Effective date: 10 October 2026 | Version 1.0
This notice explains how personal data is handled when you visit www.yieldframe.app, use the YieldFrame marketing platform or RedEye AI assistant, connect a third-party account, or contact us. It also explains your choices and rights. Features described here apply only where they are actually available and enabled for your account.
1 Who is responsible
YieldFrame is provided by BLACK STAG Korlátolt Felelősségű Társaság, abbreviated BLACK STAG Kft. (we, us). Registered office: 8636 Balatonszemes, Kinizsi utca 13., Hungary. Company registration number: 14-09-320851. Hungarian tax number: 32550717-2-14.
For privacy requests and general enquiries, contact hello@blackstag.hu or write to our registered office, marked “YieldFrame privacy”.
We are a data controller for our own account administration, billing, service security, business communications and website activities. This means we determine why and how that information is used.
Where a business customer supplies or connects personal data for its own marketing activities, that customer normally determines the purposes and we act as its processor. Where the customer is an agency acting for another controller, we may act as a subprocessor. Annex A to the Terms of Service governs that processing. A customer’s own privacy notice explains its marketing activities; this notice does not replace it.
2 Information we handle
Account and business information includes names, work email addresses, roles, business and brand details, billing information, selected plans, preferences and support correspondence. We also record permissions, approvals and changes needed to administer your workspace.
Customer content may include business briefs, websites, research, marketing plans, brand colours and fonts, logos, photographs, advertising copy, campaign drafts, AI conversations, instructions and feedback. Content may contain personal data, including information about employees, customers or people depicted in images.
Connected-account information may include account and property identifiers, account names, authorised users, access tokens, campaign structures and settings, creatives, keywords, audiences, conversion definitions, advertising statistics and analytics reports. Lead or contact information is included only where the relevant feature and permissions are enabled. We do not need your Google or Meta password to connect through OAuth.
Usage and security information may include IP addresses, device and browser details, timestamps, sign-in events, service requests, error records, audit logs and records of automated processing. Public-source research may include professional contact details, website content and public advertising material.
Providing information required to create an account, authenticate a connection or deliver a requested feature is necessary for that feature. Optional fields and permissions can be declined, although the related functionality may then be unavailable.
3 Where information comes from
We receive information from you and your authorised workspace users; from connected advertising, analytics and social platforms; from publicly accessible websites and advertising libraries; and from service providers involved in payments, authentication or support, where applicable.
We also generate information such as classifications, summaries, recommendations and activity records. An AI-generated conclusion is an inference, not necessarily a verified fact. If we collect personal data indirectly for our own purposes, we provide the information required by Article 14 GDPR within the applicable period, unless a lawful exception applies.
4 Purposes and legal bases
Providing the account and requested services. We use necessary information to perform a contract with you, or take steps you request before contracting, under Article 6(1)(b) GDPR. Where you represent a company rather than contract personally, our legitimate interests under Article 6(1)(f) are administering that business relationship and providing access to authorised users.
Billing and compliance. We process invoicing, accounting and legally required records under Article 6(1)(c). Handling and defending legal claims may rely on our legitimate interests in protecting our rights.
Security and service reliability. Detecting abuse, enforcing access controls, investigating failures and maintaining proportionate audit records serve our legitimate interests in protecting customers and operating a dependable service. We assess those interests against individuals’ rights and minimise the data used.
Support and product operation. We process support requests and feedback to deliver the service and resolve problems, relying on the contract where applicable and otherwise our legitimate interests. This does not authorise unrestricted reuse of customer content for model training or advertising.
Optional marketing and tracking. Where consent is required, we request it separately for promotional messages and non-essential cookies or similar technologies. You can withdraw it without affecting the lawfulness of earlier processing. Direct marketing based on another lawful basis is used only where applicable law permits, with a simple opt-out.
Customer-directed marketing processing. For data we handle as a processor, the customer determines and documents the legal basis, notices and necessary consents. An OAuth permission or acceptance of these documents does not itself establish a legal basis for marketing to another person.
5 Connected Google and Meta services
When you connect an account, the authorisation screen identifies the permissions requested. We use the permitted information to deliver the selected user-facing features, such as reporting, analysis, preparation of campaigns or authorised changes. Connecting Google Analytics 4 is distinct from connecting Google Ads; neither connection automatically authorises the other.
Reading data, preparing a draft and changing an external account are different actions. External changes require the authorisation described in the Terms of Service. Permissions must match the functionality enabled. New uses requiring additional permissions or consent will be presented before they begin.
Our use and transfer of information received through Google APIs must comply with the Google API Services User Data Policy, including its Limited Use requirements where applicable. We do not sell connected-account personal data or use it for unrelated advertising. Human access is restricted to authorised purposes such as requested support, security, compliance and permitted service delivery.
You can disconnect an integration in YieldFrame where that control is available, or revoke access with the platform provider. Google permissions can be managed at https://myaccount.google.com/connections. Revocation stops access through the revoked permission; it does not automatically delete previously imported records, cancel a subscription or pause advertisements already running on the external platform. Contact us to request deletion where it is not available in the product.
Google, Meta and other connected platforms also process data under their own policies. Those policies govern their independent activities, including their advertising and attribution systems.
6 AI processing and automated features
When an AI feature is enabled, relevant information may be sent to the AI providers and intermediaries identified in Schedule 1. Depending on the request, this can include your brief, research, campaign settings, performance statistics, selected brand materials, conversation and previous decisions. We limit the information to what the feature needs; credentials and unnecessary personal identifiers must not be included in model prompts.
Schedule 1 lists the providers that receive this information, their processing locations, retention and training use. We do not use customer content to train our own or third-party models, and we do not permit providers to do so under the settings and terms we use. Providers may keep request data for a limited period solely for abuse and security monitoring, as described in Schedule 1. Every paid AI request is recorded in our usage ledger (provider, model, task, time, usage and cost) without secrets or the model’s internal reasoning. Optional data transfers subject to consent will not occur before that consent is obtained.
Background checks may identify unusual spending, measurement problems or possible improvements and generate recommendations. A recommendation may be incorrect or incomplete. Records of its input sources, relevant versions, approvals and resulting actions may be retained for accountability and troubleshooting.
YieldFrame’s ordinary marketing recommendations are not intended to make solely automated decisions about individuals that produce legal or similarly significant effects under Article 22 GDPR. Do not use the service for such decisions, or to infer sensitive personal characteristics, without a separately assessed lawful arrangement. We do not describe campaign optimisation as a guarantee of business results.
7 Research and brand materials
At your direction, YieldFrame may collect and store relevant website pages, public advertisements, images, logos and brand information to build a business knowledge base. Public availability does not make personal data unrestricted, or grant permission to reuse a photograph or a competitor’s creative.
Customers must have a lawful basis for the material they supply or instruct us to collect. Research material and material permitted for creative reuse must be distinguished. If you believe research or a saved asset contains inaccurate or unlawfully used personal data about you, contact us with the relevant source and details.
Do not upload patient files, detailed health information, payment-card credentials, government identity documents, criminal records or other sensitive information unless a separately agreed feature and lawful safeguards expressly support that processing. The service is intended for adults acting in a business capacity and is not directed to children.
8 Cookies and similar technologies
Essential technologies may be used for authentication, session security and preferences needed to provide a requested service. Non-essential analytics or advertising technologies require consent where applicable law requires it; they must not load merely because you continue browsing.
Cookie choices must allow users to reject non-essential technologies and later change their choice. Connecting your own GA4 property does not by itself mean that we use GA4 to track visitors to our own website.
On www.yieldframe.app we use only essential browser storage, set by us (first party): a sign-in session (kept until you sign out or it expires, and refreshed while you use the service); your selected language and active business or workspace (kept until you clear browser data); and the local history of your RedEye assistant conversation (kept until you clear it or your browser data). We do not use analytics or advertising cookies on our own website, so there is no cookie banner or cookie settings link; if that changes, we will ask for your consent first and update this section. Browser controls also allow you to delete or block cookies, which may affect sign-in or other functionality.
9 Recipients and international transfers
Access may be given to authorised personnel, workspace members according to their permissions, and contracted providers of hosting, databases, storage, authentication, AI processing, payments, communications, monitoring and support, to the extent required. Professional advisers, competent authorities or parties involved in a lawful business reorganisation may receive information where necessary and subject to appropriate safeguards.
Providers processing personal data on our behalf must be bound by appropriate contractual obligations. The current provider and transfer information is set out in Schedule 1. We do not treat information from different customer workspaces as a shared customer database.
Where personal data is transferred outside the EEA, we use an applicable adequacy decision or appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, together with additional measures where necessary. An adequacy mechanism is relied on only where the recipient and transfer qualify. Contact us for information about the relevant safeguards or a copy, subject to lawful redactions. The countries and mechanisms are listed in Schedule 1.
10 Retention and deletion
We retain personal data only for the relevant purpose, customer instructions and applicable legal obligations. Information needed for an active account or customer-directed service is retained while needed to provide that service, subject to deletion requests and agreed limits.
Hungarian accounting documents and supporting records subject to statutory retention are generally retained for at least eight years. This does not justify retaining all campaign content, AI conversations or connected-account data for eight years.
Records needed for security investigations, disputes or legal claims may be retained for the relevant investigation or limitation period, restricted to the information needed. Truly anonymised statistics that no longer identify individuals are outside this personal-data retention policy.
The operational periods are: after account closure, customer content and connected-account data are deleted within 30 days of the closure request or the end of the paid period, whichever is later; AI conversation and request logs are kept for up to 12 months, and the cost-ledger entries that carry no prompt content for up to 24 months for accounting and abuse control; security and access logs are kept for up to 12 months; access credentials of a disconnected integration are revoked and deleted within 7 days of disconnection; backups expire and are overwritten within 35 days. AI-provider retention is specified in Schedule 1.
Deletion may occur through the normal backup rotation, with residual copies restricted from ordinary use and deleted on the stated schedule. If a backup is restored, applicable deletion instructions must be reapplied. Data subject to a legal hold is retained only for that obligation. For processor data, the return and deletion provisions in Annex A to the Terms also apply.
11 Security
We apply technical and organisational measures appropriate to the risks, including access restrictions, separation of customer workspaces, protection of authentication credentials and processes for incident management. The processor safeguards are described in Annex A to the Terms. No internet service can promise absolute security. Contact us promptly if you suspect unauthorised access; do not send passwords or access tokens by email.
12 Your rights and complaints
Subject to GDPR conditions, you may request access, correction, deletion, restriction and portability of your personal data. You may object to processing based on legitimate interests and may always object to processing for direct marketing. You may withdraw consent at any time where processing relies on it.
Send requests to hello@blackstag.hu. We may request proportionate information to verify identity. We normally respond within one month. If a lawful extension is necessary, we explain the reason within that month; the extension can be up to two further months. Requests are normally free, subject to the GDPR exceptions for manifestly unfounded or excessive requests.
If we hold your information solely on a customer’s instructions, please contact that customer as controller. We will assist the controller and forward requests as appropriate rather than independently changing its records without authority.
You may complain to a supervisory authority, particularly where you live, work or where the alleged infringement occurred. Our Hungarian authority is the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), 1055 Budapest, Falk Miksa utca 9–11., Hungary; website: https://www.naih.hu/. Contacting us first is optional.
13 Changes to this notice
We will update the effective date when this notice changes and give appropriate notice of material changes. A notice update does not replace consent where consent is required for a new purpose. The current version must be available on www.yieldframe.app.
Schedule 1 Provider and transfer register
The following register identifies the recipients used for the deployed service, with their function, data categories, processing locations, retention and transfer mechanism. Providers not used by a customer’s enabled features must not receive that customer’s data for those features.
Hosting, database storage and authentication: Lovable Cloud (Lovable), which runs on managed database, authentication and edge-hosting infrastructure (Supabase and Cloudflare as its infrastructure providers). Data: account details, workspace content, connected-account data and audit logs. Processing location: the European Union for the database; edge delivery may occur in other countries. Retention: as in section 10. Transfers outside the EEA rely on an adequacy decision or the Standard Contractual Clauses.
AI gateway and model providers: the Lovable AI Gateway, which routes requests to model providers such as OpenAI (text and image generation) and Google (embeddings). Data: only what the requested feature needs (brief, research, campaign settings, statistics, selected brand material, conversation). Training use: none. Providers may retain request data for a short period for abuse and security monitoring only, under their API terms. We keep our own request records as described in section 10. Transfers outside the EEA rely on an adequacy decision (for example the EU–US Data Privacy Framework where the recipient is certified) or the Standard Contractual Clauses.
Payments and invoicing: Stripe Payments Europe, Ltd. (Ireland) processes card payments and subscriptions as an independent controller for payment, fraud-prevention and regulatory purposes. We receive subscription status and limited billing details, not full card numbers. Invoices and accounting records are kept as required by Hungarian law (section 10).
Email, support and error records: support correspondence is handled through our own business mailbox (hello@blackstag.hu). Service errors and audit records are stored in our own database and hosting logs; we do not use a separate third-party error-reporting or advertising-tracking service.
Connected advertising and analytics platforms: Google for enabled Google Ads or GA4 connections; Meta only for an enabled Meta connection. For users in the EEA, the contracting entities are Google Ireland Limited and Meta Platforms Ireland Limited. Data flows from these platforms to us are read-only reporting and account data; YieldFrame does not publish social content, and Google Ads changes are made only in accounts where you have switched on write access and after your confirmation. These platforms transfer data internationally under their own safeguards. These platforms may act as independent controllers for their own activities rather than our subprocessors.
For new subprocessors handling customer-controlled personal data, the notice and objection process in Annex A to the Terms applies.