Subprocessors | YallaSalon

Amplitude

Optional consent-gated Business mobile and customer website product analytics; Session Replay remains disabled

Contracting entity: Amplitude, Inc.
Processing region: United States (production Ampli source Zone: us; customer website HTTP V2 US endpoint)
Transfer mechanism: Separate affirmative consent after disclosure of United States processing (UAE PDPL Article 23(1)(b)); Amplitude acts as processor under its Terms and incorporated TOS DPA, with contractual and security safeguards. DPF, SCC and UK Addendum safeguards apply only where their respective laws apply.
Retention or deletion: Application-enforced retention rotates opaque subjects at 18 months and queues each retired subject through the project-scoped User Privacy API v1. The Business mobile production migration was applied and its health RPC was confirmed healthy on 2026-08-12; the mobile runtime continues to fail closed if that health check becomes unhealthy. Customer website analytics has separate consent/deletion controls: delivery payloads expire after seven days and outcome correlations after 90 days. Its SQL migration was confirmed applied by the owner on 2026-10-07. A synthetic request was accepted and scheduled by Amplitude on 2026-08-12, and provider completion was confirmed by the YallaSalon product owner on 2026-08-24. Amplitude documents completion within 30 days.

Material changes

2026-08-12 — Published verified facts for optional consent-gated mobile product analytics. Session Replay remains disabled, and provider deletion completion remains pending.

2026-08-24 — The product owner confirmed completion of the synthetic provider-deletion exercise in the existing US project.

2026-10-07 — Published a separate customer website analytics disclosure. Collection requires its own consent and release verification. Website analytics uses per-browser, per-salon identifiers, the existing US project and shared deletion transport. Website and Business mobile deletion authority remain separate.