Who controls your data
Sansa Group AB (Swedish organisation number 559111-9507), Soldathemsgatan 20, 415 28 Göteborg, Sweden, operates Yieldline through its SansaVision division and acts as controller for account, website, sales, and support data. SansaVision and Yieldline are operating brands of Sansa Group AB, not separate legal entities. For advertising, commerce, and product data that a customer connects to a workspace, the customer is normally the controller and Sansa Group AB acts as its processor under the Data Processing Agreement. Contract terms can allocate roles differently where required.
Contact privacy support at support@sansavision.com or use the data-rights form.
Data we process
| Category | Examples | Main purpose |
|---|---|---|
| Account and identity | Name, work email, authentication events, role, session and device security data | Provide accounts, secure access, and workspace permissions |
| Workspace and economic inputs | Offers, costs, margins, cash limits, contracts, approval rules | Calculate CAC ceilings and enforce customer guardrails |
| Connected platform data | Campaign objects, spend, delivery, attributed events, provider payment-readiness status, subscriptions, refunds, product events | Reconcile performance and produce customer-requested analysis |
| Creative and evidence | Assets, briefs, genome tags, rights records, model routes, action and outcome receipts | Generate governed creative and preserve auditability |
| Support and sales | Messages, request metadata, incident details, order and billing contacts | Respond, troubleshoot, sell, and administer the service |
| Website and consent | Necessary security data, consent selections, optional analytics and campaign data | Operate the site, remember choices, and measure use with permission |
Yieldline records whether a connected advertising account is ready for provider billing, but does not collect or store the card number or bank credentials used by the advertising platform.
How we use data
- Provide, secure, maintain, and improve Yieldline.
- Reconcile ad, commerce, payment, subscription, and product signals.
- Calculate deterministic economics and confidence ranges.
- Generate recommendations and execute only approved or contract-eligible actions.
- Send one-time codes, service notices, approval requests, reports, and incident alerts.
- Prevent fraud, abuse, unauthorized access, duplicate actions, and policy violations.
- Comply with law, enforce agreements, and establish or defend legal claims.
Yieldline does not sell personal data. It does not use one customer’s confidential data to target another customer’s users. Privacy-safe benchmarks, if introduced, will require minimum cohort thresholds and de-identification controls.
Legal bases in the EEA and UK
Depending on the context, processing relies on performing a contract, legitimate interests in operating and securing a B2B service, consent for optional storage and marketing, and legal obligations. The detailed mapping appears in the GDPR matrix.
Sharing and subprocessors
We disclose data to service providers only for documented purposes, to connected platforms at the customer’s direction, during a corporate transaction subject to safeguards, or when legally required. Public-authority requests are verified, reviewed for legality, challenged or narrowed where appropriate, minimized, documented, and independently approved under our Public Authority Request Policy. Current provider roles are listed on the subprocessor page. For purchases completed with Stripe Managed Payments, Sold through Link is the merchant of record and separately controls transaction, tax, fraud, dispute, and transaction-support processing under its own notices.
International transfers
Cloud systems and connected platforms may process data outside your country. Where required, we use contractual transfer safeguards, assess destination risks, and apply technical and organizational controls. Customers remain responsible for ensuring their connected-platform use has an appropriate legal basis.
Retention
Account and contract records are retained while a workspace is active and for a limited period needed for security, billing, disputes, and legal obligations. Default product control data is retained for up to 24 months, raw evidence for up to 13 months, and security logs for up to 12 months unless a plan, law, incident hold, or customer instruction requires another period. Deletion requests propagate through active systems and backups according to documented schedules.
Automated systems
Yieldline uses deterministic calculations, statistical models, and language models to support business advertising decisions. Language models cannot write directly to ad platforms. Actions pass typed policy, evidence, confidence, approval, and idempotency checks. Yieldline is not intended to make solely automated decisions about individuals that produce legal or similarly significant effects.
Your choices and rights
Depending on location, you may request access, correction, deletion, restriction, objection, portability, or information about processing. California residents may also request to know, delete, correct, opt out of sale or sharing, limit certain sensitive-data uses, and receive equal service. Yieldline honors Global Privacy Control for applicable browser activity. Submit a request through Data rights.
Security and incidents
Controls include tenant isolation, least-privilege scopes, encrypted secrets, pseudonymous identifiers, step-up authentication for sensitive actions, action receipts, structured logs, and emergency write locks. No system is risk-free. If an incident affects protected data, we investigate, mitigate, and notify as legally required.
Children and changes
Yieldline is a business service and is not directed to children under 16. We may update this notice as the product, providers, or law changes. Material changes will be announced in the service or by email when required.