of the Russian Federation (Article 6(1)(2) of Law 152-FZ) — keeping data for tax and accounting purposes

The legal grounds under the law of the Republic of Armenia are in the “Users in the Republic of Armenia” section.

6. Retention periods

Personal data is kept for as long as it is needed for the purposes of processing; account data — for as long as the account exists. What happens when an account is deleted and what remains afterwards is in the “Your rights” section.

Records that are deleted automatically:

  • — the account sign-in log — after 90 days;
  • — Service statistics events — after 90 days, purchase-funnel events — after 180 days;
  • — search queries — after 12 months;
  • — time spent in sections of the Service and actions in the interface — after 90 days;
  • — sign-in session records (device, browser, IP address) — after the session ends: after 30 days of inactivity, but no later than 90 days after sign-in, or 7 days after signing out or ending the session;
  • — stories — 24 hours after publication they stop being shown and are kept in the author's archive until the author deletes them. Who viewed a story, who liked it, how they answered a poll or a question and who subscribed to a reminder is kept for 48 hours after publication and is then deleted together with the notifications to the author about likes — only the overall numbers remain. If a complaint has been filed about a story, the story and this data are kept until the moderator's decision, including after the account or shop is deleted; the viewer data is then deleted, and a story on which the moderator took action is deleted entirely. In the Service, only the author sees the archive, and a shop's archive is seen by its staff with the right to manage content; a shop's “close friends” story is seen only by its author. Personal stories are deleted together with the account when its restoration period ends (the “Your rights” section), a shop's stories — when the shop is deleted; a shop's “close friends” stories are usually deleted within an hour after the author's membership of the shop's team ends or the author deletes their account (if the story is still being shown — within an hour after it stops being shown), and if the author is the shop's owner — when the restoration period of their account ends; other stories published on behalf of a shop stay in its archive after the author leaves the team. After deletion, the story file is still kept for up to 187 days in a hidden backup copy of the file storage in Russia — for recovery after failures and, in cases established by law, to meet the obligation to keep it; it is not shown in the Service. A story that a shop has added to a collection on its page stays in the collection until the shop removes it; a “close friends” story deleted because its author's team membership ended or the author deleted their account is removed from the collection as well. Clicks and follows from stories that we record with your consent to statistics are kept for 400 days;
  • — an unfinished application to connect a shop — 30 days after the last save (the terms for applications are in the “Seller application” section); the seller registration form in the Republic of Armenia — for the periods of the “Seller registration in the Republic of Armenia” section;
  • — the photo of a document uploaded for identity verification — after the decision on the request.

Orders and payments, together with the recipient's details, delivery confirmations, returns and disputes, are kept after the account is deleted — for as long as they are needed for accounting and for handling claims. The consent log is kept as proof of consent, including after the account is deleted. Activity and access logs and server logs are kept for as long as they are needed to protect the Service and investigate incidents. Requests from a shop's links page and the statistics of its views are kept until the shop deletes that page.

For some data there is no automatic deletion period yet: back-in-stock notification subscriptions, complaints, information about views of products, profiles and posts, about clicks through collaboration links and about where a user came from, and data of brand and author representatives. We delete it at your request (the “Your rights” section), except data we are required by law to keep. When a deletion period is set for such data, we will state it in this section.

We make database backups and keep them in Russia. Deleted data remains in backups created earlier.

A deleted file is still kept in a hidden backup copy of the file storage in Russia: photos and videos of posts and stories, profile photos, attachments and voice messages from chats, and files of shops’ links pages — for up to 187 days; a photo of an identity document, pictures taken at the Ylon warehouse and files uploaded to “Catalog upload” — for up to 15 days; listing photos, and shops’ images, stickers, documents and product, stock and price import files — with no set period yet. These copies are kept for recovery after failures and, in cases established by law, to meet the obligation to keep them; they are not shown in the Service. Cropped copies of images that the Service makes on upload are kept for up to 106 days after they are made.

7. Recipients

The Operator passes personal data only to the recipients listed in this section, only for the stated purposes and in the stated scope. A recipient may change if we replace a service provider; the purpose, the data involved and the basis for the transfer do not change. We will provide information about recipients as of the date of your request on request (the “Your rights” section).

Shops. What a shop receives depends on how you pay.

  • — An order paid through Ylon: the recipient's name and phone number, the email if you gave one, the delivery address or the chosen pick-up point, the order comment and its contents, and also the name, profile photo, email and username from your account.
  • — An order paid outside Ylon, including such a part of an order from several shops: the recipient's name, the order comment and its contents, and also the name, profile photo and username from your account; the phone number and email you give are passed only with your separate consent. Such a shop does not receive the delivery address, the pick-up point or your account's email: you agree delivery with it in the chat.
  • — A service booking: the service, the chosen time and the booking comment, and also the name, profile photo and username from your account. When you book, the shop does not receive your phone number, address or email.

The order data is seen by the shop's staff and by the services the shop has connected to its account; if the shop has connected delivery or an accounting system, what they receive is listed below in this section. Correspondence with the shop is seen by its staff. If you sent a request through the form on a shop's links page, the shop receives the name, email, phone number, message and advertising tag from the request. An invitation to a shop team goes to the email provided, together with the shop's name and the name of the person who invited you.

Other users see what you publish yourself: your profile, listings, reviews, posts and stories — and also the lists of your followers and of who you follow. The author of a story — and, for a shop's story other than a “close friends” one, its staff with the right to manage content — sees for 48 hours after publication that you viewed or liked it and how you answered a question; for polls and reminders, only the overall numbers. A confirmed phone number can be obtained by a user with whom you have a conversation or an order, if the “Show Phone Number” setting allows it (by default “Verified Users”: users with a confirmed email).

Storage and operation of the Service (Russia): servers — Selectel (Moscow); files — Yandex Object Storage (Yandex Cloud); file delivery — Yandex Cloud CDN, which receives the viewer's IP address and browser details; the Operator's mail — Yandex 360: the emails you send us and service notifications about new seller applications, in the scope stated in the “Seller application” section.

Payment acceptance and fiscal receipts (Russia) — YooKassa (YuMoney LLC) and T-Bank (TBank JSC), if the shop has connected payment through them: the order number and amount, the payer's email and phone number, details for the fiscal receipt — name, quantity and price of goods, delivery cost, VAT rate, and for labelled goods — labelling codes. When you buy stickers and interface themes through YooKassa, the email and phone number from the account and the account identifier are passed.

Delivery (Russia), if the shop has connected delivery through these carriers:

  • — CDEK (CDEK LLC): the recipient's full name and phone number, delivery address or pick-up point code, order number, order comment, contents, weight and value of the shipment;
  • — Yandex Delivery (Yandex.Taxi LLC): the recipient's full name and phone number, the order number, delivery address or pick-up point, contents, dimensions, weight and price of the goods;
  • — Russian Post (Russian Post JSC): the recipient's full name, phone number and city, order number, weight of the shipment.

Address and details suggestions (Russia) — DaData: the text of the address you enter when placing an order, and the city; the INN that a seller enters in the shop's details.

Maps (Russia) — Yandex Maps. When a map is shown on the website or in the app, the browser loads it from Yandex servers. Yandex receives the IP address, browser details, the area of the map shown and the coordinates of its centre — if you allowed location detection, this is your location or a point near it. Yandex may store its own cookies, including identifiers, in the browser or in the app's map, and receives them — as well as Yandex cookies already in your browser — with the map requests. When a seller on the website chooses the place where a service is provided — by moving the map or by their own location, if they allowed it to be detected — the coordinates of the point are sent to Yandex to determine the address.

SMS — SMSC.RU (Russia), including to Armenian numbers: the phone number and the text of the message — a confirmation code, or the order number and amount. If a shop has connected its own SMS.RU account (Russia), messages about its orders are sent through that account.

Order messages in WhatsApp — if the shop has connected this channel through Green API (Green-API LLC, Russia). Then, instead of an SMS, the order confirmation reaches you in WhatsApp: Green API receives the phone number and the text of the message (order number and amount) and passes the message to WhatsApp (Meta Platforms, Inc., USA).

The shop's accounting system — if the shop has connected MoySklad: the buyer's name and phone number, the order number, date and contents, and the delivery method.

Email: UniSender Go (Russia); open and link-click tracking is on in the emails. The recipient's email, subject and text of the email are passed.

Push notifications — 650 Industries, Inc. (the Expo Push service, USA): the device's push token, the title and text of the notification (in a message notification — the sender's name and the beginning of the text), a link to the image or the sender's profile photo and technical navigation parameters. The app gets the push token from Expo when you allow notifications. The notification is then delivered by Apple Inc. and Google LLC (USA). To a browser, the notification is delivered by the push service the browser has chosen: it is given the subscription address, and the content of the notification is encrypted and not disclosed to the service.

Notifications to a shop in Telegram — if the shop has connected a bot; the data involved is in the “Cross-border transfers” section.

Error monitoring — Functional Software, Inc. (the Sentry service); data is received and stored in Germany. From the website, the technical description of the error (page address, call stack, latest actions in the interface), browser details, for some visits — measurements of page speed, and also the identifier of the account of a signed-in user are sent. Reports from the website go through our server, which removes cookies and authorisation data from them. From the app, the technical description of the error, details of the device, the system and the app, a layout of the screen elements at the time of the error, failed network requests and measurements of screen speed are sent; the app sends the account identifier only in a bug report that you send yourself, together with its text. Reports from the app are sent to Sentry directly, so Sentry receives the device's IP address.

Statistics — only with your consent. Yandex Metrica (Yandex LLC, Russia): IP address, device and browser details, cookie identifier, referral source, pages viewed and actions on them; on the home page and on the “Sell on Ylon”, shop catalogue and shop theme pages, actions on the page are recorded (Webvisor). On shops' links pages — the counters the shop has connected: Yandex Metrica with recording of actions on the whole page, the VK pixel (Russia) and Google Analytics (USA); they are loaded only if you gave consent on that page.

AI features — Groq, Inc. and OpenAI, L.L.C. (USA): the scope and terms are in the “AI features” section.

Sign-in with an external account (Russia) — Yandex ID, VK ID, Sber ID, if you chose such a sign-in: the service learns that you are signing in to Ylon and passes us the data listed in the “Categories of data processed” section.

8. Cross-border transfers

Ylon's databases are in Russia: the servers are in a Selectel data centre (Moscow), and uploaded files are in Yandex Object Storage (Yandex Cloud). This applies to the data of all users, including users from the Republic of Armenia. Some of the recipients listed in the “Recipients” section are located outside Russia. Cross-border transfers are carried out under Article 12 of Federal Law No. 152-FZ “On Personal Data”.

The Federal Republic of Germany (the data centre of the Sentry service) and the Republic of Armenia are on the list of foreign countries that ensure adequate protection of the rights of personal data subjects (Roskomnadzor Order No. 253 of 16 September 2026). The Operator works with data remotely in the Republic of Armenia. In the cases provided for by the law of the Republic of Armenia, the information is received by the Personal Data Protection Agency and the Police of the Republic of Armenia.

The United States of America is not on that list. Data is sent there:

  • — to deliver push notifications: to the app — through Expo, Apple and Google; to the browser — through the push service chosen by the browser (for example, Google, Mozilla or Microsoft);
  • — for order messages in WhatsApp (Meta), if the shop has connected that channel;
  • — for AI features: transcription of voice messages (Groq, OpenAI) — only with your consent; preparing a product description and listing (OpenAI) — at the seller's request;
  • — for the statistics of shops' links pages (Google Analytics), if the shop has connected that counter — only with your consent on that page.

The company that provides the Sentry service (Functional Software, Inc.) is also incorporated in the USA, although error-monitoring data is received and stored in Germany. Transfers stop if Roskomnadzor decides to ban or restrict them.

If a shop has connected Telegram notifications, messages about new orders and bookings, their cancellation and refunds are passed to Telegram Messenger Inc. and Telegram FZ-LLC (United Arab Emirates, British Virgin Islands); those countries are also not on the list. About the buyer, such a message contains only the order or booking number and a link to the shop dashboard, and, for a refund processed by the Service, the order number, the amount and the refund reason entered by the staff member. The buyer's name, phone number and address are not included.

The grounds for each transfer are stated in the description of the relevant purpose:

  • — performance of the contract with you (Article 6(1)(5) of Federal Law No. 152-FZ): delivery of notifications, order messages in WhatsApp and shop notifications in Telegram, error monitoring, a draft product description and listing at the seller's request;
  • — your consent (Article 6(1)(1)): transcription of voice messages (the “AI features” section); statistics of shops' links pages; passing information to the authorities of the Republic of Armenia.

9. AI features

On the website and in the Android app, voice messages can be transcribed. Transcription is off by default. A voice message is transcribed only if its sender has allowed it on their side and the recipient has turned transcription on on theirs. The audio is sent to Groq (USA) or, if it is unavailable, to OpenAI (USA), without the sender's name or contact details.

A seller on the website and in the Android app can get a draft product description by pressing a button. For this, the product name, category, characteristics and the language in which the text is needed are sent to OpenAI (USA) — without the seller's name or contact details. On the website a seller can also fill in a product listing from a photo: the photo is sent to OpenAI (USA); if people appear in it, their image is sent with it. Both features work only when the button is pressed.

Other features that use external artificial intelligence are currently switched off: message translation and reply suggestions (Anthropic PBC, USA), the shopping assistant (Anthropic PBC, USA), photo search (OpenAI, USA). If such a feature is switched on, we will describe it in the Policy in advance and ask for your separate consent. External artificial-intelligence features are not available in the iOS app.

10. Your rights

You have the right to:

  • — obtain information about your data and access it;
  • — require it to be corrected, blocked or destroyed if it is incomplete, inaccurate, outdated, unlawfully obtained or not needed for the purposes of processing;
  • — withdraw your consent;
  • — challenge our actions or inaction before Roskomnadzor, the Personal Data Protection Agency of the Republic of Armenia or a court.

Time limits — the same for all users:

  • — information about your data, or access to it — within 5 days of receiving your request;
  • — correcting, completing, blocking or destroying data — immediately or, if that is not possible, within 3 working days;
  • — if we refuse, we will send you a reasoned answer citing the law within 5 days of receiving the request; where the law of the Republic of Armenia requires, a copy goes to the Personal Data Protection Agency;
  • — after you withdraw consent by email, we will stop processing and destroy the data within 10 working days, and tell you within 3 working days of the destruction. Data we must keep by law is not destroyed.

Deleting your account. You can delete your account in the settings on the website or in the app: Settings → Security → Delete account. Immediately after the request you are signed out on all devices, your listings are taken off display and moved to the archive, your shops become inactive, your membership of shop teams ends (your “close friends” stories in shops you do not own are deleted within the period stated in the “Retention periods” section and do not come back if you restore the account), and draft listings, an unfinished application to connect a shop and an unsent seller registration form are deleted. You can restore the account within 30 days — just sign in again. Listings and shops are switched back on manually after the restore.

After 30 days we delete the messages you sent, your personal stories together with their archive, the “close friends” stories you published on behalf of your shops, favourites, notifications, delivery addresses, settings, profile (first and last name, gender and date of birth), cart, browser notification subscriptions and applications to connect a shop. The account record is wiped of name, email, phone number, password, profile photo, cover, description, address, links and username. If an email was linked to the account, we will then send a message to it.

What remains:

  • — orders and payments together with the recipient's details, delivery confirmations, returns and disputes, applied promo codes and gift-card payments — for as long as they are needed for accounting and for handling claims;
  • — your shops — inactive, together with their details, addresses, contacts, team, story archive (except your “close friends” stories) and the keys of connected services; they are not deleted by themselves;
  • — reviews, comments and questions about products. Reviews and comments stay visible to other users: for 30 days with your name, afterwards under the label “Deleted User”. Listings stay in the archive; posts are hidden from other users;
  • — follows, followers, blocks and other links with users and shops, hidden story authors, complaints you filed, back-in-stock notification subscriptions;
  • — likes, message reactions and “helpful” marks; saved posts, bookmarks and collections together with their participants and invitations; purchased and installed sticker packs; reservations, price offers and pick-up meetings, including arrival coordinates; participation in conversations and read marks;
  • — the consent log — as proof of consent — and the current state of consents; the link to the external account you signed in with; the city from your profile and the time of your last visit; internal moderation marks; profile photo history; two-factor verification data; personal wallet; the shop's plan; collaborations with shops; disabled push-notification addresses;
  • — support requests, shops' notes about a buyer, information about the products and profiles you viewed, about clicks through collaboration links, about where you came from when you registered, and about the amount and number of your orders;
  • — activity and access logs; the sign-in log — until its retention period expires (the “Retention periods” section);
  • — an identity-verification request; if it has not yet been reviewed — together with the photo of the document.

The profile photo and cover, including earlier ones, and files from messages remain in file storage. Deleted data remains in backups created earlier. If you want these data deleted too, or want the account deleted without a restore period, write to support@ylon.ru (Russia) or support@ylon.am (Armenia) — we will delete them within 10 working days, except for data we are required by law to keep.

How to contact us. Email support@ylon.ru (Russia) or support@ylon.am (Armenia) from the address linked to your account, or send a letter to the address in the “Personal data operator (controller)” section. We may ask you to confirm that the request was sent by the account owner. Information is provided free of charge.

Data breach. If personal data leaks, we will tell you. Within 24 hours we will notify Roskomnadzor, and within 72 hours report the results of our investigation to it. At the same time we will publish a statement and inform the Police of the Republic of Armenia and the Personal Data Protection Agency.

11. Security measures

The Operator takes the organisational and technical measures that are necessary and sufficient to protect personal data:

  • — Encryption of connections to the website and the app (TLS 1.2 and 1.3)
  • — Encryption at rest (AES-256-GCM): of sellers' details — INN (tax ID), KPP, OGRN, BIK, accounts, registered address and the name of the head — and copies of them made during verification; keys of connected services; the two-factor verification secret; the phone number, email, tax number, links and free text of a seller application; contacts of brand and author representatives
  • — Separation of access rights to the information systems that contain personal data
  • — Regular software updates and security monitoring
  • — Data backups

12. Seller application

If you apply to open a shop, we receive the answers of the application form: the contact person's first and last name; a phone number and/or email; a social network link; the company or sole proprietor tax ID (optional); links to your website and your Instagram and Facebook pages; your answers (what products you plan to sell, where you already sell, the order fulfilment model, how you heard about Ylon); a comment; the market country. A record of your consent is stored with the application: the time, a partly masked IP address and browser details.

Why: to contact you, review the application and prepare your shop for launch.

Who sees it: authorised Ylon staff with access to the application system; every reveal of a hidden field is logged. The team learns about a new application from a service notification sent to a corporate mailbox (Yandex 360, Russia): it carries the contact person's name, the country, the chosen answer options and the time of sending — no phone, email, tax ID, links or comment.

How we store it: the phone, email, tax ID, links and free text are stored encrypted. The storage location is described in the “Cross-border transfers” section.

How long: an unfinished application — 30 days from the last change; a rejected application — 12 months from the date of rejection; other applications — until the account is deleted. When the term expires, the application's text data — the name, contacts, form answers and comment — is erased from our database. What remains is the application type, status, the rejection-reason code (without your comment), the country, the dates, and a record of which staff member opened a hidden field and when — without its content. The record of your consent is kept as proof of consent, including after the account is deleted; the team's copy of the application notification email is not erased by this term.

Legal basis: your consent, given with a separate checkbox when you send the form, and steps taken before entering into a contract. For the Republic of Armenia — under the RA Law on Protection of Personal Data; for the Russian Federation — under Federal Law No. 152-FZ “On Personal Data”.

You can withdraw your consent and ask for the data to be deleted — see “Your rights”.

13. Seller registration in the Republic of Armenia

This section applies only to shops that register to sell in the Republic of Armenia and supplements the “Users in the Republic of Armenia” section. The registration form does not apply to shops in the Russian Federation. In this section, “the Law” means the Law of the Republic of Armenia on Personal Data Protection (HO-49-N).

What we receive: the seller type, name and legal form, tax ID (ՀՎՀՀ), state registration number and date, legal and actual addresses, tax regime, and the shop's phone number and email; the surname, first name and position of the organisation's director; the surname, first name, position and basis of authority of the contact person and the signatory of the offer, who are the account owner or the director; bank accounts for payouts; documents for the review: a register extract, proof of authority, account confirmation and others (we do not accept a passport or an ID card); the record of accepting the offer and email confirmation codes; the seller's confirmation that they may name these people in the registration form; the record of the account owner's consent: their surname and first name, a shortened IP address and browser details.

Why and on what basis: to review the seller, conclude and perform the contract (the offer), make payouts, meet tax obligations and show buyers the seller's details. Until the registration form is sent, the account owner's consent. Once the offer is accepted, the contract (Article 9(4)(2) of the Law) if the seller is a sole proprietor: they are a party to the contract themselves. If the seller is an organisation, we process the account owner's data on the basis of their consent, and the information open in the state register as publicly available information. Keeping data after the shop closes: the law (Article 9(5) of the Law, the Armenian Tax Code).

We receive the details of the people the seller named in the registration form (the director, the contact person, the signatory of the offer, people in uploaded documents) from the seller. Without their consent we process only publicly available information: surname and first name (Article 8(1)(2) and Article 11(1) of the Law) and information open in the state register of legal persons and individual entrepreneurs, such as the names of the organisation's director and founders (Article 6(1) of the Armenian Law on State Registration of Legal Persons, State Record-Registration of Separate Subdivisions, Institutions of Legal Persons and Individual Entrepreneurs). The details of a sole proprietor whose registration form was filled in by a representative are processed under the contract with that sole proprietor: the offer accepted on their behalf (Article 9(4)(2) of the Law). We do not ask for other people's phone numbers or emails in the registration form: the contact person and the signatory of the offer are the account owner or the director, and we use the shop's phone number and email to get in touch. Passport details and home addresses in documents can be covered: they are not needed for the review.

Who sees it: authorised Ylon staff who review sellers. Buyers and every visitor to Ylon see the seller's name (for a sole proprietor, their name), legal form, tax ID (ՀՎՀՀ) and state registration number; for a company, also its legal and actual addresses. A sole proprietor's addresses are not shown to buyers or visitors. The details of the director, the contact person and the signatory are not shown to buyers. The recipients that store data and send emails, and state authorities, are listed in the “Recipients” and “Cross-border transfers” sections.

Where it is stored: in Moscow, Russian Federation: the registration form and records on Selectel servers, document files in Yandex Cloud. Russia is on the list of countries with an adequate level of protection approved by the Personal Data Protection Agency of the Republic of Armenia (Article 27 of the Law).

How long we keep it: while the shop operates, for as long as it operates; after it closes, 5 years counted from 1 January of the following year (the Armenian Tax Code). If registration is refused, 12 months after the decision; a registration form that was never sent, 6 months after the last change, and once consent is withdrawn, within 10 working days. When the account is deleted, a registration form that was never sent is deleted at once; a submitted registration form, the documents and the contract data are kept for the periods of this section. Deleted data remains in backups created earlier.

If you were named in a registration form. The seller may have named you as the director, the contact person, the signatory of the offer or the sole proprietor on whose behalf they fill in the registration form. Your details may also appear in uploaded documents: a register extract or a power of attorney. We received these details from the seller, not from you: your surname and first name, position and, for the contact person and the signatory, the basis of authority. The basis for this is set out in the paragraph above. We use them to review the seller and to stay in touch with the seller under the contract, and a sole proprietor's details also to perform the contract with them. Only Ylon staff who review sellers see them; Selectel and Yandex Cloud store them in Moscow; an email service sends the emails; state authorities receive data on a lawful request. Of these details, buyers and every visitor to Ylon see only a sole proprietor's name, tax ID (ՀՎՀՀ) and state registration number; their addresses are not shown. If a representative filled in the registration form for a sole proprietor, we send the sole proprietor a notice at the shop's email. The operator is named in the “Personal data operator (controller)” section. You have the right to find out what data about you we process and where we got it, to access it free of charge, to require us to correct, block or destroy it and to stop processing it, and to challenge our actions before the Personal Data Protection Agency of the Republic of Armenia or in court. If the seller named you without your knowledge, write to us: we will block these details while we check, and if the seller had no right to name you, we will delete them within 3 working days. Write to: support@ylon.am.

14. Showing shop owners

If you are the founder, an owner or an administrator of a shop, we may show your name, username, profile photo, your role in the shop and a link to your profile on the shop page (the “Owners” block and the page header) and in your profile — on the ylon.ru and ylon.am websites and in the Ylon app. This information is visible to an unlimited number of people, including those who are not signed in, and to search engines.

Why: so that buyers can see who runs the shop.

Legal basis: only your separate consent to the dissemination of personal data. We ask for it separately — in the shop settings or after you join the team; showing is off by default. Consent is given for each shop separately. For the Republic of Armenia — under the RA Law “On Protection of Personal Data”; for the Russian Federation — under Article 10.1 of Federal Law No. 152-FZ “On Personal Data”.

How to withdraw: turn off “Show me publicly” in the shop's team settings — showing stops within two minutes. If your role in the shop changes to one that is not shown publicly, or you leave the team, showing stops; if the role is given back, we will ask again.

We keep a record of every consent and withdrawal: the time, the shop, the text revision, a partially masked IP address and browser details.

15. Cookies

Cookies are small files that the website saves in your browser.

Necessary — the website does not work without them:

  • — sign-in session (authjs.session-token) — 30 days;
  • — protection of forms against forgery (authjs.csrf-token) and the return address after sign-in (authjs.callback-url) — until the browser is closed;
  • — trusted device for two-factor verification (trusted_device_id) — 30 days;
  • — selected shop (activeShopId) — 30 days.

Functional — remember your settings:

  • — language (NEXT_LOCALE) — until the browser is closed;
  • — selected language (NEXT_LOCALE_CHOICE) — 1 year;
  • — city and country (NEXT_LOCALE_CITY, NEXT_LOCALE_COUNTRY), interface and form density (ylon_ui_density, ylon_form_density), the view of a shop's storefront and of search results (ylon_shop_grid, ylon_search_view) — 1 year.

The colour theme and the guest cart are kept in the browser's storage (localStorage), not in cookies.

Statistics — only with your consent in the banner:

  • — the Service's own statistics: a random visitor identifier (ylon_aid) — 1 year; advertising referral tags (_ylon_utm) — 30 days; after a click through a collaboration link — a visitor identifier (_ylon_aid) — 1 year and referral details (_ylon_collab) — 30 days;
  • — Yandex Metrica: its cookies and their retention periods are on the “Analytics Cookie Consent” page (/privacy/cookies); after sign-up a mark is set for 10 minutes that Metrica uses to count the registration (ylon_signup_goal).

Your choice in the banner is remembered: consent or refusal (ylon_analytics_consent) — for 1 year, the “later” decision (ylon_consent_later) — until the browser is closed. You can change your choice on the “Analytics Cookie Consent” page.

The Ylon app uses no cookies for statistics: it asks for consent to our own statistics itself and keeps the random identifier and your choice (for 1 year) on the device.

Shops' links pages (an address like /language/page-name on the Ylon website, or the shop's own domain). The counters that a shop has connected — Yandex Metrica with recording of actions on the page (Webvisor), the VK pixel and Google Analytics — are loaded only if you gave consent in that page's banner. The choice is remembered for 1 year (ylon_cookie_consent); the retention periods of the counters' cookies are set by those services. We also count views of these pages and taps on their buttons ourselves. If the shop has connected counters and you gave consent in that page's banner, a view is recorded together with the referral source, advertising tags and a browser fingerprint (a hash of the browser string, language and time zone); otherwise — only the fact of the view or tap itself.

Maps. When a map is shown on the website, it is loaded by the Yandex Maps service. Yandex may store its own cookies, including identifiers, in your browser and receives them — as well as Yandex cookies already in the browser — with the map requests. Yandex decides which cookies these are and how long they are kept; we do not read them. In the app, the map opens in a built-in browser window, and Yandex may store its cookies there.

On the website, the names of sign-in cookies begin with __Secure- or __Host-.

You can delete cookies or block them in your browser settings; without the necessary cookies the website will not work.

16. Children’s data

The Ylon platform is not intended for persons under 18 years of age. We do not knowingly collect personal data from minors. If you become aware that a child under 18 has provided us with their data, please contact us at support@ylon.ru (Russia) or support@ylon.am (Armenia) — we will promptly delete this information.

17. Final provisions

This Policy takes effect from the moment it is posted on the Operator's website and remains in force indefinitely until replaced by a new revision.

We announce changes to the Policy on this page and, if the purposes of processing or the set of data transferred change, by email or in the app. If a new purpose needs your consent, we will ask for it separately. Previous revisions of the Policy are available through the links below.

This Policy is written in Russian. The Operator may publish translations of it into other languages for convenience. A translation is not a separate revision of the Policy: if the Russian text and any translation differ, the Russian text applies, unless the “Users in the Republic of Armenia” section provides otherwise. The date of the last update and the version of the Policy, which determine the revision accepted by the user when giving consent, refer to the Russian text.

18. Contact information

For any questions about the processing of personal data you can contact:

  • — Email (Russia): support@ylon.ru
  • — Email (Armenia): support@ylon.am
  • — Postal address — in the “Personal data operator (controller)” section
  • — Websites: ylon.ru, ylon.am

Response times are in the “Your rights” section.

Supervisory authorities: in the Russian Federation — Roskomnadzor (rkn.gov.ru); in the Republic of Armenia — the Personal Data Protection Agency of the Ministry of Justice of the Republic of Armenia.

19. Users in the Republic of Armenia

This section applies to users located or resident in the Republic of Armenia. It supplements the other sections of this Policy and prevails over them if they conflict. In this section, “the Law” means the Law of the Republic of Armenia on Personal Data Protection (HO-49-N).

Legal basis. Under the Law we process your data:

  • — for your account, profile, orders, messages and service notifications, and for the draft product description and listing that a seller requests by pressing a button — on the basis of the Terms of Use you accept when signing up. Your consent is then deemed given (Article 9(4)(2) of the Law); you also give it by ticking a separate box (Article 8(1)(1));
  • — for analytics cookies (Yandex Metrica), marketing mailings and transcription of voice messages — only with your separate consent, which you can withdraw at any time without deleting your account;
  • — without consent — only where the law expressly provides for it (Article 9(5)), for example at the lawful request of a state authority.

Your profile, reviews, posts, stories and videos that you publish yourself are visible to other users; this is part of the service under the Terms. Merely using the platform is not treated as consent; consent is given only by the actions described above.

Who receives your data. The full list of recipients by purpose is in the “Recipients” section. Data of users in the Republic of Armenia is transferred to the following countries:

  • — the Russian Federation: our servers, the file storage and the network that delivers files, the Operator's mail, the shops you order from or send a request to, payment and delivery services, SMS and email services, address suggestions (DaData), maps (Yandex Maps), Yandex Metrica and the counters of shops' links pages — with your consent, the shop's accounting system (MoySklad) and the WhatsApp gateway (Green API) — if the shop has connected them, sign-in through Yandex ID, VK ID or Sber ID — if you chose it;
  • — the Federal Republic of Germany: the data centre of the error-monitoring service (Sentry);
  • — the United States of America: push delivery (Expo, Apple, Google and, in the browser, the push service the browser chose, for example Google, Mozilla or Microsoft), the company that provides Sentry, WhatsApp (Meta) — if the seller has connected such notifications, Google Analytics on shops' links pages — with your consent, AI features (OpenAI, Groq) — only with your consent or at your own request.

All these countries are on the list of countries ensuring an adequate level of personal data protection (Decision No. ԱՏՊՊ-001/24 of 8 July 2024 of the Head of the Personal Data Protection Agency: Russian Federation — No. 43, Germany — No. 9, United States of America (organisations) — No. 2), so no permission of the Agency is required (Article 27(2) of the Law).

Your data may be transferred to countries not on that list only with the Agency's permission (Article 27(3)). That is why the Telegram notification sent to the seller does not contain your name, phone number or address.

Where your data is stored. Ylon's servers are in the Russian Federation (Moscow), in a Selectel data centre. The photos, videos, voice messages and other files you upload are stored in Yandex Object Storage (Yandex Cloud), also in the Russian Federation. Data of users in the Republic of Armenia is stored there too: there is no separate storage in Armenia or elsewhere yet.

Under the Law this is a transfer of personal data to another country. The Russian Federation is on the list of countries ensuring adequate protection (No. 43), so no permission of the Agency is required (Article 27(2)). The transfer is necessary to provide the service and is also based on the consent you give when signing up (Article 27(1)).

We plan to move the data of users in the Republic of Armenia to separate infrastructure outside the Russian Federation. Before the move we will publish a new version of this Policy and let you know.

Special categories and biometric data. We do not ask for information about your health, religious or political views, ethnicity or other special categories.

We do not automatically identify anyone by their face or voice and do not create biometric templates. If you go through identity verification, a photo of your document is reviewed by a member of Service staff; after the decision on the request the file is deleted. Sign-in with Face ID or Touch ID is performed by your device; biometric data is not sent to us.

Your rights and response times. You have the right to:

  • — obtain information about your data, the purposes and grounds of processing, the operator and its location, and the persons to whom the data may be transferred (Article 15 of the Law);
  • — access your data free of charge;
  • — require us to correct, block or destroy your data if it is incomplete, inaccurate, outdated, unlawfully obtained or not needed for the purposes of processing;
  • — withdraw your consent;
  • — challenge our actions or inaction before the Personal Data Protection Agency or in court and claim compensation (Article 17).

Time limits.

  • — Information about your data, or access to it — within 5 days of receiving a written request (Article 20(1));
  • — completing, updating, correcting, blocking or destroying data — immediately or, if that is not possible, within 3 working days (Article 20(2));
  • — if we refuse, within 5 days of receiving the request we will send you and the Agency a reasoned written decision citing the provisions of law it is based on (Article 20(4));
  • — if you withdraw consent, we will stop processing and destroy the data within 10 working days of the day after we receive the withdrawal, and tell you within 3 working days of the destruction (Article 21(6)). Data we must keep by law is not destroyed.

Deleting your account. When you delete your account on the website or in the app, you choose deletion with a restore option: you can restore the account within 30 days by signing in again. This is our mutual agreement within the meaning of Article 21(6) of the Law. Which data we delete after that period and which data remains is set out in the “Your rights” section. If you want the data destroyed without the restore period, write to support@ylon.am and we will destroy it within 10 working days, except data we are required by law to keep.

How to contact us. Send a written request by post to 40/1 Dzorapi St., Yerevan, Republic of Armenia or by email to support@ylon.am from the email address linked to your account. We may ask you to confirm that you own the account. Information is provided free of charge.

Data breach. If personal data leaks from electronic systems, we will immediately publish a statement and at the same time inform the Police of the Republic of Armenia and the Personal Data Protection Agency (Article 21(4)), and we will notify you.

The authority for personal data protection in the Republic of Armenia is the Personal Data Protection Agency of the Ministry of Justice of the Republic of Armenia.

Language. For users in the Republic of Armenia, this Policy, the Consent to the processing of personal data and the Terms of Use are published in Armenian. The Armenian and Russian texts are equally authoritative; if they differ, the interpretation more favourable to you applies.

Terms of Use