Loading
Last updated: 10 November 2026
Yaya Digital Limited (“Yaya”, “we”, “us”) runs this website at yaya.co. This policy sets out exactly what we collect, what we run on the site, who else gets to see it, and how to make us stop.
We are a design studio, not a platform. There are no accounts on this site, nothing to log into, and no product telemetry. The data we hold about you comes from five places: a form you filled in, a message you sent us on WhatsApp, a cookie you consented to, the server logs that any website generates by existing, and public business information we add when you sign up with a work email.
Data controller
Yaya Digital Limited, registered in England and Wales, company number 11954846. Registered office: 5th Floor, 167 - 169 Great Portland Street, London W1W 5PF. Privacy contact: hello@yaya.co
The contact form on /contact and the newsletter sign-ups in our page footers collect:
We also process, transiently, the IP address the submission came from. It is used as a rate-limit key to stop bots hammering the form, and to run the spam check described in section 3. It is not stored against your enquiry.
Forms include a hidden field that humans never see and bots usually fill in. If it comes back filled, we discard the submission silently and write nothing anywhere.
Our free training and webinar pages ask for your first name and work email. We use them to send you the training, a few follow-up emails about it, and occasional emails from Yaya. Every one carries an unsubscribe link that works on the first click.
Live events we run on Demio are registered on Demio’s own page. Demio collects your name, email, and attendance data, passes registration details to us, and its own privacy notice applies there.
Our hosting provider, Vercel, writes standard server logs for every request: IP address, timestamp, requested URL, referrer, user agent, and response status. This happens whether or not you accept cookies, because it is how a web server works and how we spot abuse.
If something on the site throws an error, our error monitor, Sentry, captures a report: the URL, the browser and operating system, a stack trace, and the IP the request came from. No form content is included.
Google Analytics 4, loaded through Google Tag Manager, runs only if you accept statistics cookies in the consent banner. It records pages viewed, session data, coarse location derived from IP, device and browser, and our Core Web Vitals performance measurements.
The full list of cookies, with names and durations, is in our Cookie Policy.
We run a Meta (Facebook) pixel, and Google Ads conversion tags when we are advertising. Both load only if you accept marketing cookies in the consent banner; decline them and neither runs. On our webinar pages a Nudgify notice shows recent sign-ups, loaded only with statistics consent. On our free training pages only, Hotjar records session replays and heatmaps, and only if you accept statistics cookies. Hotjar does not record what you type into form fields. No other page on the site runs session replay or heatmapping.
We self-host our typefaces. Loading a page on yaya.co does not send a font request to Google or anyone else.
Our WhatsApp number is a WhatsApp Business account. If you message it, WhatsApp (Meta Platforms Ireland) processes your phone number, profile name and messages under its own privacy policy, as it does for any WhatsApp conversation. We see the same things, and we use them to reply to you and, if it goes somewhere, to scope work. We may follow up about your enquiry on WhatsApp. We will not send you marketing on WhatsApp unless you have opted in to it, and you can tell us to stop at any time. If we run automated replies on the number, the first message will say so, and you can ask for a person at any point.
When you sign up with a work email, we look up public business information about you and your company: the company’s name, website, industry and size, and your job title and public professional profile. It comes from your company’s website, professional networks such as LinkedIn, and business registries. We use it to understand who signed up and to make our follow-up relevant. We do not buy contact lists, and we add nothing that is not already public. Object at any time and we will delete what we added.
| What | Why | Lawful basis (UK GDPR) |
|---|---|---|
| Contact form submissions | To answer your enquiry and, if it goes somewhere, to scope work | Art. 6(1)(b) steps prior to a contract, and Art. 6(1)(f) legitimate interest in responding to enquiries |
| WhatsApp messages | To answer your enquiry and follow it up | Art. 6(1)(b) and Art. 6(1)(f); Art. 6(1)(a) consent, plus PECR, for any marketing |
| Newsletter sign-ups | To send you the newsletter | Art. 6(1)(a) consent, plus PECR |
| Training and webinar sign-ups | To send you the training and follow-up emails | Art. 6(1)(f) legitimate interest in following up a request you made; Art. 6(1)(a) consent, plus PECR, where the law requires it |
| Live event registration (Demio) | To run the event and follow up on it | Art. 6(1)(b) |
| Public business information added to sign-ups | To understand who signed up and tailor follow-up | Art. 6(1)(f) legitimate interest |
| Server logs, rate limiting, spam checks | To keep the site up and keep bots out | Art. 6(1)(f) legitimate interest in security |
| Error reports | To find and fix broken pages | Art. 6(1)(f) legitimate interest in a working website |
| Analytics cookies | To see which pages earn their place | Art. 6(1)(a) consent, plus PECR reg. 6 |
| Advertising pixels and conversion tags | To measure and improve our advertising | Art. 6(1)(a) consent, plus PECR reg. 6 |
Where we rely on legitimate interest, we have weighed it against your interests and rights. You can object at any time using the contact details above.
If you fill in the contact form we may email you about your enquiry. We will not add you to a newsletter because you asked us a question. Those are separate, and the newsletter opt-in is a separate unticked box.
Form submissions pass through Cloudflare Turnstile, a privacy-focused alternative to CAPTCHA. Turnstile scores whether a submission is automated. It does not profile you across websites and does not ask you to identify traffic lights. Cloudflare processes your IP address and browser characteristics to produce that score.
We also apply a per-IP rate limit of five submissions a minute.
We do not sell personal data. We do not share it with data brokers. The processors below handle it on our instructions, under contract.
| Processor | What they do | Where |
|---|---|---|
| Vercel Inc. | Hosting and CDN. Our production region is London (lhr1) | US company, EU/UK infrastructure |
| Sanity AS | The CMS holding our page content and media | Norway, with global CDN |
| Google Ireland Ltd | Tag Manager and Analytics 4, consent-gated | EU and US |
| Usercentrics A/S (Cookiebot) | The consent banner and consent record | Denmark |
| Cloudflare Inc. | Turnstile spam prevention | US company, global network |
| Functional Software Inc. (Sentry) | Error monitoring | US |
| Slack Technologies (Salesforce) | Where new enquiries are notified to our team | US |
| Productive Tools d.o.o. | Our CRM, where enquiries and sign-ups are stored | Croatia, EU |
| The Rocket Science Group LLC (Mailchimp) | Sending the training and follow-up emails | US |
| Hotjar Ltd | Session replay and heatmaps on our free training pages, consent-gated | Malta, EU |
| Banzai International (Demio) | Webinar and event registration | US |
| Meta Platforms Ireland Ltd | WhatsApp Business messaging; the Meta pixel, consent-gated | Ireland, with US transfers under Meta’s own terms |
| Nudgify Ltd | Recent sign-up notices on webinar pages, consent-gated | UK |
| Marker.io | A feedback widget that runs on our pre-release preview builds only, never on the public site | EU |
We will also disclose data where the law requires it, and to a buyer and their advisers if the business is sold. If that happens, this policy travels with the data.
Several of the processors above are US-based. Where personal data leaves the UK, we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or on the UK extension to the EU-US Data Privacy Framework where the processor is certified under it. Ask us at hello@yaya.co and we will tell you which mechanism covers a specific transfer.
| Data | Retention |
|---|---|
| Enquiries that did not become a project | 24 months from your last contact with us |
| Enquiries that became a project | For the life of the engagement plus 6 years, to meet UK accounting and limitation-period requirements |
| WhatsApp conversations | As for enquiries above. Chat history also lives on our phones under WhatsApp’s own retention |
| Newsletter and training sign-ups | Until you unsubscribe, plus a suppression record so we do not re-add you |
| Public business information added to a sign-up | As long as the sign-up it belongs to |
| Hotjar recordings and heatmaps | Up to 365 days |
| Consent records (Cookiebot) | 12 months, matching the consent cookie |
| Server logs (Vercel) | Per Vercel’s platform retention, currently around 30 days |
| Error reports (Sentry) | 90 days |
| Google Analytics event data | Up to 14 months |
Under UK GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or hand it over in a portable format. You can object to processing based on legitimate interest, and you can withdraw consent at any time without affecting what we did before you withdrew it.
If we get it wrong, you can complain to the Information Commissioner’s Office at ico.org.uk, or on 0303 123 1113. We would rather you told us first.
The site sets HTTP Strict Transport Security, so browsers only ever talk to us over TLS. We send X-Content-Type-Options: nosniff, a strict-origin-when-cross-origin referrer policy, and a permissions policy that switches off camera, microphone, geolocation, and Topics API access for the page. We operate a content security policy and monitor violations against it.
Our CMS API accepts browser requests only from an allow-list of our own origins: yaya.co, our Sanity Studio, our Vercel deployment aliases, and local development. Credentialed cross-origin requests are restricted to that list.
Secrets are held in a password manager and injected at deploy time. No API key for any system named in this policy is present in the code you download when you load a page.
No transmission over the internet is completely secure, and we will not claim otherwise. If we suffer a breach that risks your rights, we will report it to the ICO within 72 hours and tell you where the law requires it.
This site is aimed at founders and marketing leaders at cybersecurity companies. It is not directed at children, and we do not knowingly collect data from anyone under 16. If you think we have, email hello@yaya.co and we will delete it.
We do not make automated decisions with legal or similarly significant effects about you. The Turnstile spam score decides whether a form submission is processed, not whether you get a reply from a person.
Separately from this website, we build client websites that include an analytics dashboard inside their content management system. Where a client turns it on, the dashboard signs that client’s own staff in with Google and shows them their Google Analytics figures without leaving their CMS.
When someone connects it, Google asks them to grant one permission: read-only access to their Google Analytics data (the analytics.readonly scope). We use that access for one thing: to fetch the Google Analytics reports for a property they already have access to and draw them in the dashboard. We never write, change or delete anything, and we request no other Google account data.
The connection is held as an encrypted token for that person’s session so the dashboard can refresh the figures. We do not sell this data, do not share it with anyone, do not use it for advertising, and do not use it to train any model. Yaya’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Anyone can revoke the access at any time at myaccount.google.com/permissions.
We update this policy when what we run on the site changes, not on a schedule. The date at the top is the last substantive change. If the change is material, we will say so on the page.
Yaya Digital Limited 5th Floor, 167 - 169 Great Portland Street, London W1W 5PF Company number 11954846 hello@yaya.co