Privacy Policy

1. Who we are

We are the company behind this website and the Yielde platform. Section 18 explains how to reach our Information Officer.

2. Our two roles: responsible party and operator

POPIA gives roles by function, not by label (POPIA section 1).

• A responsible party decides why and how personal information is processed.
• An operator processes personal information for a responsible party under a contract or mandate, without coming under that party's direct authority.

One business can be both, for different sets of information. That is our position.

What this means for you.

• If you are a Yielde platform customer, your end-users' and leads' personal information remains under your control as the responsible party. We process it only on your instructions and only under the DPA, the written operator contract POPIA section 21(1) requires.
• If you deal with Yielde directly (as a visitor, an enquirer, or as a customer for your own contact and billing details), we are the responsible party and this policy governs that relationship.

If the platform's own signed agreement (the platform DPA) and this policy say different things about the platform, the one that gives our customer and the people whose information it is more protection applies.

3. Our commitments under POPIA

POPIA builds lawful processing on eight conditions. We commit to all eight.

• Accountability (section 8). We take responsibility for meeting these conditions, both when we decide why and how we process and throughout the processing.
• Processing limitation (sections 9 to 12). We process personal information lawfully, minimally and on a recognised legal ground. Consent is only one of six grounds in section 11(1). We rely on the right ground for each purpose, not on consent by default. Section 6 lists our grounds.
• Purpose specification (sections 13 and 14). We collect personal information for specific, explicitly defined, lawful purposes. We keep records no longer than necessary (section 13 of this policy).
• Further processing limitation (section 15). We do not use personal information for a new purpose that is incompatible with the one it was collected for.
• Information quality (section 16). We take reasonably practicable steps to keep personal information complete, accurate and up to date.
• Openness (sections 17 and 18). We keep records of our processing. When we collect personal information, we tell you what POPIA requires, including any transfer outside South Africa and the level of protection in the destination country (section 18(1)(g)).
• Security safeguards (sections 19 to 22). We secure personal information with appropriate, reasonable technical and organisational measures (section 14 of this policy).
• Data subject participation (sections 23 to 25). We give you the rights in section 16 of this policy.

We do not sell personal information.

4. What we collect when we are the responsible party

4.1 When you visit yielde.dev

• Server logs. Our hosting provider, Vercel, records standard request logs when you visit: IP address, browser (user agent), the page requested and the time. We use them for security and debugging.
• Error monitoring. Your browser contacts our error-monitoring service, Sentry, each time a page loads. It sends short records of the visit: a random visit ID, the time, and your browser's identifying string, which shows your browser and device type. These records hold no name or email address. Sentry also sees your IP address when your browser connects to it. When something on a page breaks, Sentry receives a report about the error: the page address, your browser and device type, and the technical details of the error. For a sample of page loads it also receives timing data about how the page loaded. Before a report leaves our code, the code removes secrets and cookies, masks email addresses, and masks phone numbers written in international format (starting with +, such as +27).
• No visitor-analytics or advertising tools. We don't use visitor-analytics or advertising tools. The only monitoring data our site sends to another company is the error, session and page-speed data that Sentry receives (above). Vercel Web Analytics and Speed Insights are built into our code but switched off. Their code is in the files your browser downloads from our site, but it does not run, so they collect nothing. We will not switch them on without first updating this policy and our Cookie Policy, and giving notice as section 21 sets out.
• Cookies and browser storage. See section 19 and our Cookie Policy.

4.2 When you contact us or ask for a demo

• The forms on this website. The short form asks for your name, your email address and your message. The longer form on our contact page asks for the same, and also for what you are interested in (you pick at least one option), your budget range and your timeline. It also has optional fields for your phone number, your business or venue name, your industry and how you heard about us. Section 7 says which fields each form needs.
• What happens to a form message. We store it in our database (Supabase, hosted in Ireland). We also email every form message to our support inbox, support@yielde.dev, through our email provider (Resend, United States). That email's reply address is yours, so that we can answer you.
• Our enquiry-sorting automation. We also pass each form message to our own enquiry-sorting automation. It runs on Vercel (serverless), as part of Yielde's own automation. It uses an AI model, reached through OpenRouter, to score the enquiry and write short notes on it. It can store the result in our database (Supabase, Ireland), email it to us, and send you an automatic acknowledgement by email. The AI model providers it reaches are outside South Africa (section 9).
• Email, phone and WhatsApp. If you email or phone us, or send us a WhatsApp message, we keep your contact details and what you tell us, so that we can answer and keep a record of the conversation.
• Demos. If you book a demo, we keep the time we agreed and how we are meeting (a video call, or in person). Video demos use Google Meet.

4.3 When you are a Yielde platform customer

• Account and sign-in data. Your sign-in email address and the session records we need to run your dashboard account. Sign-in is by a link we email to you, so we store no password.
• Billing details. What we need to issue invoices and take payment in rand. Paystack processes card payments. Card details are handled by Paystack and are not stored by Yielde.
• Subscription records. Your plan, subscription status, account lifecycle and credit balance.
• Project and onboarding information you share so that we can deliver the service, such as assets, copy and configuration, and your signed DPA.
• Messages you send us about your account or for support.

4.4 Information we get from someone other than you

• Introductions. Someone who knows you may introduce us. We only accept an introduction if that person asked you first.
• Businesses we build a demo for. We build the demo from your business's own public website (section 4.5).
• Our customers' data. Where we act as an operator, the personal information comes from our customer or from people who contact our customer (section 10).

4.5 When you try a demo we built for your business

Sometimes we build a demo AI assistant for a business, to show it what our service could do. The business gets a private link to a demo page on yielde.dev. Each demo page says that it is a demonstration built by Yielde, and that the business does not run or endorse it.

• What we take from your website. We read your business's public website: its home page and up to six other pages, such as its contact, prices and booking pages. An AI model turns that text into instructions for the demo assistant. The text can include names and contact details that your website publishes. We store the instructions in our database (Supabase, in Ireland), with your business's name, your website address, a phone number or email address the assistant refers people to, and a brand colour.
• When someone types a question. The question goes through our website's server (Vercel) to OpenRouter, together with the demo's instructions. OpenRouter passes it to the AI model provider that answers it. These providers are outside South Africa (section 9). We use the same route when we build a demo's instructions.
• What is kept. The demo sends one question at a time, up to 2,000 characters, without earlier messages. We don't store the questions or the answers in our database. We don't ask the AI providers for zero data retention on demo questions, so their own terms decide what they keep.
• Your IP address. To stop one person flooding a demo, we count the questions each IP address sends to it in the last minute. The count is kept only in the working memory of our website's server (Vercel), not in a database, and it is lost when that server stops. Section 4.1 also applies, as on every page of yielde.dev.
• Limits. Each demo stops answering when its link expires or when it reaches its reply limit.
• It is up to you. Using a demo is voluntary, and the demo doesn't need your personal details. Each demo page tells the business how to ask us to take the demo down, and we take it down the same day. You may also object (section 16).

4.6 When you try a chat-widget preview of our own demo workspace

A chat-widget preview page (an address that starts with yielde.dev/embed/preview/) lets people try a chat widget before it goes live. When the preview shows Yielde's own demo workspace, we are the responsible party for the messages you type into it. Each message goes to that workspace on the Yielde platform, and through OpenRouter to an AI model outside South Africa, which writes the reply (sections 8 and 9). The preview keeps the conversation in your browser (Cookie Policy section 4). When the preview shows a customer's workspace, that customer is the responsible party and we are its operator (section 10).

5. Direct marketing (POPIA section 69)

Under POPIA, personal information includes information about an identifiable business, including its email address (section 1). So the rules on direct marketing by email (section 69) apply to any marketing we send, even when we write to a business address.

Rules for any marketing we send.

• Every marketing message we send says who it is from and gives you a way to stop further messages (section 69(4)).
• We never treat silence, a pre-ticked box or a failure to opt out as consent (POPIA Regulations, regulation 6.4).
• Messages that are part of a service you use (for example invoices and support replies) are not marketing.
• If you ask for a demo through this website, you have contacted us. Our reply about that demo answers your request.

6. Why we use personal information, and our legal grounds

POPIA section 11(1) lists the grounds on which personal information may be processed. This table shows which ones we rely on.

Where we rely on consent, you may withdraw it at any time (section 11(2)(b)). Withdrawing it does not affect processing we did before. Where we rely on a legitimate interest, you may object (section 16 of this policy).

7. Must you give us this information?

• Enquiries and demos. Giving us your details is voluntary. The short form needs your name, email address and a message. The form on our contact page needs your name, email address and a message, at least one choice of what you are interested in, a budget range and a timeline. Its other fields are optional. A form will not send without the fields it needs, and then we can't reply to it. You can always email or phone us instead.
• Customers. To open a platform account we need your email address, because that is how you sign in. To take payment and issue a tax invoice we need the billing details the payment page asks for. Without them we can't provide the service or invoice you.
• The law that requires some of it. The Value-Added Tax Act 89 of 1991 (section 20) sets out what a tax invoice must contain. The Tax Administration Act 28 of 2011 requires us to keep tax records. The Companies Act 71 of 2008 (sections 24 and 28) requires us to keep accounting records for seven years.

8. Who we share it with

We share personal information only with the service providers we use to deliver our services and run our business, and with public authorities when the law requires us to. The table below and our Sub-processor Register are the authoritative list of those providers: who they are, what they process and where. We do not sell personal information.

These providers process personal information for us, where Yielde is the responsible party:

Providers that process our customers' data. When we act as an operator, the providers we use are our sub-processors. Our Sub-processor Register is the authoritative list of who they are, what they process and where. Section 10 summarises it.

9. Transfers outside South Africa (POPIA section 72)

Some personal information leaves South Africa. The platform, and our own business systems, use providers in other countries. So some of your personal information is processed outside South Africa, in the countries named below.

The rule. A responsible party in South Africa may not transfer personal information to a third party in a foreign country unless one of the five grounds in POPIA section 72(1) applies. The main one, section 72(1)(a), needs the recipient to be bound by a law, binding corporate rules or a binding agreement that gives an adequate level of protection. That protection must uphold principles substantially similar to POPIA's conditions, including similar limits on onward transfer. Another ground, section 72(1)(c), applies where the transfer is needed to perform a contract between you and the responsible party, or to take steps you asked for before such a contract. South Africa has no published list of adequate countries and no standard contractual clauses from the Information Regulator. So, for the platform, we assess each recipient ourselves, record the assessment, and rely on each provider's data-processing terms, with a POPIA onward-transfer rider where needed (our Sub-processor Register, section 3.3). The table below gives the ground we rely on for each flow.

Where the information goes.

The level of protection.

• European Union. We treat the EU's GDPR regime as giving protection substantially similar to POPIA.
• United States. POPIA has no list of adequate countries, and we have not assessed United States law as giving protection substantially similar to POPIA. For United States providers we rely on their binding data-processing terms (section 72(1)(a)) where we have them. Otherwise we rely on section 72(1)(c) where the transfer is necessary to perform our contract with you, or to take steps before a contract that you asked for.
• Global networks. Cloudflare, Google, WhatsApp and OpenRouter may process information in any country where they operate. We have not assessed the law of each of those countries. The basis for each flow is in the table above.

Our most significant cross-border flow is text sent to AI model providers outside South Africa. That text can contain personal information. Section 10 explains how the platform limits it, and section 4.5 explains our demos.

10. Our work as operator: the Yielde platform

Where you are a Yielde platform customer, the platform processes the personal information of your end-users and leads on your behalf and on your instructions. Examples are contact details captured by an automation, voice-receptionist call data and message content. For that information:

• You are the responsible party; we are the operator.
• Only with your authority. We process it only with your knowledge or authorisation, and we keep it confidential, as POPIA section 20 requires of every operator.
• Under the DPA. Our processing is governed by the DPA, the written operator contract POPIA section 21(1) requires. It carries down the security obligations of section 19 and the breach-notification duty of section 21(2).
• No routine inspection. We do not routinely inspect the content of your tenant data. We access it only as the DPA, our Acceptable Use Policy or the law permits.
• Your own privacy notice. Your privacy notice to your end-users and leads, not this Yielde policy, is the notice that must disclose your purposes, your legal ground and, where applicable, the cross-border processing described below. We will assist you to do so.

Where platform data is processed. Yielde's automation runs on Vercel (serverless) and Supabase (eu-west-1); model calls via OpenRouter. Platform data is therefore processed in the European Union (Supabase), the United States (Vercel) and by OpenRouter's model providers, as the table below shows.

AI-assisted features. Some platform features send content, which can contain personal information, to third-party AI model and voice providers to generate responses. This includes AI Chat, the in-dashboard assistant that lets you converse with your choice of leading AI models.

• OpenRouter. Platform model calls, from your workflows, your chatbot and the in-dashboard AI Chat (including its live web search and video generation), go from our application server and automation on Vercel to OpenRouter. OpenRouter passes each one to the chosen model provider, which can include OpenAI and Anthropic. The response is streamed straight back to you.
• Voice. The voice receptionist runs on the language model that our voice provider, Retell, hosts in the United States.
• For customer lead data, this is further processing that must stay compatible with the purpose for which you originally collected it. It is scoped in the DPA, and it is minimised so far as practicable before it leaves South Africa.
• Customer prompts and completions are not used to train any model.

Platform sub-processors.

The Sub-processor Register (Table A) is the authoritative list and forms part of your DPA. We require each sub-processor to be named and authorised in the DPA and to give back-to-back security and breach-notification commitments (sections 14 and 15). Before we add, replace or materially change a platform sub-processor, we give you at least 30 days' written notice, as section 7.2 of the register sets out. You may object, as section 7.3 sets out. Where a platform sub-processor must be replaced urgently for security, legal-compliance or service-continuity reasons, section 7.4 of the register lets us make the change before the notice period ends; we then give notice as soon as reasonably possible, and your right to object still applies.

Requests from your end-users and leads. Your end-users and leads should send requests about their information to you, as the responsible party. Where we hold that information as your operator, we will assist you to fulfil access, correction and deletion requests across our systems, as the DPA requires.

11. Venuo

If you use Venuo, our enquiry desk for wedding and function venues, or you sent an enquiry to a venue that uses it, Venuo's own privacy notice at https://venuo.co.za/privacy/ applies.

12. Automated decisions

POPIA section 71 protects you from decisions with legal consequences, or that affect you to a substantial degree, made solely by automated processing.

13. How long we keep information

We keep personal information only as long as we need it for the purpose we collected it for, plus any retention period required by law (for example, accounting and tax records, which the law requires us to keep for seven years). When that time ends, we delete it, destroy it or de-identify it as soon as reasonably practicable (POPIA section 14).

Where Yielde is the responsible party.

Where Yielde is the operator.

• Platform. Customer project and lead data is handled under the DPA and deleted in line with our Cancellation Policy. After a cancellation takes effect, your data is kept for a 30-day export window, during which you can ask for and receive a copy. At the end of that window, your data and the personal information we processed for you are deleted, except for the limited records the law requires us to keep.

14. How we protect personal information

We secure personal information by taking appropriate, reasonable technical and organisational measures to prevent its loss, damage or unauthorised destruction, and unlawful access to it or processing of it, as POPIA section 19(1) requires. We follow the four steps in section 19(2):

• identify reasonably foreseeable internal and external risks;
• establish and maintain safeguards against them;
• regularly verify that the safeguards work; and
• continually update the safeguards in response to new risks, or to weaknesses found in the safeguards we already have.

We apply generally accepted information-security practices. As an operator, we process customer data only with the customer's authorisation and keep it confidential (section 20). Our DPA carries the section 19 security standard down to us and onward to our sub-processors. No system is perfectly secure.

What that means today.

• Every public page and endpoint of this website and the platform is served over HTTPS only, with HSTS. Browsers reach every yielde.dev address only over HTTPS, because the whole .dev domain is on the browsers' built-in HTTPS-only list.
• Sign-in to the dashboard uses a link emailed to you, so we store no passwords.
• Secrets are kept in a secrets manager, never in our source code.
• Incoming webhooks are signature-checked before we trust them.
• Our Supabase database is encrypted at rest.
• Before an error report leaves our code, the code removes secrets and cookies, masks email addresses, and masks phone numbers written in international format (starting with +).

Yielde does not hold SOC 2, ISO 27001 or any similar certification, and claims none. To report a security weakness, email security@yielde.dev. Our Security page has more detail.

15. If there is a security compromise

Where Yielde is the responsible party. If there are reasonable grounds to believe that someone has accessed or acquired your personal information without authority, we will notify the Information Regulator and you as soon as reasonably possible after we discover the compromise (POPIA section 22).

• We notify you unless your identity cannot be established.
• We may delay notifying you only if a public body responsible for investigating offences, or the Information Regulator, decides that notice would impede a criminal investigation.
• We notify you in writing: by email, by a prominent notice on this website, or as the Regulator directs.
• The notice tells you the possible consequences, what we have done or will do about it, what you can do to protect yourself, and, if we know it, who accessed the information.

Where Yielde is the operator.

• Platform. Our duty is to notify the responsible party (our customer) immediately where there are reasonable grounds to believe that its data subjects' personal information has been accessed or acquired by an unauthorised person (POPIA section 21(2)). This is not limited to business hours. The customer then notifies the Regulator and the affected people, and we will assist the customer to do so.
• Our sub-processors must notify us promptly enough for us to meet these duties.

16. Your rights

You have these rights over the personal information we hold about you as a responsible party.

• Access (section 23). You may ask us to confirm, free of charge, whether we hold personal information about you. You may ask for a copy or a description of it, including who has had access to it. We give it within a reasonable time, in a reasonable and understandable form. If the law allows a fee for a copy, we tell you the amount in writing before we do the work, and we may ask for a deposit. We may refuse only on the grounds in the Promotion of Access to Information Act 2 of 2000 (PAIA). If we refuse part of a request, we give you the rest. For a copy, POPIA section 25 applies the PAIA request procedure. Our PAIA Manual explains it and links the PAIA request form (Form 2 under the PAIA Regulations, which is not the same as Form 2 under the POPIA Regulations mentioned below). You may start with an email to support@yielde.dev. We will tell you if the law needs you to use the PAIA form.
• Correction or deletion (section 24). You may ask us, free of charge, to correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully. You may also ask us to delete a record we are no longer allowed to keep. As soon as reasonably practicable, we correct or delete it, or show you credible evidence that it is right. If we can't agree, we will, at your request, attach a note that you asked for a correction. If a change matters for decisions about you, we tell the people we shared the information with, where reasonably practicable. We tell you in writing what we did, within 30 days of the outcome (section 24(4); POPIA Regulations, regulation 3.6).
• Objection (section 11(3)). You may object at any time, free of charge, on reasonable grounds relating to your situation, to processing we base on a legitimate interest. You may object at any time to processing for direct marketing. You may also object in any other circumstances POPIA section 11(3) allows. Once you object, we stop that processing (section 11(4)), unless the law provides for it.
• Withdrawing consent (section 11(2)(b)). Where we rely on your consent, you may withdraw it at any time. This does not affect processing we did before.
• Automated decisions (section 71). See section 12.
• Complaint to the Information Regulator. See section 17.

How to use your rights. Email our Information Officer at support@yielde.dev, or write to us at 55 York Street, George, Western Cape, 6529. You may use Form 1 (objection) or Form 2 (correction or deletion) from the POPIA Regulations, but you don't have to: a clear request in your own words is enough. Before we give you access to information, we may ask you to prove who you are, so that we don't give your information to someone else.

If your information is held by one of our customers.

• Platform. If you are a Yielde platform customer's end-user or lead, the customer is the responsible party for your data, so send your request to that customer. Where we hold the data as operator, we will assist the customer to fulfil your access, correction or deletion request across our systems, as the DPA requires.

17. Complaints to the Information Regulator

You have the right to lodge a complaint with the Information Regulator of South Africa.

• Website: https://inforegulator.org.za
• Complaints email: POPIAComplaints@inforegulator.org.za
• General enquiries: enquiries@inforegulator.org.za
• Phone: 010 023 5200, or toll-free 0800 017 160
• Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• Online services: https://eservices.inforegulator.org.za

18. Information Officer and how to contact us

Our Information Officer is the head of Splice Computers (Pty) Ltd, by operation of law (POPIA section 1, read with PAIA section 1). The Information Officer deals with requests and questions about this policy.

• Email: support@yielde.dev
• Phone: 063 611 2952
• Address: 55 York Street, George, Western Cape, 6529, South Africa
• Security weaknesses: security@yielde.dev
• PAIA Manual: /paia

19. Cookies

This site uses only the cookies it needs to work. It does not set marketing or analytics cookies.

• If you only browse the public pages and don't sign in, yielde.dev sets no cookies.
• Signing in to the dashboard sets strictly necessary cookies that keep you signed in.
• Your light or dark theme choice is saved in your own browser's storage, not in a cookie.

Our Cookie Policy lists every cookie and browser-storage item, and explains how to delete them.

20. Children

Our website and services are for businesses and the people who act for them, not for children. As a responsible party, we do not knowingly collect children's personal information.

21. Changes to this policy

We may update this policy from time to time. The effective date at the top of the page shows the latest version. Material changes will be communicated by updating this page and, where appropriate, by notice to platform account holders.

If you had any Yielde subscription before 27 September 2026, section 14.2 of our Terms of Service applies: if anything in this version affects you materially, it applies to you only from the start of your next billing period after we notify you, and you may cancel before then. Until then, the version of 20 June 2026 applies to you. On request, we send you a free copy of that version.

22. Governing law

This policy and our processing of personal information are governed by the laws of the Republic of South Africa, in particular POPIA. Disputes are subject to South African jurisdiction. See our Terms of Service, Refund Policy and Cancellation Policy for related terms.