Privacy Policy
Effective date: 4 May, 2026
1. Introduction
Yush Ltd ("Yush", "we", "us", "our") respects your privacy. This Privacy Policy explains how we collect, use, share and retain personal data when you use Yush, including our websites, app, Reaction Kits, public reaction pages, dashboards, reports, content tools, APIs and related services.
Yush Ltd is a company registered in England and Wales under company number 15963427, with registered office at 3rd Floor, 86–90 Paul Street, London, England, United Kingdom, EC2A 4NE.
This Privacy Policy should be read alongside our Terms of Service, Cookie Policy and, for Customers, our Data Processing Addendum.
If you have questions, contact support@yushnow.com.
2. Key terms used in this policy
Customer means a business, organisation, professional, charity, institution, public body or other non-consumer user that creates an account or Reaction Kit to capture, manage, analyse, publish or reuse responses through Yush.
Respondent means a person who submits a response through a Reaction Kit.
Reaction Kit means a response-capture setup created through Yush, including questions, prompts, QR codes, short URLs, branding, settings, public pages, live displays, dashboards, exports and reports.
Response means any emoji, option selection, rating, short text, comment, photo, image, email address, metadata or other material submitted by a Respondent through Yush.
Reaction Content means any Response that includes text, comments, photos, images, quotes, captions or other content capable of being displayed, exported, reused or published.
Public Surface means any public or semi-public page, gallery, live display, share card, social proof page, example page, report excerpt, embed, public API output or other part of Yush that may be visible to people other than Yush and the relevant Customer.
3. Our role under data protection law
Yush may act in different roles depending on the feature and use case.
For Customer-controlled Reaction Kits, the Customer will usually decide why Responses are collected and how they are used. In those cases, the Customer is normally the controller of Respondent personal data, and Yush processes that data on the Customer’s behalf as processor.
Yush may also act as an independent controller for certain purposes, including account administration, authentication, billing, payment administration, fraud prevention, security, service analytics, product improvement, support, legal compliance and Yush marketing where permitted.
Where Yush processes personal data on behalf of a Customer, our Data Processing Addendum applies unless a separate written data processing agreement has been agreed.
4. Personal data we collect
4.1 Customer account data
When a Customer or authorised user creates or uses a Yush account, we may collect:
- name;
- email address;
- password or authentication details;
- business or organisation name;
- role or job title;
- billing and subscription information;
- account settings;
- support messages;
- usage and activity information relating to the account.
Customer accounts are for people aged 18 or over.
4.2 Respondent data
When a Respondent submits a Response through a Reaction Kit, we may collect:
- emoji reactions;
- option selections;
- ratings;
- short text comments;
- photos or images;
- captions or other uploaded content;
- email address, if provided through an email-capture, follow-up or opt-in field;
- event, location, collection or Reaction Kit context;
- submission time and related metadata;
- device, browser, log and usage data.
Respondents usually do not need to create an account to submit a Response.
4.3 Public and reusable Reaction Content
Depending on the Reaction Kit settings and the notice shown at submission, Responses and Reaction Content may appear on Public Surfaces, including public galleries, live displays, share cards, reports, example pages, product demonstrations and social proof pages.
Comments, photos and other identifiable content may contain personal data. Respondents should not submit anything they do not want Yush, the relevant Customer or public viewers of a Public Surface to see.
4.4 Email-capture and follow-up data
Some Reaction Kits may allow Respondents to provide an email address, for example to receive a copy of their Response, get a link, receive a follow-up or opt into updates.
Email addresses and contact details collected through an email-capture, follow-up or opt-in field are not intended to be displayed on Public Surfaces.
However, if a Respondent includes contact details inside free-text comments, captions, photos or other Reaction Content, those details may be visible unless removed or redacted.
Providing an email address to receive a copy of a Response does not automatically mean the Respondent agrees to marketing emails.
4.5 Google Sign-In data
If you choose to sign in with Google, we may receive:
- your Google account name;
- your Google account email address;
- your Google profile picture, if available.
We use this information to create, secure and manage your Yush account, authenticate you, identify you within the platform, personalise your account profile and provide the Service.
We do not access your Gmail, Google Drive, Google Calendar or other Google services unless we expressly ask for additional permission and you grant it.
We do not use Google Sign-In data for advertising purposes. We retain Google Sign-In data while your account is active, unless we need to retain limited records for security, legal, accounting, dispute resolution or backup purposes.
You may revoke Yush’s access through your Google Account permissions, but doing so may affect your ability to log into your Yush account.
Our use of Google user data complies with Google’s API Services User Data Policy, including the Limited Use requirements where applicable.
4.6 Device, log and usage data
When you use Yush, we may collect technical and usage data, including:
- IP address;
- device type;
- browser type;
- operating system;
- pages viewed;
- features used;
- timestamps;
- referral information;
- error logs;
- session and interaction data;
- approximate location derived from technical data where available.
We use this data to operate, secure, monitor, analyse and improve Yush.
4.7 Payment data
If you purchase a paid plan or service, payment information is processed by our payment provider, currently Stripe.
We do not store full payment card details. We may store billing records, subscription status, invoices, transaction IDs and related payment administration information.
4.8 Contact lists and invitations
Yush may in future allow Customers to upload contact lists, attendee lists or email addresses, or ask Yush to send invitations, reminders or follow-up messages on the Customer’s behalf.
Where this functionality is available, Customers are responsible for ensuring that they have a lawful basis to upload and use those contact details, that any required marketing consent or soft opt-in applies, and that opt-out requests are honoured.
Customers must not upload purchased, scraped, harvested or unlawfully obtained contact lists.
5. Sensitive and special category data
Yush does not intentionally request or require special category data through standard Reaction Kits.
However, free-text comments and photos may reveal sensitive information, including health, disability, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life or sexual orientation.
Respondents should avoid submitting sensitive personal data unless the Reaction Kit clearly asks for it and explains why.
Customers must not use Yush to collect special category data unless they have assessed the risks, identified an appropriate lawful basis and special category condition, and put suitable safeguards in place.
Yush may remove, restrict, blur, redact or otherwise limit access to sensitive content where appropriate.
6. How we use personal data
We use personal data for the purposes below.
| Personal data | Purpose | Typical lawful basis |
|---|---|---|
| Customer account data | Create and manage Customer accounts, authenticate users, provide support and manage subscriptions | Contract; legitimate interests |
| Google Sign-In data | Authenticate users and create, secure and manage accounts | Contract; legitimate interests |
| Respondent emoji, option and rating Responses | Capture live feedback, display results, provide dashboards and generate reports | Customer’s lawful basis where Customer is controller; legitimate interests where Yush is controller |
| Comments, photos and Reaction Content | Display, analyse, moderate, report, publish and reuse content according to Reaction Kit settings and submission notice | Customer’s lawful basis; consent or legitimate interests depending on context and use |
| Public galleries and Public Surfaces | Show live reactions, public proof, event galleries, examples, reports, demonstrations and social proof | Customer’s lawful basis; consent or legitimate interests depending on context and notice |
| Yush marketing reuse | Use Responses, Reaction Content, screenshots, public galleries, quotes, photos, event names, Customer names and report excerpts to show how Yush works | Consent, legitimate interests or another lawful basis depending on context, submission notice and applicable law |
| Email-capture data | Send a copy/link/follow-up requested by the Respondent or manage opt-ins | Consent; legitimate interests; service request |
| Marketing emails | Send product updates, offers or promotional messages | Consent or PECR soft opt-in where valid |
| Device, log and usage data | Security, fraud prevention, debugging, analytics and product improvement | Legitimate interests; consent for non-essential cookies where required |
| Payment and billing data | Process payments, manage subscriptions and maintain accounting/tax records | Contract; legal obligation |
| AI-assisted processing | Suggest questions, transcribe images, classify sentiment, extract themes, summarise responses and generate reports where enabled | Same basis as the underlying feature; Customer instructions; legitimate interests where Yush is controller |
| Legal and compliance data | Comply with law, enforce terms, respond to disputes and protect rights | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we consider the impact on individuals and whether their rights override our interests.
Where we rely on consent, you may withdraw consent at any time, but this will not affect processing that already took place before withdrawal.
7. Public galleries and Yush marketing reuse
Yush is designed to turn live Responses into public or reusable proof.
Unless a Reaction Kit states otherwise, Responses and Reaction Content may appear on Public Surfaces, including public galleries, live displays, share cards, reports, example pages, product demonstrations and social proof pages.
Subject to the notice shown at submission, our Terms of Service and applicable law, Yush may use Responses and Reaction Content in its own marketing, case studies, sales materials, product examples, product demonstrations, social media, website pages and investor or stakeholder materials. This may include event name, Customer name, screenshots, quotes, photos, reaction patterns, public gallery excerpts and report excerpts.
Where content includes personal data, photos, identifiable people or potentially sensitive information, Yush will use reasonable care and may remove, anonymise, blur, crop, redact or restrict content where appropriate.
Respondents and Customers may request removal of identifiable content by contacting support@yushnow.com.
8. AI-assisted features
Yush may use AI-assisted features to suggest questions, transcribe images, classify sentiment, extract themes, generate summaries, draft reports or create shareable outputs.
Where enabled, Responses and Reaction Content may be processed by AI service providers to provide those features.
Customers are responsible for reviewing AI-generated outputs before relying on them, publishing them or sharing them with stakeholders.
We do not use AI-assisted features to make decisions about Respondents that have legal or similarly significant effects.
9. Who we share personal data with
We may share personal data with the following categories of recipients.
| Recipient | Purpose |
|---|---|
| Customers | To allow the relevant Customer to view, analyse, export, publish and reuse Responses according to Reaction Kit settings, submission notices and applicable law |
| Customer team members, contractors, sponsors, funders, partners or stakeholders | Where the Customer shares dashboards, exports, reports, galleries or other outputs |
| Public viewers | Where Responses or Reaction Content appear on Public Surfaces |
| Hosting, database and infrastructure providers | To host, store, deliver, secure and operate Yush |
| Authentication providers | To allow account creation and sign-in, including Google Sign-In where used |
| Email providers | To send transactional emails, response links, account emails and service communications |
| Payment providers | To process payments, billing and subscriptions |
| Analytics and product-insight providers | To understand usage, improve the Service and diagnose issues where enabled |
| AI service providers | To provide AI-assisted analysis, transcription, classification, summarisation and reporting where enabled |
| CRM and customer-support providers | To manage Customer relationships, support requests and communications |
| Professional advisers | To obtain legal, accounting, insurance, finance or business advice |
| Regulators, courts, public authorities or law enforcement | Where required by law or necessary to protect rights, safety, security or legal interests |
| Corporate transaction parties | In connection with a merger, acquisition, investment, restructuring, financing or sale of assets |
We require service providers that process personal data for us to handle it under appropriate contractual obligations.
A list of material subprocessors is set out in our Data Processing Addendum or subprocessor list.
10. International transfers
We and our service providers may process personal data in the United Kingdom, European Economic Area, United States and other countries where we or our service providers operate.
Where personal data is transferred internationally and transfer safeguards are required, we use appropriate safeguards such as adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, EU Standard Contractual Clauses or other lawful transfer mechanisms as applicable.
11. Cookies and similar technologies
We use cookies and similar technologies on Yush to keep the Service working, remember preferences, support authentication, understand usage and improve the Service.
Strictly necessary cookies and similar technologies are used for authentication, session management, security, load balancing, consent preferences and core Service functionality. These are always on where required for the Service to work.
Analytics, performance, advertising or tracking technologies may include tools such as Google Analytics, Google Tag Manager, Hotjar, Meta Pixel, LinkedIn Insight Tag, HubSpot tracking or similar tools where enabled.
Non-essential cookies and similar technologies are used only where required consent has been given.
Where Google Consent Mode v2 is enabled, if you reject non-essential cookies, Google services may receive limited cookieless signals for consent and aggregated measurement purposes, depending on our configuration. We do not intentionally use these signals to identify you.
You can manage cookie choices through our cookie banner or cookie settings where available. You can also control cookies through your browser settings.
12. Marketing communications
We may send Customers service-related emails, account notices, billing messages, product updates or support communications.
We may send marketing communications where we have consent or where a valid PECR soft opt-in applies. A soft opt-in only applies where we collected your contact details directly during a sale or negotiation for our services, we are marketing similar Yush products or services, and we gave you a clear opportunity to opt out when we collected your details and in every marketing message.
Providing an email address to receive a copy of a Response or follow-up link does not automatically opt you into marketing.
You can unsubscribe from marketing emails using the unsubscribe link in the email or by contacting support@yushnow.com.
We may still send non-marketing service messages where necessary to provide the Service, manage your account, respond to support requests or comply with law.
13. Data retention
We keep personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer period is required for legal, accounting, tax, security, dispute resolution or regulatory reasons.
Typical retention periods include:
| Data | Typical retention |
|---|---|
| Customer account data | For the life of the account, then as needed for legal, accounting, security or dispute purposes |
| Billing and payment records | Usually up to 6 years where needed for tax, accounting and audit purposes |
| Responses and Reaction Content | For as long as the relevant Customer keeps the Reaction Kit, account, gallery or report active, unless deleted earlier or retained for legitimate legal, security or dispute reasons |
| Public galleries and Yush examples | Until disabled, deleted, removed by Yush or the Customer, or a valid removal request is actioned, subject to legal and backup retention |
| Email-capture data | For the purpose requested, such as sending a copy, link or follow-up, and then according to applicable Customer/Yush settings and legal requirements |
| Marketing consent and suppression records | For as long as needed to evidence consent, opt-out or suppression |
| Support messages | For as long as needed to provide support and maintain business records |
| Logs, security and diagnostic data | For a limited period appropriate for security, debugging, fraud prevention and service integrity |
| Backups | Retained and overwritten according to ordinary backup cycles |
| Aggregated or de-identified data | May be retained indefinitely where it no longer identifies individuals |
If personal data is exported by a Customer, the Customer is responsible for the exported copy.
If a Response has already been published, shared or exported, we may not be able to delete every copy, but we will take reasonable steps to remove or restrict content from Yush-controlled Public Surfaces where appropriate.
14. Data security
We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
These measures may include access controls, authentication, encryption in transit, provider-level encryption at rest, infrastructure security, logging, monitoring, confidentiality obligations and incident-response processes.
No online service can be guaranteed to be completely secure.
Customers are responsible for managing access to their accounts, keeping credentials secure and handling exported data safely.
15. Your rights
Depending on where you are and how your personal data is processed, you may have rights to:
- access your personal data;
- correct inaccurate personal data;
- request deletion of personal data;
- restrict processing;
- object to processing;
- receive a copy of your personal data in a portable format;
- withdraw consent where we rely on consent;
- object to direct marketing;
- complain to a supervisory authority.
In the UK, the supervisory authority is the Information Commissioner’s Office.
To exercise your rights, contact support@yushnow.com.
If your Response was submitted through a Customer’s Reaction Kit, the Customer may be the controller of that data. We may refer your request to the relevant Customer or work with them to respond. Where we are responsible for responding to an erasure request and personal data has been disclosed to recipients or made public through Yush, we will take reasonable steps required by applicable law, which may include informing relevant recipients or controllers where this is possible and not disproportionate.
Because many Responses are submitted without an account, we may need enough information to identify the Response before we can act on a request. This may include the event name, approximate submission time, screenshot, response text, photo, email address used or response link.
Where we cannot reasonably identify your Response, we may be unable to delete, access or amend it.
16. Children and young people
Customer accounts are for people aged 18 or over.
The Service is not intended for Respondents under 13. If you are under 13, do not submit a Response.
We do not knowingly collect personal data from children under 13. If you are a parent or guardian and you believe your child has provided personal data through Yush, contact us at support@yushnow.com. If we learn that we have collected personal data from a child under 13 without appropriate consent, we will take reasonable steps to delete it.
Customers must not knowingly invite children under 13 to submit Responses.
Customers must use appropriate safeguards for Reaction Kits involving children aged 13 to 17, including suitable notices, permissions, moderation and disabling public display or photo capture where public reuse would be inappropriate.
17. Links and third-party services
Yush may contain links to third-party websites, event pages, Customer websites, social media pages or third-party services.
We are not responsible for the privacy practices of third parties that we do not control. You should review their privacy policies before providing personal data to them.
18. Changes to this Privacy Policy
We may update this Privacy Policy from time to time.
The latest version will be available on our website. Where changes are material, we will take reasonable steps to notify Customers or users where appropriate.
If we need to use personal data for a new purpose that is not compatible with the original purpose, we will provide appropriate notice and explain the lawful basis before doing so, unless the law permits or requires otherwise.
19. Contact
For privacy questions, rights requests or removal requests, contact:
Email: support@yushnow.com