Privacy Policy

For merchants and supplier accounts. Effective date: 25 April 2026

1. Who we are

Yuzu (“we”, “us”, “our”) operates the orderyuzu.com platform — a B2B provisioning marketplace where superyacht crew procure goods from vetted suppliers. This policy describes the personal data we collect from merchants (you, your staff who use the seller dashboard, and the contact people you list on your business profile) when you operate a Yuzu shopfront.

A separate privacy policy applies to buyers — see app.orderyuzu.com/privacy.

For questions about this policy, contact privacy@orderyuzu.com.

2. Data we collect

We collect the following categories of data:

Account dataName and email of the person registering, password (hashed), account creation date, and preferred language for emails.

Business profileTrading name, registered country, business address, VAT number (where supplied), phone number, website, and a short description of your business.

Banking detailsIBAN, BIC, account name, sort code or routing number — supplied only if you opt to receive bank transfer payments. Encrypted at rest with a key not stored alongside the data.

Stripe Connect dataA Stripe account ID is stored against your profile after you complete onboarding. We do not store payout amounts or balances — Stripe holds those.

CatalogueProducts you list (name, unit, list price, photos, descriptions, tax codes). Photos are stored on Cloudinary; product text is indexed in Algolia so buyers can search it.

Order dataQuote requests received, items quoted, prices, shipments, deliveries, and any credit notes issued. Includes buyer name, vessel name, and delivery address per order.

CommunicationsEmails we send you (quote notifications, payment confirmations, fee invoices) and any support messages you send us.

Usage dataPages visited inside the seller dashboard, search queries, browser/device type, IP address. Used to improve the product.

Location dataApproximate latitude/longitude of your storefront, displayed on the buyer map. This is set from your business address when you save your profile.

3. How we use your data

We use your data to:

Operate your seller account, listings, and order processing on the platform.
Route quote requests from buyers to you and notify you when action is needed.
Process payments via Stripe Connect and bank transfer; issue platform-fee invoices to you each month.
Display your storefront, products, and approximate location to buyers searching the platform.
Send transactional emails — quote requests, payment confirmations, monthly fee invoices, occasional product announcements relevant to merchants.
Detect and prevent fraud, abuse, and security incidents.
Meet our legal obligations (tax records, KYC for merchants who request bank-transfer payouts, financial regulations).
Improve and develop the platform using aggregated, anonymised analytics.

We do not sell your data and we do not use it for advertising or profiling outside of Yuzu.

4. Legal basis for processing (GDPR)

If you are based in the European Economic Area, UK, or Switzerland, we process your data under the following legal bases:

Contract performanceOperating your seller account, listing your products, routing orders, and processing payouts.

Legitimate interestsPlatform security, fraud prevention, product analytics, sending merchant-relevant announcements.

Legal obligationRetaining financial records, complying with KYC/AML and tax law.

ConsentAnything beyond the above — for example marketing emails from us, which we currently do not send.

5. Who we share your data with

We share data with the third parties necessary to operate the platform. All sub-processors are contractually bound to protect your data.

Buyers on YuzuWhen a buyer browses the marketplace they see your trading name, country, approximate location, products, prices, and any ratings they have left for you. When you confirm an order, the buyer receives your contact details on the order PDF.

StripePayment processing and payouts via Stripe Connect. Stripe holds your full banking and tax-residency data under their own privacy policy. We receive only a Stripe account ID and a payout status. stripe.com/privacy

Brevo (Sendinblue)Transactional email delivery. Your email address and name are passed to Brevo to send seller emails. brevo.com/legal/privacypolicy

CloudinaryHosting for product photos you upload. We do not send your personal data to Cloudinary — only the image bytes. cloudinary.com/privacy

AlgoliaProduct search index. Your product names, descriptions, and prices are indexed so buyers can find them. Algolia receives no personal data about you as an individual. algolia.com/policies/privacy

RailwayCloud infrastructure hosting our API and database. Data is stored on Railway's EU-region servers. railway.app/legal/privacy

SentryError monitoring. JavaScript errors and stack traces are sent to Sentry to help us fix bugs. No analytics or session-replay. sentry.io/privacy

We may disclose data to law enforcement or regulatory authorities if required by law.

6. Data retention

We retain your data for as long as your account is active, plus:

Order & fee-invoice records7 years — required by financial regulations in most jurisdictions.

Banking detailsHeld for as long as you operate as a merchant. Removed within 30 days of account closure, except where a pending payout requires longer retention.

Account dataDeleted within 30 days of a verified account deletion request, except where retention is legally required.

Usage logsRolling 90-day window, then automatically purged.

Email logs12 months, then automatically purged.

7. Your rights

Depending on your location you may have some or all of the following rights:

Access — request a copy of the personal data we hold about you.
Rectification — ask us to correct inaccurate data.
Erasure — request deletion of your data (subject to legal retention obligations).
Portability — receive your data in a structured, machine-readable format.
Objection — object to processing based on legitimate interests.
Restriction — ask us to pause processing while a dispute is resolved.
Withdraw consent — where processing is based on consent, you may withdraw at any time without affecting the lawfulness of prior processing.

To exercise any right, email privacy@orderyuzu.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

8. Cookies & tracking

The seller dashboard uses a session cookie to keep you signed in and a language-preference cookie. See our cookies page for the full list and your consent options. We do not use advertising cookies, third-party tracking pixels, or fingerprinting.

9. Changes to this policy

We may update this policy from time to time. Material changes will be notified by email and the effective date above will be updated. Continued use of the platform after the effective date constitutes acceptance of the revised policy.

10. Contact

All privacy enquiries should be directed to: privacy@orderyuzu.com.

Yuzu • orderyuzu.com