Privacy Policy
Last updated: 26 September 2026
1. Introduction
This Privacy Policy describes how Ylon LLC (hereinafter "we", "Platform") collects, processes, stores, and protects the personal data of Ylon marketplace users. We process data in accordance with Federal Law No. 152-FZ "On Personal Data" of the Russian Federation, the Law of the Republic of Armenia "On Protection of Personal Data", and other applicable legislation. By using the platform, you consent to the processing of your data in accordance with this Policy.
2. Data Collected
We collect the following categories of data: account data (name, email, phone number, profile photo); order data (delivery addresses, purchase history, preferences); assistant data (the text of your requests to the assistant and the standing preferences it remembers from them with your consent — see section 6); device data (IP address, browser type, operating system, screen resolution); interaction data (viewed products, search queries, time on platform); seller data (business details, banking information for payouts, shop information). Buyer bank card data is processed by the payment provider (YooKassa/Robokassa) and is not stored on our servers.
3. Purposes of Processing
We process your data for: contract fulfillment (order processing, delivery, returns); service improvement (usage analysis, A/B testing, bug fixes); personalization (product recommendations, feed customization); operation of the assistant (selecting products for your request and, with your consent, remembering your preferences); communication (order notifications, support responses, marketing with consent); security (fraud prevention, detection of suspicious activity, blocking violators); legal compliance (accounting, responding to requests from authorized bodies).
4. Data Storage
Personal data is stored on servers located in the Russian Federation. For users in the Russian Federation, processing is carried out in accordance with Federal Law 152-FZ. For users in the Republic of Armenia, storing data on servers in the Russian Federation constitutes a cross-border transfer and is carried out on the basis of the consent you gave at registration and for the performance of our contract with you. Account data is retained until the user deletes their account. Order data is retained for 3 years from the last activity (in accordance with accounting requirements). Logs and analytics data are anonymized after 12 months. Retention periods for assistant data are set out in section 6. We use AES-256 encryption to protect sensitive data and TLS 1.3 for all connections.
5. Third-Party Sharing
We share data with the following categories of recipients: sellers — name, delivery address, and contact details for order fulfillment; payment systems (YooKassa, Robokassa) — data for payment processing; delivery services (CDEK) — recipient address and contact details; analytics services — anonymized data for platform improvement; an artificial intelligence technology provider (Anthropic, USA) — the text of your request to the assistant and part of your preferences, and only if the assistant's extended mode is enabled and you have given separate consent to it; your account identifiers are not transferred, and special categories of data are never transferred; authorized government bodies — upon lawful request. We do not sell personal data to third parties or share it for advertising targeting purposes.
6. The Assistant and Its Memory
Ylon offers an assistant that selects products for your request. To make its advice more accurate, it can remember standing preferences: your usual budget, city, favourite categories and brands, household composition, convenient times. Each such statement is stored as a separate entry — you can view, correct, or delete any of them in settings. The memory works only with your consent and can be switched off at any moment. Without it the assistant still answers, but forgets the context once the conversation ends. Entries you do not confirm for a long time weaken automatically: after 180 days without confirmation an entry loses weight and is eventually archived. Data from the current conversation (city, budget, who you are with) lives for 30 minutes and is not written to the database. A log of issued recommendations is kept for 90 days and serves to handle enquiries and improve the quality of selection. Information about dietary restrictions, allergies, health, and religious beliefs belongs to special categories of personal data. The assistant uses it only with your separate consent and never transfers it outside our infrastructure — it reaches no external provider, including the artificial intelligence technology provider. In extended mode the assistant calls an external artificial intelligence model. In that case the text of your request and part of your preferences are transferred outside the Russian Federation — without your name, phone number, or any other identifier of your account. Such transfer is possible only with your separate consent, which you may withdraw in settings; after withdrawal the assistant continues to work on the platform's own algorithms. The assistant does not take decisions producing legal consequences for you. Its recommendations are advisory; the final choice is always yours.
7. Seller Application
If you apply to open a shop, we receive the answers of the application form: the contact person's first and last name; a phone number and/or email; a social network link; the company or sole proprietor tax ID (optional); links to your website and your Instagram and Facebook pages; your answers (what products you plan to sell, where you already sell, the order fulfillment model, how you heard about Ylon); a comment; the market country. A record of your consent is stored with the application: the time, a partly masked IP address and browser details. Why: to contact you, review the application and prepare your shop for launch. Who sees it: authorised Ylon staff with access to the application system; every reveal of a hidden field is logged. The team learns about a new application from a service notification sent to a corporate mailbox: it carries the contact person's name, the country, the chosen answer options and the time of sending — no phone, email, tax ID, links or comment. How we store it: the phone, email, tax ID, links and free text are stored encrypted. The storage location is described in section 4. How long: an unfinished form — 30 days from the last change; a rejected application — 12 months from the date of rejection; other applications — until the account is deleted. When the term expires, the application's text data — the name, contacts, form answers and comment — is erased from our database. What remains is the application type, status, the rejection-reason code (without your comment), the country, the dates, and a record of which staff member opened a hidden field and when — without its content. The record of your consent is kept as proof of consent, including after the account is deleted; the team's copy of the application notification email is not erased by this term. Legal basis: your consent, given with a separate checkbox when you send the form, and steps taken before entering into a contract. For the Republic of Armenia — under the RA Law on Protection of Personal Data; for the Russian Federation — under Federal Law No. 152-FZ “On Personal Data”. You can withdraw your consent and ask for the data to be deleted — see “Your Rights”.
8. Showing Shop Owners
If you are the founder, an owner or an administrator of a shop, we may show your name, username, profile photo, your role in the shop and a link to your profile on the shop page (the “Owners” block and the page header) and in your profile — on the ylon.ru and ylon.am websites and in the Ylon app. This information is visible to an unlimited number of people, including those who are not signed in, and to search engines. Why: so that buyers can see who runs the shop. Legal basis: only your separate consent to the dissemination of personal data. We ask for it separately — in the shop settings or after you join the team; showing is off by default. Consent is given for each shop separately. For the Republic of Armenia — under the RA Law “On Protection of Personal Data”; for the Russian Federation — under Article 10.1 of Federal Law No. 152-FZ “On Personal Data”. How to withdraw: turn off “Show me publicly” in the shop's team settings — showing stops within two minutes. If your role in the shop changes to one that is not shown publicly, or you leave the team, showing stops; if the role is given back, we will ask again. We keep a record of every consent and withdrawal: the time, the shop, the text revision, a partially masked IP address and browser details.
10. Your Rights
In accordance with applicable law, you have the right to: obtain information about the processing of your data; request a copy of all your personal data; request correction of inaccurate data; withdraw consent to data processing; request deletion of all your data (right to be forgotten); request restriction of data processing. To exercise any of these rights, contact support at support@ylon.ru. We will process your request within 30 days.
11. Children's Data
The Ylon platform is not intended for persons under 18 years of age. We do not knowingly collect personal data from minors. If you become aware that a child under 18 has provided us with their data, please contact us at support@ylon.ru — we will promptly delete this information.
12. Policy Changes
We may update this Privacy Policy from time to time. You will be notified of material changes via email or in-app notification. The current version of the Policy is always available on this page with the date of the last update.
13. Contacts
For questions regarding personal data processing and privacy, please contact us: email — support@ylon.ru. Data Protection Officer — Ylon LLC. Supervisory authorities: for the Russian Federation — Roskomnadzor (rkn.gov.ru); for the Republic of Armenia — the Personal Data Protection Agency of the Ministry of Justice of the RA (foi.am).