Privacy Policy

This policy is issued by Yellow Monk Technologies LLP, LLPIN AAY-1244, registered office 3 Kalpataru, Kishor Suryawanshi Marg, MERI, Nashik, Maharashtra 422003, India, which operates SquareUp. It is the data fiduciary and controller for the personal data described here, and you can reach it at hello@joinsquareup.com or +91 86684 62386.

We collect what the product needs to run: your account email, your store's data, and the conversations your storefront has with its shoppers. Merchants own their store data.

We don't sell personal data. Conversations are processed by the AI provider configured for your store solely to generate responses. Secrets you store with us (API keys, SMTP passwords, payment credentials) are encrypted at rest.

Fraud screening on stores you buy from

When you place an order on a store hosted by SquareUp, that merchant may screen the order for payment fraud. If the merchant connects a screening partner (such as Signifyd, NoFraud, or FraudLabs Pro), the order's email, amount, and your IP address are shared with that partner for the single purpose of scoring that order. The lawful basis is the merchant's legitimate interest in fraud prevention. Never your card number: payments happen on the payment provider's own secure page. Each store's connected partners appear in its data disclosure, and a deletion request to the merchant covers this data too.

Audience enrichment for stores you buy from

If a merchant turns on audience enrichment, SquareUp may share a hashed(one-way, non-reversible) version of the email or phone you gave that store with an identity-resolution partner (currently FullContact and People Data Labs) only to help the merchant recognize and better understand their own customers. We never share your raw email, phone, card, or the contents of your order, and a match is used only when it meets a strict confidence threshold. The lawful basis is the merchant's legitimate interest in understanding their customers, subject to your rights below. Each store's connected partners appear in its data disclosure, and a deletion request to the merchant covers this data too.

When you ask to get in

When you raise your hand to get in, we collect the email you enter, your brand name if you add it, your website if you add it, your phone number if you add it, and the page you came from. We use this only to contact you about access to our invite-only beta. The lawful basis is your consent and our legitimate interest in following up on a request you started. Raising your hand does not subscribe you to marketing; that only happens if you tick the separate opt-in box.

We keep your request for up to 24 months. If you do not become a customer, you can ask us to delete it sooner. You can request access to, correction of, or deletion of your information at any time by emailing hello@joinsquareup.com. We honor Do Not Track signals on this site.

Marketing emails, only if you opt in

We send marketing email only to people who asked for it. There are two streams you can choose: the useful stuff (tips to sell more and keep customers) and Same Store, More Sales, our monthly newsletter. The waitlist checkbox opts you into the tips; the newsletter uses double opt-in, so you also confirm from a link we email you. We never add the people already on our waitlist to marketing without a fresh opt-in.

The lawful basis is your consent where consent is required (the EU, EEA, UK, and India) and our legitimate interest elsewhere, and you can withdraw any time: every email has a one-click unsubscribe, and the preference center lets you turn each stream on or off on its own. We keep a record of when and how you opted in (and out) as proof of consent, even after we erase the rest of your data. Unsubscribing is separate from deleting your data; you can do either. Marketing email is sent from a dedicated sending subdomain through our email provider acting on our behalf, kept apart from your order and account emails.

When you talk to Sage

Sage is the seller on the front of a SquareUp store, and you can chat with it on this site by typing or, if you choose, by voice. If you speak to it, your browser asks your permission for the microphone first, and your audio is sent to our voice partners only to turn your speech into text and to speak the reply back. We do not store your recordings. What you type or say is used only to answer you in the moment; we may keep a short note of what you asked so we can improve the experience. Do not share sensitive personal details in the chat.

How we measure this page

While we are in invite-only beta, we measure how people move through this page so we can improve it: we set a first-party measurement cookie (a random id, not your name or email, up to 12 months, never shared) and, if configured, Google Analytics with your IP anonymized and ad personalization off. It never receives your name or email. In regions with prior-consent rules (the EU, EEA, UK, and India), none of this runs until you say yes; elsewhere it runs by default and you can opt out anytime from the Cookie settings link in the footer. If your browser sends a Do Not Track or Global Privacy Control signal we do not run any of it, for the cookie and Google Analytics alike.

What we record is the page and section you view, how long you spend, and the clicks and choices you make (including the problems you pick, which we use to tailor what this page shows you). If you later give us your email, we connect it to your earlier visits so we can follow up about your interest. The detailed browsing events are kept for up to 365 days and then deleted automatically; your funnel and lead history are kept. Ask us to delete your data at hello@joinsquareup.com and we remove your events and unlink your visit history.

When you try the demo

The live demo sets its own first-party cookie the first time you act in it (a random id, not your name, up to 180 days, never shared). It connects what you do in the demo, the pages, the questions you ask the store, and the moves you make in the console, into one trail. If you give us your email there, we link that trail to it so we can follow up about your interest, and your email is kept in one place. Demo browsing events are kept for up to 365 days and then deleted automatically. Ask us to delete your data at hello@joinsquareup.com and we remove your demo trail and unlink your email.

Payments

We never see or store your full card number. Payments are handled on the payment gateway's own secure, PCI-DSS compliant page, and we keep only what we need to show you a receipt and to reconcile the order: the amount, the currency, the status, the gateway's reference, and the last four digits and card type where the gateway returns them. Where you save a payment method for a subscription, the gateway holds it and gives us a token, never the card itself.

Who is responsible for what

For your SquareUp account and this website, Yellow Monk Technologies LLPdecides how your data is used and is responsible for it. For a store built on SquareUp, the merchant who runs that store decides how their shoppers' data is used, and we process it on their instructions. If you shopped at a store and want your data changed or removed, ask that merchant first. Write to us at hello@joinsquareup.com if you cannot reach them and we will help.

How long we keep things, and how we protect them

Account and store data is kept while your account is open and for up to 90 days after you close it, so you can change your mind, unless the law requires us to keep a record longer. Financial records are kept for as long as tax law requires. Browsing and demo events are deleted automatically after 365 days. Waitlist requests are kept for up to 24 months. Proof of a marketing opt-in is kept even after the rest is erased, because it is the evidence that your consent was real.

Data is encrypted in transit and at rest. Secrets you store with us are encrypted separately with their own keys. Access inside our team is limited to the people who need it to run the service. We host on cloud infrastructure in the United States and in India, so your data may be processed outside the country you are in, under contractual protections with each provider.

Your rights

You can ask us for a copy of your data, ask us to correct it, ask us to delete it, withdraw a consent you gave, or object to a use you disagree with. Email hello@joinsquareup.com and we will respond within 30 days. If you are not satisfied, you can complain to the data protection authority in your country.

Children

SquareUp is not for children. We do not knowingly collect data from anyone under 18. If you believe a child has given us data, write to hello@joinsquareup.com and we will delete it.

Changes to this policy

If we change how we use your data in a way that materially affects you, we will email you before it takes effect. The date at the top of this page always shows the current version.

Contact and grievances

Yellow Monk Technologies LLP
3 Kalpataru, Kishor Suryawanshi Marg, MERI, Nashik, Maharashtra 422003, India
hello@joinsquareup.com · +91 86684 62386

Our grievance officer under the Digital Personal Data Protection Act, 2023 is Param Jain, Designated Partner, reachable at hello@joinsquareup.com. We acknowledge every grievance within 24 hours and resolve it within 15 days.

Merchants who need a data processing agreement for their own compliance can request one at hello@joinsquareup.com.