Data Processing & Sub-processors
Operated by Yallo Management Consultancies L.L.C, registered office: Office G06-344, The Exchange Tower, Business Bay, PO Box 231525, Dubai, UAE · Last updated: 27 October 2026
1. Who this page is for
Organisation customers whose personnel use Yallo AI academy under Team, Enterprise or Custom plans. It summarises the processing relationship and lists sub-processors. A Data Processing Agreement (DPA) is available on request from support@yallo.co. Yallo AI academy is operated by Yallo Management Consultancies L.L.C, registered office Office G06-344, The Exchange Tower, Business Bay, PO Box 231525, Dubai, UAE.
2. Roles per data set
| Data | Your organisation | Yallo |
|---|---|---|
| Seat assignment; assigned-learning progress, scores, Skill Score growth, certification status | Controller | Processor |
| Learner accounts; privately purchased learning | None | Controller |
| Billing contacts, order and invoice records | Controller (its personnel data) | Independent controller (its own records) |
| Certificate verification register | None | Controller (credential integrity) |
3. Processing commitments
- Process organisation-controlled data only on documented instructions; the portal's documented functions constitute the standing instruction set.
- Personnel with access are bound by confidentiality.
- Technical and organisational measures include: TLS in transit, hashed sign-in tokens, role-based access, server-side-only grading, immutable audit logging, server-side state validation, secrets held server-side, environment separation, backups and monitoring.
- We assist with data-subject requests relating to assigned-learning data and, on reasonable request, with your data protection impact assessments.
- Breach notification: we will notify you without undue delay after becoming aware of a breach affecting your organisation's data, with the information reasonably available to support your own notifications.
- End of contract: deletion or return of organisation-controlled data within 60 days, excluding records we must retain (invoices; the audit entries underpinning issued certificates, which remain to keep verification pages truthful).
4. Sub-processors
| Sub-processor | Service | Data touched | Region |
|---|---|---|---|
| Vercel | Application hosting, edge delivery and cookie-free web analytics | All platform traffic; page views (address without query strings, except campaign tags such as utm_source), referrer, country, device and browser type | Frankfurt, Germany (application); content delivered from a worldwide network |
| Neon | Managed Postgres database | Accounts, learning records, audit log | Frankfurt, Germany (AWS) |
| DigitalOcean (Spaces) | File storage for lesson resources and course images | Uploaded files, course images | London, United Kingdom |
| Gumlet | Video hosting and streaming | Playback requests, viewer tokens, video files | Worldwide delivery network |
| Resend | Transactional email: sign-in links, verification codes, notifications | Name, email, notification content | Ireland (EU) |
| "Sign in with Google" | Name, email, profile picture | United States | |
| DigitalOcean (App Platform) | Hosting for the Yallo booking scheduler (book.saasinator.ai) | Booker name, email, chosen slot | DigitalOcean data centre |
| Cloudflare | Cookie-free web analytics for this site | Page views (address without query strings or private codes), referrer, country, device and browser type, page load times; IP address in transit | Worldwide network |
| Paddle.com | Merchant of record: checkout, payment processing, sales tax, invoicing and refunds for all orders | Name, email, country, billing address, order and payment details (card data is held by Paddle, never by Yallo) | United Kingdom and worldwide payment networks |
| Cloudflare | Network delivery and security for the booking scheduler | Booker IP address and request data | Worldwide network |
When AI features launch, the AI provider will be added to this list.
Changes: we keep this list up to date on this page and, where practicable, notify organisation customers before a new sub-processor is added. You may raise reasonable data-protection concerns with support@yallo.co.
5. International transfers
Sub-processing takes place in Germany, Ireland, the United Kingdom and the United States, with some delivery through worldwide networks. Where the law requires it, transfers rely on appropriate safeguards, such as contractual protections or recognised transfer mechanisms.
6. Audits and contact
Organisation customers may request a summary of our security measures on reasonable request. Contact: support@yallo.co.