Complete the controller identity, live provider inventory, retention periods, international-transfer details, cookie controls and automated-decision statement. Verify them against actual hosting and contracts; these items cannot be established from a sales page alone. Square-bracketed fields require verified information. Effective date: [INSERT PUBLICATION DATE].
1. Who is responsible
This policy covers YellYeah’s website, purchase and licence administration, member services, optional AI service and support. The controller responsible for these activities is:
- Legal operator
- [FULL LEGAL NAME], trading as YellYeah / Coollexx
- Business address
- [PUBLIC BUSINESS ADDRESS], Netherlands
- Registration
- [KVK NUMBER OR VERIFIED REGISTRATION STATUS]
- VAT
- [VAT IDENTIFICATION NUMBER OR VERIFIED VAT STATUS]
- support@support-mail.yellyeah.com
- Telephone
- [BUSINESS CONTACT NUMBER]
For privacy questions or requests, email support@support-mail.yellyeah.com with “Privacy request” in the subject. This policy does not replace the privacy notice you need for a website or mailing list you operate using YellYeah.
If you use the software on your own hosting, you generally control the campaign and visitor data stored there. We do not receive every project or visitor record merely because you installed a plugin. Connected services, licence checks, AI requests and information you send to support involve separate data flows described below. Where YellYeah processes personal data solely on your business’s instructions, an appropriate data-processing agreement must govern that processing.
2. Information used and its purpose
| Activity | Information involved | Purpose and proposed legal basis |
|---|---|---|
| Orders and licences | Name, purchase email, billing details handled by checkout, order and licence identifiers, payment status and permitted-site details. | Deliver purchases and manage access: performance of the contract. Required accounting records: legal obligation. Fraud or abuse checks: legitimate interest in protecting the service. |
| Funnel Club | Account email, verification status, core and Club licence identifiers, connected site URLs, pairing and access-token records, and relevant service events. | Provide membership and controlled downloads, verify eligible installations and protect access: contract and legitimate interest in service security. |
| Support | Email address, message contents, attachments, order reference, technical details and ticket history. | Provide purchased support: contract. Answer other enquiries and investigate faults or complaints: legitimate interest in customer service and product reliability. |
| Requested free resources | Email address, request and confirmation status and relevant timestamps. | Fulfil your request and prevent misuse: legitimate interest in providing the requested resource, subject to your rights. |
| Optional marketing | Email address, consent wording/version, opt-in and confirmation times, subscription status and withdrawal record. | Send the updates you opted into: consent. Maintain a minimal suppression record: legitimate interest in honouring opt-outs and applicable compliance duties. |
| Optional AI | Submitted brief, selected page text, image prompt and any reference you choose; service/account identifiers, request status, usage and credit records, and generated results. | Perform the generation you request and administer its allowance: contract. Detect abuse, diagnose failures and reconcile charges: legitimate interest in operating a reliable service. |
| Website operation | Technical connection and security information such as IP address, request time, browser information and errors, to the extent recorded by the configured host and services. | Deliver pages, keep the site secure and investigate faults: legitimate interest. Optional tracking or embedded-content storage: consent where required. |
We obtain information from you and from the services involved in fulfilling your request, such as checkout payment status or licence verification. If you do not provide information essential to deliver a purchase, verify an account or process a request, we may be unable to complete that action. Optional marketing consent is not required to purchase or use the core software.
3. What happens when you use AI
Using an enabled AI feature sends the material needed for that request through YellYeah’s connected server-side service to the configured AI provider. A website design request uses the relevant text brief and page text; it does not automatically send all images in your project. A separate image-generation or editing request may include the reference image you expressly supply.
Only submit information and images you have permission to use. Remove unnecessary personal, confidential or sensitive data first. Local editing and ordinary image uploads can be used without requesting AI generation. If you take a downloadable prompt to another AI service yourself, that service’s terms and privacy notice govern that separate submission.
Request and credit records may be checked to resolve failures, disputed charges or abuse. Generated suggestions require your review before application and publication. Automated licence and credit checks can restrict a particular feature when its entitlement is unavailable; contact support if you believe a decision is wrong.
AI provider and account-specific processing: [CONFIRM ACTIVE PROVIDER — CURRENT INTEGRATION IS INTENDED FOR OPENAI — LEGAL ENTITY, PROCESSING REGIONS, RETENTION, TRAINING/DATA-SHARING SETTINGS AND PRIVACY LINK]. This draft does not promise zero retention, EU-only processing or exclusion from training without verified account and contract settings.
4. Service providers and disclosures
Information is disclosed only for the relevant purpose and to the extent needed by the recipient. Providers may act as our processors or as independent controllers for their own defined activities. The final provider list and those roles must match the services actually enabled.
| Function | Provider / confirmation required | Relevant information |
|---|---|---|
| Website, member and AI-service hosting | [LEGAL PROVIDER NAME, LOCATION, ROLE AND PRIVACY LINK] | Hosted account, content, service and technical records. |
| Checkout and licence administration | [CONFIRM FREEMIUS LEGAL ENTITY / PAYMENT PARTNERS, ROLE AND PRIVACY LINK BEFORE ACTIVATION] | Order, billing, transaction and licence/installation information. |
| Support email delivery | Resend delivery has been verified. [CONFIRM CONTRACTING ENTITY, PROCESSING TERMS, REGION AND PRIVACY LINK] | Recipient and sender information, support/receipt content and delivery records. |
| Support ticket hosting | [CONFIRM SUPPORT PLATFORM OPERATOR AND HOST, ROLE AND PRIVACY LINK] | Support messages, attachments and ticket records. [CONFIRM WHETHER AI-ASSISTED DRAFTING IS ENABLED AND ANY RELATED RECIPIENT.] |
| Newsletter and resource emails | [ACTIVE EMAIL SERVICE, ROLE AND PRIVACY LINK; REMOVE UNUSED PLANNED PROVIDERS] | Email address, consent and subscription status, messages and delivery information. |
| AI generation | [CONFIRMED AI PROVIDER AND PROCESSING TERMS] | Request material, relevant identifiers and generation results. |
| Embedded video and optional analytics | YouTube is used for video embeds. [CONFIRM GOOGLE ENTITY/PRIVACY LINK AND ANY ACTIVE ANALYTICS OR ADVERTISING SERVICES] | Connection information and, where enabled and permitted, device identifiers or tracking data. |
We may also disclose relevant records to professional advisers or competent authorities where necessary for legal obligations, disputes or the protection of lawful rights. We do not grant a service provider permission to use your submitted material for an unrelated purpose through this notice.
5. International processing
A provider may process information outside the European Economic Area. Where this happens, the transfer must use an applicable legal mechanism, such as an adequacy decision or approved contractual safeguards with any necessary supplementary measures. You may ask us about the safeguards for your data and how to obtain relevant information or a copy.
Actual transfer destinations and mechanisms: [INSERT VERIFIED PROVIDER-BY-PROVIDER TRANSFER DETAILS]. A provider’s brand name or an EU website address does not establish where all processing occurs.
6. How long information is kept
Retention depends on the reason for processing, the duration of the service, legal record-keeping and any active dispute. Information needed for a legal claim may be retained for that purpose with restricted access after routine use ends. Backup copies follow the verified backup schedule.
| Record | Retention position to apply and verify |
|---|---|
| Orders, invoices and essential transaction records | [INSERT APPLICABLE ACCOUNTING PERIOD AND START POINT; DISTINGUISH SELLER RECORDS FROM PROVIDER RECORDS] |
| Club accounts, licence links and connected sites | While required to provide the account and paid service, followed by [APPROVED CLOSURE/DELETION PERIOD]. Retain only what is needed for legal obligations, access disputes or security. Removing a plugin is not an account-deletion request. |
| Support tickets and attachments | [APPROVED PERIOD AFTER TICKET CLOSURE], unless a specific ongoing issue or legal duty requires longer retention. |
| Unconfirmed YellYeah Leads records | The supplied plugin schedules deletion after 7 days. [VERIFY THAT THE LIVE SCHEDULE RUNS AND WHETHER THE EMAIL PROVIDER RETAINS A COPY.] |
| Confirmed YellYeah Leads records | The supplied plugin schedules removal of the email address from records older than 730 days. A minimal keyed suppression value can remain; this is not a claim of irreversible anonymisation. [VERIFY LIVE BEHAVIOUR AND CONNECTED PROVIDER DELETION.] |
| Unsubscribe / suppression records | A minimal record is retained as needed to honour your opt-out and avoid accidental re-enrolment. [SET A REVIEW PERIOD AND DOCUMENT THE CONTINUING NEED.] It is not used to continue marketing to you. |
| AI design results | Current design-service results have a roughly 24-hour availability window. This does not establish the deletion time of provider logs, credit ledgers, image-service records or backups. [CONFIRM THOSE SEPARATE PERIODS.] |
| Security logs and backups | [CONFIRMED LOG PERIOD], [CONFIRMED BACKUP CYCLE AND MAXIMUM DELETION DELAY]. |
These operational values must describe the deployed service. A cleanup schedule in plugin code is not a guarantee that the hosting scheduler has executed it. Account deletion may require a separate request and does not erase records we are legally required to retain.
7. Cookies, video and similar technologies
The site may need storage for essential functions such as a signed-in session, security or remembering your privacy choice. Optional embedded video, analytics and advertising technologies must be identified and controlled according to the applicable consent requirements.
YouTube embeds can send connection information to Google when loaded. Where consent is required, the embed and its optional storage must remain blocked until the appropriate choice is made. Rejecting optional technologies must not prevent access to the ordinary public information on the site.
Cookie controls: [INSERT THE WORKING COOKIE-PREFERENCE CONTROL AND VERIFIED COOKIE/STORAGE INVENTORY, INCLUDING PROVIDER, PURPOSE AND DURATION]. Browser controls can also remove or block stored information, though this may affect sign-in or other functionality.
8. Email choices
Requesting a checklist and subscribing to ongoing marketing are separate choices. We use the recorded optional marketing permission for the communications described when you opted in. You can withdraw that permission through the unsubscribe link or by emailing us. Withdrawal does not make earlier consent-based processing unlawful.
Essential purchase, security, membership and support messages may still be sent when necessary to deliver or administer your service. We do not treat unsubscribing from marketing as cancellation of a paid membership.
9. Your privacy rights
Depending on the applicable law and circumstances, you can ask to access and receive a copy of your personal information, correct it, erase it, restrict its use or receive portable data. You can object to processing based on legitimate interests and to direct marketing. You can withdraw consent at any time where consent is the basis.
Email support@support-mail.yellyeah.com. We may ask for proportionate information to verify that the request concerns your data; do not send identity documents unless we explain why they are necessary and agree a suitable method. We normally respond to GDPR requests within one month. If a lawful extension is needed, we will explain it within that initial period. Some requests are subject to legal exceptions, which we will explain.
You can complain to the Dutch Autoriteit Persoonsgegevens at autoriteitpersoonsgegevens.nl or another competent supervisory authority. You do not have to contact us first, although we welcome the opportunity to address your concern.
Automated decisions or profiling with legal or similarly significant effects: [CONFIRM WHETHER ANY EXIST; IF THEY DO, DESCRIBE THE LOGIC, EFFECTS AND APPLICABLE HUMAN-REVIEW RIGHTS]. Routine feature-access checks are described above; this draft does not assume the configuration of checkout fraud tools.
10. Security, children and policy updates
We use safeguards appropriate to the information and risks involved and limit access to people and providers who need it for their role. No system can guarantee absolute security. Report suspected exposure or misuse to our support address without sending additional sensitive data.
YellYeah’s purchasing and account services are intended for adults and authorised business users, not directed at children. If you believe a child has supplied personal information without the necessary authority, contact us so we can investigate and take appropriate action.
We will update this notice when our practices or services change and show the effective date. If a change requires fresh consent, posting a revised notice alone will not be treated as that consent.