1. Who This Policy Covers
This policy covers three groups of people who interact with Yolla Media:
- Visitors to yollamedia.com: people who browse this website, including publishers evaluating Yolla as a monetization partner.
- Publisher partners: companies and individuals who use Yolla’s ad management platform to monetize their web properties.
- End users on publisher sites: people who visit gaming sites and other web properties where Yolla’s ad technology is deployed.
Yolla acts in different roles depending on the context. Yolla Media, LLC is the controller for yollamedia.com and the forms on it, and for its own consent management platform and reporting data. When Yolla’s ad tag runs on a publisher’s site, Yolla and the publisher are each separate controllers of the advertising data. For collecting data through our ad tag and sending it to us, we and the publisher may be joint controllers: the publisher gives you notice and asks for consent, and you can exercise your rights with either of us. Our Advertising Privacy Statement explains how that data is used.
If you are a publisher partner reviewing this policy before signing a partnership agreement, Section 3 (TCF Consent Management) is most directly relevant to your compliance obligations.
Data controller inquiries and formal rights requests for yollamedia.com should be directed to: privacy@yollamedia.com. For end-user data questions related to a specific publisher site, you can also contact that publisher directly.
2. What Data We Collect
For yollamedia.com visitors
When you submit the Get a Revenue Estimate form, we collect: the sites you list (up to 10), your monthly traffic range, game genre, current monetization setup, your name, and your email address. Only your sites and email address are required. If you submit the form more than once, we keep a record of each submission. We use this information to assess whether our managed service fits your sites and to reply to you.
When you submit the advertiser inquiry form on our advertisers page, we collect: your company, contact name, and email address (required), and, if you provide them, your role, monthly budget range, target audiences or categories, the demand-side platforms you currently use, and any additional context you add. We use this information to reply to your inquiry.
When you sign up for our newsletter on the blog, we store your email address, where you signed up, the signup date and, if you unsubscribe, the date you did. We use your email only to send the newsletter, through a third-party email service. Every newsletter includes an unsubscribe link, and you can ask us to delete your address at any time.
We also collect standard web analytics data (page views, session duration, referral source, browser type, and device type) to understand how publishers use this site and where to improve it. We use Google Analytics 4 to collect aggregate site usage data. GA4 data is retained for 14 months. No personally identifying information is sent to the analytics system.
For publisher partners
We collect: business contact information (name, email, company name, billing contact, tax forms (W-9/W-8), portal login credentials), site performance data (revenue, impressions, CPMs, fill rates, bid landscape data), and payment information used for revenue share disbursements. This data belongs to the publisher relationship. Aggregated auction data that does not identify a publisher may be combined across the Yolla network to inform floor pricing and demand reporting.
For end users on publisher sites
When Yolla’s ad tag runs on a publisher’s site, it may collect or process the following data, subject to consent signals received from Yolla’s consent management platform (IAB TCF):
- Consent preferences (what a user has accepted or declined via the consent prompt)
- Ad interaction data (impressions served, clicks, and similar standard programmatic data)
- Technical identifiers (cookie IDs, device identifiers): in the EEA, UK, Switzerland, and anywhere else the law requires it, only with consent; elsewhere unless you opt out
- IP address, used for approximate location and fraud prevention
For how Yolla and its advertising partners use data when ads are shown on publisher sites, including the partners we work with and how to opt out, see our Advertising Privacy Statement.
How long we keep it
- Revenue estimate requests and advertiser inquiries: 24 months after our last contact with you.
- Newsletter signups: until you unsubscribe, then deleted within 30 days.
- Publisher partner accounts: for as long as the partnership lasts, plus 7 years for payment and tax records.
- Advertising data from publisher sites and consent records: up to 13 months.
After these periods we delete the data or keep it only in a form that no longer identifies you.
3. TCF Consent Management
Technical Implementation
Yolla provides InMobi Choice, an IAB-registered consent tool, as part of its ad tag (or the publisher uses another tool Yolla approves). It is a Consent Management Platform (CMP) that implements the IAB Europe Transparency and Consent Framework (TCF) and is integrated directly into the Yolla ad tag deployed on publisher sites, so publishers do not need to contract or implement a separate CMP.
How it works: When an end user in the European Economic Area, the United Kingdom, or Switzerland visits a publisher site with Yolla’s technology for the first time (or after a prior consent record has expired), a consent prompt appears before any personalized ad data is collected or transmitted. The user’s response (which data uses they accept and which they decline) is recorded as a consent signal.
For those users, the consent signal is transmitted to all demand partners in every subsequent bid request, and partners must honor it. Elsewhere, users can opt out as described in our Advertising Privacy Statement.
The vendor list managed through this CMP is maintained by Yolla. When TCF specification versions change or vendor lists are updated, those changes propagate through Yolla’s infrastructure. Publishers in the Yolla network do not need to redeploy their ad tag to pick up those changes.
Yolla’s CMP is built on InMobi Choice (formerly Quantcast Choice), integrated with the IAB TCF Global Vendor List. Consent records are stored and retained for 13 months from the date of the user’s last consent interaction.
4. Rights for Users in the EEA, UK, and Switzerland
If you are located in the European Economic Area, United Kingdom, or Switzerland, the GDPR, UK GDPR, or Swiss Federal Act on Data Protection (FADP), as applicable, governs how Yolla processes your personal data. You have the following rights:
- Right to access: You can request a copy of the personal data Yolla holds about you.
- Right to rectification: You can request correction of inaccurate data.
- Right to erasure: You can request deletion of your personal data under qualifying circumstances.
- Right to restriction of processing: You can request that Yolla limit how it processes your data in certain circumstances.
- Right to data portability: You can request your data in a commonly used, machine-readable format.
- Right to object: You can object to processing based on legitimate interests.
- Right to withdraw consent: Where processing is based on your consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.
To exercise any of these rights, contact us at privacy@yollamedia.com. We respond to rights requests within 30 days of receipt.
5. US Privacy Rights
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the CCPA), grants you the following rights:
- Right to know: You can request information about the categories and specific pieces of personal information Yolla has collected about you in the past 12 months.
- Right to delete: You can request deletion of personal information Yolla has collected, subject to certain exceptions.
- Right to opt out of sale or sharing: Yolla does not sell personal information as most businesses understand that term. However, certain data sharing in programmatic advertising may constitute a “sale” or “sharing” under the CCPA. You can opt out through the “Do Not Sell or Share My Personal Information” link on publisher sites where Yolla’s ad tag runs, by turning on Global Privacy Control in your browser, or by emailing privacy@yollamedia.com.
- Right to non-discrimination: Exercising your CCPA rights will not result in different pricing, service quality, or other discriminatory treatment.
To exercise your rights, contact us at privacy@yollamedia.com. We respond within 45 days.
Residents of other US states with comprehensive privacy laws, including Virginia, Colorado, Connecticut, Texas and Oregon, have the same rights: to know, access and correct their personal information, to delete it, and to opt out of its sale and of targeted advertising. We honor Global Privacy Control as an opt-out for visitors anywhere in the US. If we decline your request, you can appeal by replying to our decision; we answer appeals within 45 days and, if we deny the appeal, tell you how to contact your state attorney general.
7. ads.txt and Supply Chain Transparency
Yolla monitors ads.txt configuration across publisher partner sites as part of the managed service.
ads.txt is an IAB-standard file that identifies which ad technology companies are authorized to sell a publisher’s ad inventory. When an unauthorized entry appears (whether added by a third party, misconfigured, or missing), it creates two problems: buyers may pay for spoofed inventory they didn’t intend to buy, and publishers may lose revenue to unauthorized resellers.
Yolla’s monitoring layer regularly checks ads.txt files and fires an alert when an unauthorized addition, deletion, or configuration error is detected, so publishers can act on the change quickly. This monitoring is documented here because it involves processing data related to publisher sites on an ongoing basis, and because transparency about how that data is used is the point.
8. Contact and Policy Updates
For privacy questions, rights requests, and data inquiries:
- General inquiries: within 5 business days
- GDPR rights requests: within 30 days
- CCPA requests: within 45 days
For publisher partners: Specific questions about how Yolla processes data within your publisher account should be directed to your Yolla account contact. For formal rights requests, use the address above.
Policy updates: Material changes to this policy will be communicated by email to publisher partners before the changes take effect. The effective date at the top of this page will be updated to reflect the date the revised policy applies.
Want to know what your gaming site could earn? Get a Revenue Estimate.