Effective date: 10 October 2026 | Version 1.0

These Terms govern access to YieldFrame at www.yieldframe.app, including the RedEye AI assistant and enabled marketing, analytics and campaign-management features. They explain what you authorise, how charges work and the responsibilities of both parties. Annex A forms the data processing agreement for customer-controlled personal data.

1 Provider and business customers

The provider is BLACK STAG Korlátolt Felelősségű Társaság, abbreviated BLACK STAG Kft. (YieldFrame, we, us). Registered office: 8636 Balatonszemes, Kinizsi utca 13., Hungary. Company registration number: 14-09-320851. Hungarian tax number: 32550717-2-14. Contact: hello@blackstag.hu.

The service is offered for business and professional use. You must be at least 18 and have authority to bind the business identified in the account or order (Customer, you). An agency must also have authority to manage each client brand and connected account. These Terms do not remove mandatory rights that apply if a customer legally qualifies as a consumer.

2 Contract and scope

A contract is formed when you accept these Terms through the service and we confirm account activation or the applicable order. Before placing a paid order, you must be able to review and correct the selected plan, price and billing details. We provide confirmation and the applicable Terms in a form you can retain. The contract language is English unless separately agreed.

Your order or accepted plan specifies available features, fees, usage allowances and subscription period. These Terms govern the general relationship; a signed order prevails for expressly agreed commercial differences. Annex A prevails for customer-data processing. The Privacy Notice explains our privacy practices and is not blanket consent to process information for any purpose.

Only features actually made available under your plan are included. References to Google, Meta, AI automation or other integrations do not promise that every platform, campaign type or action is supported. Roadmap statements are not contractual delivery commitments unless expressly agreed in writing.

3 Accounts brands and authority

You are responsible for accurate business details, appropriate user roles and protecting your credentials. Notify us promptly of suspected misuse. We remain responsible for our own security obligations and for access controls within our service.

Check the business, brand, advertising account and analytics property selected before granting access or approving changes. A single external account may contain campaigns for different businesses; an account name alone does not establish ownership. We must not knowingly transfer one customer’s data to another brand or workspace without appropriate authority.

You may use the service for your own business and for clients you are authorised to represent. You are responsible for obtaining those clients’ permissions and complying with applicable advertising, intellectual-property and data-protection requirements.

4 What the service does

Depending on the enabled features, YieldFrame can research a business, retain brand materials, import platform data, analyse performance, prepare marketing plans and campaign drafts, suggest improvements and assist with authorised campaign management. Analysis may run on a schedule without your browser remaining open.

Data freshness depends on platform availability, permissions, reporting delays and service operation. We must distinguish unavailable or incomplete data from a measured zero, and distinguish simulated results from live analysis. We do not guarantee uninterrupted access to an external API or immediate platform reporting.

Google, Meta and other providers operate independently. Their terms, policies, review processes and technical limitations also apply. YieldFrame is not those providers and does not imply their sponsorship or endorsement.

5 Drafts approvals and external actions

An internal draft or saved edit does not itself launch a campaign or change an external platform. Approval of a business brief or marketing plan is not permission to spend money. Connecting an account through OAuth grants technical access, not unrestricted authority to use that access.

Where external creation is supported, the action must identify the target business and account and state whether it creates a paused campaign or launches one. A paused campaign created on Google Ads is a real platform campaign, not merely an internal draft. It is not authorised to run merely because its draft was approved.

Starting, pausing, editing or removing an external campaign requires your explicit instruction for the proposed action, or a separate automation permission covering that action and its limits. A clear instruction in the assistant can authorise preparation of the change; the interface must identify when the next action will affect the external account or spending.

Approval applies to the presented settings and version. A material change to the budget, destination account, targeting, content or campaign objective requires renewed approval unless it falls within an automation permission you have expressly granted. Automatic draft saving is not external approval.

Where automation is offered, its scope must specify the affected accounts or campaigns, permitted actions, spending limits and how to disable it. Revoking it stops future actions within our control but may not recall a request already accepted by a platform. We keep an activity record of external instructions and results.

If an external request has an uncertain outcome, the service must verify its status before repeating a potentially duplicate or chargeable action. Partial completion, rejection and an unknown outcome must be communicated accurately. Platform removal can be irreversible; the interface must explain that consequence before execution.

6 Budgets advertising charges and performance

Advertising charges are separate from YieldFrame fees and AI usage charges. Unless an order expressly states otherwise, you contract with and pay the advertising platform directly. You remain responsible for properly authorised platform expenditure.

We must explain whether an amount is a planning estimate, daily average, monthly estimate or a platform-enforced total budget. An internal planning figure is not a guaranteed external spending cap. Platform pacing, taxes, currency, time zone and billing rules may differ, and we must not represent a limit as enforceable unless the relevant integration supports and applies it.

You must have an opportunity to review the account, currency, budget, schedule, objective and material campaign settings before launch. A platform may continue charging until a pause or removal takes effect. Disconnecting YieldFrame, cancelling a subscription or deleting a draft does not automatically stop advertisements already running.

Forecasts, attributed conversion values and platform ROAS are estimates or platform measurements, not verified revenue or profit. AI recommendations do not guarantee approval, sales, leads, return on spend or any minimum result. These limitations do not excuse our failure to implement an authorised instruction with reasonable care.

7 AI assistance and customer review

RedEye and other AI features may generate strategies, keywords, exclusions, copy, images, settings, explanations and recommendations. Outputs may be inaccurate, incomplete, unsuitable, non-unique or inconsistent with platform policy. We apply appropriate validation, but neither validation nor model output guarantees correctness.

You must review material business claims, offers, regulated content, audience choices and expenditure before approving publication or launch. We must make the material proposed action understandable; these Terms do not transfer responsibility for our own software errors to you.

We may use the contracted AI providers disclosed in the Privacy Notice to perform requested features, subject to applicable permissions and Annex A. Provider use must follow the disclosed data and training policy. Acceptance of these Terms is not separate consent for undisclosed model training or unrelated data sharing.

The service does not provide legal, medical, tax or investment advice. Do not use it for unlawful profiling or decisions about individuals requiring safeguards not supplied by the service.

8 Content and intellectual property

You retain your rights in Customer Content, including briefs, uploaded materials, campaign data and your business information. You grant us a non-exclusive licence to store, process, adapt, display and transmit that content only as necessary to provide the service, execute your instructions and meet legal obligations. Contracted providers may exercise those rights only as needed for the authorised service.

As between you and us, you may use generated deliverables for your business, and we assign any rights we hold in those deliverables to you upon payment of applicable charges. This does not transfer our software, models, templates or pre-existing tools, and does not guarantee that an AI output is copyrightable or free of third-party rights.

You must have the necessary rights and lawful basis for content you supply or instruct us to collect. Publicly available images, competitor advertisements and partner logos are not automatically licensed for your advertising. Research access is distinct from permission to reuse an asset. You must not remove ownership or provenance information to bypass reuse restrictions.

We retain rights in the YieldFrame software, branding and underlying service. During the contract, you receive a limited right to use it for the authorised business purposes. No broader licence is granted.

9 Fees credits trials and cancellation

The applicable order or checkout must state the price, currency, taxes, billing frequency, included usage, any credit system and renewal terms before you accept it. Subscription fees, model usage and advertising spend are separate charges. No price or allowance is implied by this document.

Automatic renewal applies only where its period and price basis have been disclosed and accepted. You may cancel renewal through the available account control or by contacting hello@blackstag.hu. Unless otherwise stated in the order, cancellation takes effect at the end of the paid period and access continues until then. We confirm receipt of a cancellation request.

A trial converts to a paid plan only on the basis of clearly disclosed and accepted conversion terms. Credit expiry, overage charges and automatic top-ups apply only if disclosed before purchase and expressly accepted where required. We will not treat an estimated AI cost as a guaranteed maximum unless that maximum is actually enforceable.

Payment dates and any usage-based billing are set out in the order. We may suspend paid features for overdue undisputed charges after reasonable notice and an opportunity to resolve the issue. A good-faith billing dispute does not remove the obligation to pay undisputed amounts.

Except for mandatory rights, service defects, our breach, or a refund expressly provided in these Terms or an order, cancellation does not create a right to a refund for an already supplied service period. If we discontinue a prepaid service without your breach and without an equivalent agreed alternative, we refund the unused prepaid portion. Third-party advertising charges are governed by the platform’s terms.

Current plans, prices (VAT included where shown) and included AI credits are shown on the pricing section of www.yieldframe.app and in the Billing page of your account, where you can also start or change a subscription at checkout. AI credits included in a plan apply to the billing period in which they are granted and do not carry over unless the plan states otherwise. Plans have no minimum commitment beyond the billing period you have paid for. Unlimited AI use applies only to a plan or account expressly designated as such and remains subject to the safety and fair-use controls described in these Terms.

10 Acceptable use and confidentiality

You must not use the service for unlawful advertising, fraud, infringement, unauthorised account access, malicious code, spam, prohibited discrimination or evasion of platform restrictions. You must not upload highly sensitive personal data unless a separately agreed feature and lawful safeguards support it. Reasonable security testing requires prior written coordination.

Each party must protect the other’s confidential information and use it only for this relationship. Disclosure is permitted to personnel, advisers and contracted providers who need it and are bound by appropriate obligations, or where law requires it. Information lawfully public, independently developed or lawfully received without restriction is excluded. Where legally permitted, the disclosing party gives notice of compelled disclosure.

11 Service care support and suspension

We will provide the service with reasonable professional care and address reported material defects. Support is available through hello@blackstag.hu. A specific response time, uptime percentage or service credit applies only if agreed in an order or service-level agreement.

Maintenance, security threats, connectivity failures and third-party outages may affect service. We will communicate material known interruptions as reasonably practicable. A separately identified beta feature may have additional limitations disclosed before use; it is not a basis to waive mandatory obligations.

We may restrict access proportionately where necessary to address a security threat, unlawful use, serious contractual breach or a legal requirement. Where practicable, we give notice, explain the reason and allow remediation. Urgent restrictions may take effect immediately, followed by notice where legally permitted.

12 Termination and data handling

Either party may terminate for a material breach not remedied within 14 days after written notice, where the breach can be remedied. Immediate termination is permitted where required by law or justified by a serious non-remediable breach. Ending a subscription does not discharge charges already properly incurred.

Before closing an account, export the information you need and review any campaigns still running on external platforms. The post-termination export window is 30 days after the account closes. We will provide available customer data in a commonly used format on a reasonable request, subject to access rights and legal requirements.

Customer-data return and deletion follow Annex A and the Privacy Notice. Records required by law or necessary for legitimate claims may be retained with restricted use. We do not withhold a data subject’s statutory rights because of a commercial dispute.

13 Liability

Each party is responsible for its own breaches of contract and applicable law. For business customers, and to the extent permitted by law, each party’s aggregate contractual liability arising from the service is limited to the YieldFrame fees paid or payable under the affected contract in the 12 months before the event giving rise to the claim. Advertising-platform spend is not a YieldFrame fee.

To the extent permitted by law, neither party is liable for indirect or consequential loss, including speculative lost profit. No exclusion or cap applies to intentional wrongdoing, liability for death or injury to life, physical integrity or health, fraud, payment obligations, or liability that law prohibits limiting. These Terms do not restrict data subjects’ rights or statutory compensation under the GDPR.

The risk of ordinary advertising performance does not create a right to reimbursement solely because results are disappointing. However, describing platform expenditure as your responsibility does not exclude our liability for an unauthorised action or failure to follow an authorised instruction, subject to the lawful limits above.

14 Changes and notices

We may update these Terms for legitimate changes to the service, law or commercial arrangements. For a material adverse change, we give at least 30 days’ advance notice where practicable and allow cancellation before it takes effect. Shorter notice may apply where necessary for law or urgent security, with reasons explained.

Price changes apply prospectively at renewal or as expressly agreed, not retroactively. A terms update does not silently expand external-action authority, remove a spending limit or substitute for required consent. Notices may be delivered to the account email or through the service; maintain current contact details.

15 Law and disputes

Hungarian law governs these Terms, subject to mandatory rules that cannot lawfully be excluded. Please send complaints to hello@blackstag.hu with sufficient detail for investigation. We will acknowledge and address them within a reasonable time and any applicable statutory deadline.

Disputes may be brought before the courts competent under applicable jurisdiction rules. Nothing limits mandatory consumer protections where they apply or the rights of data subjects to contact a supervisory authority or court. If a provision is unenforceable, the remaining provisions continue to apply to the extent legally possible.

Annex A Data processing agreement

A1 Parties roles and scope

This Annex applies when BLACK STAG Kft. processes personal data on the Customer’s behalf to provide YieldFrame. The Customer is the controller, or an authorised processor acting for an identified controller; BLACK STAG Kft. is respectively a processor or subprocessor. Each party’s independent controller activities are governed separately by applicable law and the Privacy Notice.

The subject matter is provision of the contracted marketing platform. Processing lasts for the service and applicable return or deletion period. Its nature includes collection, import, storage, organisation, analysis, generation of marketing outputs, authorised transmission, support, return and deletion. Its purpose is to deliver the Customer’s documented instructions through enabled features.

Data subjects may include the Customer’s authorised users, business representatives, personnel, website visitors, prospects, customers and people appearing in supplied materials. Data may include identity and professional contact details, online identifiers, account and campaign identifiers, engagement and conversion data, permitted lead information, content and images. Processing depends on the enabled features and permissions. Special-category and criminal-offence data are excluded unless separately agreed in writing with appropriate safeguards.

A2 Instructions and confidentiality

We process the data only on documented instructions, including these Terms, the accepted order, authorised settings and individual requests. Instructions for transfers outside the EEA must comply with Chapter V GDPR. If law requires other processing, we inform the Customer before processing unless legally prohibited. We inform the Customer if an instruction appears to infringe applicable data-protection law and may suspend that instruction while it is resolved.

The Customer is responsible for the lawfulness of its instructions, notices and legal bases, and for authority to appoint us where it acts for another controller. Persons authorised to process the data must be subject to confidentiality obligations and access restrictions appropriate to their roles.

A3 Technical and organisational measures

We must implement measures appropriate under Article 32 GDPR, taking account of the nature of the data, risks and available technology. These include access control and least privilege; separation of customer workspaces; protection of tokens and secrets; secure transmission; appropriate protection of stored data; vulnerability and change management; access and action logging; incident response; and measures for backup, recovery and deletion.

The implementation details are: data is encrypted in transit (TLS) and encrypted at rest by the hosting provider; each customer workspace is separated by database access rules so that users see only workspaces they belong to; roles and permissions are stored and enforced on the server; access tokens for connected platforms are kept server-side and never shown in the browser; external advertising accounts are read-only unless write access is deliberately switched on for that account and each change is separately confirmed and logged; paid AI requests and external changes are recorded in audit logs; access by our staff is limited to authorised purposes and reviewed periodically; backups are kept for up to 35 days and can be used to restore the service after an incident. We may improve measures without materially reducing protection. No certification is represented unless expressly identified and verified.

A4 Subprocessors

The Customer gives general written authorisation for the subprocessors actually identified in the completed provider register in Schedule 1 of the Privacy Notice at contract formation. An uncompleted register does not authorise undisclosed recipients. We impose equivalent applicable data-protection obligations on subprocessors and remain responsible for their performance of those obligations.

We give at least 30 days’ prior notice of an intended addition or replacement and an opportunity to object on reasonable data-protection grounds. The parties will seek a reasonable alternative. If an objection cannot be resolved, the Customer may terminate the affected feature before the change, with a refund of its unused prepaid fees. A recipient acting independently, such as an advertising platform for its own purposes, is not described as our subprocessor merely because an integration exists.

A5 Assistance and incidents

Taking account of the processing and information available, we assist the Customer with data-subject requests, security duties, breach assessment and notifications, impact assessments and prior consultation under Articles 32 to 36 GDPR. We promptly forward requests concerning customer-controlled data and do not respond substantively except on instruction or where law requires.

We notify the Customer without undue delay after becoming aware of a personal-data breach affecting its data. We provide available details about the nature of the breach, affected information and people, likely consequences, contact point and measures taken or proposed, and supplement them as information becomes available. Notification is not delayed until an investigation is complete.

A6 Demonstrating compliance

We make available information reasonably necessary to demonstrate compliance with this Annex and allow and contribute to audits, including inspections, by the Customer or its mandated independent auditor. Routine audits should use reasonable notice, confidentiality protections and measures to protect other customers. These arrangements must not prevent a legally required audit, urgent investigation or supervisory-authority access.

A7 Return deletion and transfers

At the end of the processing services, at the Customer’s choice, we return or delete its personal data and delete existing copies unless applicable law requires storage. The operational export and deletion periods must match the completed Privacy Notice and order. Backup copies remain restricted until deletion through the disclosed rotation; they must not be reused for unrelated purposes. We provide confirmation on request.

We must not make a restricted international transfer without a valid Chapter V mechanism. Where Standard Contractual Clauses are needed, the appropriate modules and annexes must be executed and any required supplementary measures applied. This Annex is not itself the European Commission’s transfer Standard Contractual Clauses and does not replace them.

The obligations in this Annex continue for as long as we retain customer-controlled personal data. Nothing in it reduces the obligations or rights imposed directly by applicable data-protection law.