Privacy policy

The data controller is YIELD SAS, 40 rue Caron, 91200 Athis-Mons, France. For any question about your data, you can write to [email protected].

For the WhatsApp module, YIELD acts as a processor for its client businesses: each business remains the controller of the data of the people who write to it. The “WhatsApp module” section below describes that processing.

We collect:

— Identity and contact data: surname, first name, email address, company name.
— Bank connection data: balance, IBAN and account-holder information, transmitted through our licensed partner Bridge. We never collect your online banking credentials.
— Usage data: treasury settings, history of placements and withdrawals made through the Service.
— Technical data: connection logs required for the security of the Service.

Company portrait: when you start the analysis of your company, we read public sources about it (the official company registry, your website, pages found on the web) and we keep the information retained, its sources and the answers you give to our questions. To build this portrait, your company name, your website address, the text of the public pages read, the registry information (including directors’ names and roles, never their date of birth) and your answers are sent, through our processor OpenRouter, to the provider of the AI model (to date OpenAI, and Google for reading your website). The web searches are run by the model provider or by Exa, which receive the search terms (including your company name). This data is deleted when you delete the portrait or your account.

When you use our public calculator (“Benchmark trésorerie”) and ask for the report to be emailed to you, we collect: your email address and, if you provide them, your company name and telephone number, together with the sector, revenue band and amounts you entered, and where applicable the campaign your visit came from (UTM parameters).

This data is processed, on the basis of your consent (tick box), in order to: (i) send you the report you asked for; (ii) contact you about YIELD treasury services. You can withdraw that consent at any time by writing to [email protected] — every marketing email also carries an unsubscribe option. This data is kept for a maximum of 3 years after your last contact with YIELD, then deleted. It is never sold or passed to third parties for marketing purposes.

When you ask, on our site, to be told when the WhatsApp module launches, we collect your email address, the module concerned, the page language and, where applicable, the campaign your visit came from (UTM parameters). This data is processed on the basis of your consent (tick box), for one purpose only: sending you one email when the module launches. You can withdraw that consent and ask for your address to be deleted at any time by writing to [email protected]. This data is deleted after that email is sent, and at the latest 12 months after your request. It is never sold or passed to third parties.

When a client business connects its WhatsApp Business number to YIELD, in Meta’s signup window, YIELD receives and sends messages on that number on its behalf. The business keeps its Meta account and its number; YIELD obtains only the permission the business grants, as a Tech Provider on the WhatsApp Business Platform. For this data the business is the controller and YIELD its processor: YIELD processes it only on the business’s instructions, to answer its customers.

In that context we process:
— the phone number and WhatsApp profile name of the people who write to the business;
— the content of the messages exchanged with them, their technical identifiers and their delivery and read status;
— if the business agrees to share them in Meta’s window: the contacts of its phone’s address book (number and name), used only to name a conversation, and its past chats;
— booking data (name, email address, telephone, date, number of people, amount) read from or recorded in the booking tool the business has connected;
— the amount and status of payments requested by link; card details are entered at Stripe, YIELD never has access to them;
— the identifiers of the business’s WhatsApp Business account and the access token issued by Meta, stored encrypted.

This data is used only to answer the messages the business receives, to prepare and record bookings, to send payment links and to send the business a daily recap of its activity. It is never sold, never used for advertising, and never used for any business other than the one the message was addressed to.

Messages are handled by an assistant based on artificial intelligence (a model provided to date by OpenAI, called through OpenRouter), which may answer with no human review, depending on the setting chosen by the business. The person is told so in the first reply they receive. They can reply STOP at any time: their messages are then passed to a person at the business and are no longer sent to the model for that conversation. Before anything is sent to the model, names, email addresses, phone numbers, IBANs and card numbers are replaced by tokens. Known limit: a first name on its own in the middle of a sentence may not be recognised. Photos, voice messages and files are not read by the assistant: they are passed on to the business’s team.

Retention periods: the plain text of a message is erased 30 days after it was sent; a pseudonymised version is kept until the conversation is deleted, 12 months after its last message. Contact details attached to a booking are erased 12 months after the date of that booking. Address-book contacts are deleted as soon as the business disconnects its number, and at the latest 12 months after they were last updated. The access token is deleted on disconnection, whether it is done from YIELD or from the business’s Meta account.

If you wrote to a business that uses YIELD, you can exercise your rights (access, rectification, erasure, objection) with that business, which is the controller. You can also write to [email protected]: we pass your request on to the business concerned and delete your data on its instruction.

Your data is processed in order to: (i) provide the Service and perform the contract between us (performance of a contract); (ii) ensure security and prevent fraud (legitimate interest); (iii) comply with our legal and regulatory obligations (legal obligation); (iv) send you communications relating to the Service (performance of a contract or consent).

Your data is accessible to our authorised teams and to our processors, strictly to the extent necessary to provide the Service:

— Bridge (bank account aggregation, licensed under PSD2/DSP2);
— Spiko and the partners responsible for the investment vehicle, in particular the management company and the custodian;
— Resend (sending of transactional emails);
— OpenRouter, which routes our requests to the AI models, with the logging of their content turned off on our account, and the provider of the model used, to date OpenAI (classification of anonymised bank labels — names replaced by tokens —, only with your explicit consent, given at signup or in your settings and withdrawable at any time; and drafting of the accounting firms’ monthly note, enabled by the firm; and reading the terms of a financing offer you choose to send us: the document or text is then sent as it is, without anonymisation, only with your agreement given when you send it and withdrawable at any time, and YIELD does not keep it; and building of your company portrait, when you start that analysis, from your company name, your website address, your answers and the text of public sources, the official registry included, your website being read by a Google model and the web searches being run by the model provider or by Exa). Our requests are only routed to model providers that do not use this data to train their models; if the provider of a model changes, this page is updated beforehand.

Depending on the services you connect, data is also exchanged with:
— Pennylane (reading of your accounting and bank data, on your Pennylane account);
— Meta (WhatsApp Business Platform: carrying the messages of the number you connected);
— OpenRouter and the provider of the AI model, to date OpenAI (the WhatsApp assistant’s answers, from messages in which names and contact details are replaced by tokens);
— Stripe (payment links, on your own Stripe account);
— Regiondo (bookings, on your own Regiondo account).

These providers are bound by contractual confidentiality and security obligations. Your data is never sold to third parties.

Some of these providers, in particular OpenRouter, OpenAI, Google, Exa, Meta, Stripe and Resend, are established in the United States or may process data there. These transfers are covered by the safeguards provided for by the GDPR: the European Commission’s standard contractual clauses or, for providers certified under it, the EU–US Data Privacy Framework.

Your data is kept for the duration of the contractual relationship, then archived in accordance with the applicable statutory periods (in particular accounting and anti-money-laundering requirements), before being deleted or anonymised.

The periods specific to the WhatsApp module are set out in the “WhatsApp module” section.

We implement appropriate technical and organisational measures to protect your data: encryption in transit, access control and minimisation of the data collected. The bank connection relies on the secure PSD2 (DSP2) framework.

The Service’s infrastructure is hosted by YIELD itself, with no third-party hosting provider.

In accordance with the GDPR, you have a right of access, rectification, erasure, restriction, objection and portability in respect of your data, as well as the right to set instructions on what happens to it after your death. You can exercise these rights by writing to [email protected]. You also have the right to lodge a complaint with the CNIL (the French data protection authority, www.cnil.fr).

To have your data deleted, you can delete your account at any time from your settings, or ask for it by writing to [email protected]: we answer within one month. Disconnecting your WhatsApp number from YIELD immediately deletes the access token and the synchronised contacts.

The Service uses only the cookies strictly necessary for it to work (for example keeping your session open). No advertising cookie is set without your consent.

This policy may be updated. In the event of a substantial change, you will be informed by any appropriate means.