Privacy policy
Effective date:
This policy explains what we collect when you use ynkincubator.com or the 3PL intake at intakes.ynkincubator.com, why we collect it, who handles it for us, how long we keep it and what you can ask us to do with it. It also covers the emails we send in reply. It doesn’t cover the operations data of brands that ship with us, which is governed by each client agreement.
Who we are
YNK Incubator, LLC (“YNK”, “we”, “us”), 465 Mola Blvd, Dock 10, Elmwood Park, NJ 07407, United States. We decide what is collected and why, which makes us the data controller for everything on this page. Email contact@ynkincubator.com or call +1 (888) 532-2880 with any question about your data.
What we collect, and why
Quote requests and the 3PL intake
When you send the contact form or fill in the intake, we collect what you type: your name, work email, phone number, company, what you sell, your order volumes, channels and current setup, your answers about how you ship, and any files you upload, such as a rate card or a shipment export. The contact form also records the page you were on, the page you arrived from, and any campaign tags in the link you clicked, so we know which ad or search brought you.
We use it to reply, to write your proposal, and to set up your account if you sign. The legal basis, where one is required, is taking steps before a contract at your request, and our legitimate interest in answering a business inquiry. Nothing is used for marketing lists, and we don’t add you to a newsletter.
Where it goes: by email to the 3PL team, into a Google Sheet and private file storage that only the team can open through expiring links, and into Grow, the lead tracker we run ourselves at admin.ynkincubator.com. Nobody outside YNK and the providers below sees it.
How long: 24 months after our last contact with you, then it is deleted. If you become a client, it becomes part of your account record and follows the client agreement instead.
“Finish later” drafts and your receipt
If you ask the intake to email you a link to finish later, we store your answers so far under a random token and send that link, once, to the address you give. Anyone with the link can open the draft, which is why the email says to keep it to yourself. Drafts are deleted 90 days after they are saved. When you submit the intake we email you a copy of your answers with a link that lets you add files afterwards; that link is signed so only you can use it.
Measurement
Two tools count visits. Vercel Web Analytics, on both sites, counts page views and the events we care about (a click on “Get a quote”, a tap on our phone number, a form sent) without cookies and without an identifier that follows you across sites; it uses a hash that changes daily and is never tied to what you type into a form. The Google tag, on both sites, is Google Ads conversion measurement plus Google Analytics. It sets cookies so Google can tell us which ads and searches lead to a quote request, whether that’s the form or a tap on our phone number. It doesn’t receive the contents of any form.
If you are in the European Economic Area, the United Kingdom or Switzerland, the Google tag doesn’t load until you say yes in the banner, and saying no costs you nothing. Everywhere else it loads with measurement on, and you can turn it off at any time with in the footer of every page. If your browser sends a Global Privacy Control signal, advertising measurement stays off without you doing anything. Your choice is kept in your browser for a year and then we ask again.
Server logs and abuse prevention
Vercel, which hosts both sites, keeps short-lived request logs (IP address, browser, time, page) to run and secure the service. The intake also counts “finish later” requests per IP address for an hour, in memory, so a script can’t use it to send email. Our own application logs record a submission’s reference number and outcome, never the answers.
Cookies and browser storage
| Name | Set by | What it does | How long |
|---|---|---|---|
| ynk_consent | Us (cookie on ynkincubator.com, plus browser storage) | Remembers your measurement choice on ynkincubator.com and the intake | 1 year |
| ynk_ft, ynk_lt | Us (cookies on ynkincubator.com) | The first page you landed on and the ad, search or site that brought you, so a quote request or intake carries its source. Set only where advertising measurement is on | 90 days |
| ynk_first_touch | Us (session storage) | The page you landed on and where you came from, so a quote request carries its source | Until the tab closes |
| ynk_quote_received | Us (session storage) | Carries the contact details you typed into the contact form over to the intake hand-off so you don’t retype them | Until the tab closes |
| ynk_intake_done | Us (session storage, intake) | The reference number, brand, email and phone from the intake you just sent, so the thank-you page can show them and count the request once | Until the tab closes |
| ynk_conversion_fired | Us (session storage) | The reference of a request that has already been counted, so a refresh of the thank-you page isn’t counted twice | Until the tab closes |
| _ga, _ga_* | Google Analytics | Tells one visitor from another in visit counts | 2 years |
| _gcl_au, _gcl_aw, _gcl_gs | Google Ads | Links a quote request to the ad click that led to it | 90 days |
| IDE, test_cookie | Google (doubleclick.net) | Google’s conversion measurement, only when advertising measurement is on | Up to 13 months |
The intake saves your answers in your own browser as you go (local storage), so a closed tab doesn’t lose them. That copy never leaves your device until you submit.
Who processes data for us
- Vercel (United States): hosting, private file storage for uploads and drafts, and Vercel Web Analytics.
- Google (United States): the Google Sheet the team works from, and, with your consent where it is required, Google Ads and Google Analytics. Google explains how it uses data from sites that use its services at policies.google.com/technologies/partner-sites.
- Resend (United States): sends the team’s notification, your receipt and the finish-later link.
Each of them acts on our instructions as a processor. We don’t sell your data, and we don’t share it with anyone for their own marketing.
Where it is stored
We are in the United States and your data is stored and processed here. If you are in the EEA, the UK or Switzerland, that is a transfer outside your region; our providers commit to the EU standard contractual clauses, or are certified under the EU-US Data Privacy Framework, for the data they handle for us.
Your rights
Wherever you are, you can ask us for a copy of what we hold about you, have it corrected, have it deleted, or object to how we use it. Email contact@ynkincubator.com. We reply within 30 days, and we may confirm the request by replying to the email address we have on file. There is no charge.
- EEA, UK and Switzerland: you also have the rights to restrict processing, to data portability, to withdraw consent at any time (for the Google tag, under “Your privacy choices”), and to complain to your data protection authority. In the UK that is the Information Commissioner’s Office. We have no establishment in the EU; contact us directly at the address above.
- California: you have the rights to know, to delete, to correct, and to opt out of the sale or sharing of personal information. We don’t sell it. Google’s advertising measurement may count as “sharing” under California law, so the opt-out is “Your privacy choices” in the footer, and we honor Global Privacy Control signals. We never treat you differently for exercising a right.
Security
Everything travels over TLS. Uploads and drafts live in private storage and are reached only through signed, expiring links. Access to the Sheet, the lead tracker and the mailbox is limited to the 3PL team, behind two-factor authentication.
Children
These sites are for businesses. We don’t knowingly collect data from anyone under 16, and we delete it if we learn we have.
Changes
We update this page when what we collect or how we handle it changes. The effective date at the top is the date of the last change.
YNK Content Launcher (an internal Meta app)
YNK Content Launcher is an internal, first-party business analytics application operated by YNK. This section explains what the application processes, how and why, how it is stored and secured, and how to request its deletion. It covers the application and all related services, including data accessed through Meta’s platform (Facebook and Instagram).
Who uses it
YNK Content Launcher is built and used solely by YNK staff to analyze the performance of YNK’s own brands. It is not a consumer product. There is no public sign-up and no Facebook Login. Only authorized YNK staff access the internal portal.
What it processes
The application reads data only from YNK’s own brand assets (currently the Nominal and Veiled brands), which YNK owns and manages inside its own Meta Business Manager:
- Instagram Business account data of YNK’s own brand accounts: basic profile metadata (such as account ID and username) and account-, media- and story-level insights (such as reach, views and engagement).
- Facebook Page data of YNK’s own brand Pages: Page metadata, content posted by the Page, content the Page is tagged in, and Page engagement metrics and insights.
- Advertising data for YNK’s own ad accounts: read-only ad performance and spend metrics.
- Business asset relationships within YNK’s own Business Manager, used to bind the application to the correct owned Pages, Instagram accounts and ad accounts.
- Operational credentials required to make these calls, specifically a Meta Business Manager System User access token and the app secret.
It does not collect or store consumer personal data. It has no end-user login and does not capture the names, email addresses, profile pictures or Meta user IDs of consumers, followers or any third party, and it does not export follower information for marketing.
How and why
One purpose: internal performance analytics for YNK’s own brands. The application assembles each brand’s own published content and aggregate metrics into an internal library and dashboards used by YNK staff. All access is read-only reporting on assets YNK owns. The application does not post, comment, moderate, delete or otherwise modify any content or asset on Meta’s platform.
Storage, security, sharing and deletion
Data is stored in our own backend on Postgres (Neon) and Vercel Blob. Platform data, including the Meta System User access token and app secret, is encrypted at rest with AES-256-GCM application-layer encryption in addition to the provider’s disk encryption, and all data in transit crosses public networks over TLS 1.2 or higher. Access is restricted to authorized YNK staff behind multi-factor authentication, with an audit log of access and administrative events. We do not sell, license, rent or trade any of it, and the only external parties are the infrastructure providers (Neon and Vercel), acting as processors on our instructions.
We keep it only as long as the analytics purpose needs it. Data tied to a brand is purged when that brand relationship ends or sooner on request, and we delete platform data when it is no longer necessary, when a brand or Meta requests it, or when required by law, within 120 days at most. To request deletion, see the data deletion instructions or email contact@ynkincubator.com. We process this data in accordance with applicable laws and Meta’s Platform Terms and Developer Policies.