Privacy Policy – Yosch Media
1. Who we are and what this policy covers
This Privacy Policy explains what personal data YOSCH MEDIA LTD (“YOSCH MEDIA”, “we”, “us”) collects when you use https://yoschmedia.com/ and our apps https://app.yoschmedia.com/. It also explains why we collect it, where it is stored, who can access it, and what rights you have. It is linked from the footer of landing page at https://yoschmedia.com/privacy-policy/.
Controller. YOSCH MEDIA LTD, 71-75 Shelton Street Covent Garden London WC2H 9JQ UNITED KINGDOM, company number 15495052, is the controller of your personal data. Contact: https://yoschmedia.com/contact/.
Where we operate. The Platform is offered in the United Kingdom, the United States, Canada, Australia, New Zealand, the United Arab Emirates, Singapore, Thailand, Japan and Switzerland. We apply the protections in this policy to all users. Where the law of your country gives you additional rights, Section 9 explains them. The main laws are:
| Country | Main privacy law |
| United Kingdom | UK GDPR and Data Protection Act 2018 |
| Switzerland | Federal Act on Data Protection (revFADP) |
| United States | State privacy laws, including the California Consumer Privacy Act (CCPA/CPRA) |
| Canada | PIPEDA and provincial laws (including Quebec Law 25) |
| Australia | Privacy Act 1988 and the Australian Privacy Principles |
| New Zealand | Privacy Act 2020 |
| United Arab Emirates | Federal Decree-Law No. 45 of 2021 (PDPL) |
| Singapore | Personal Data Protection Act 2012 (PDPA) |
| Thailand | Personal Data Protection Act B.E. 2562 (PDPA) |
| Japan | Act on the Protection of Personal Information (APPI) |
What this policy does not cover. This policy does not cover third-party websites you reach through links on the Platform, including Affiliate Business websites (see Section 8). It also does not cover how Clients, Talents and Hosts use personal data they receive from each other for their own business. Each user is responsible for their own handling of that data.
2. The personal data we collect
We collect only what we need to run the Platform, take payments and meet our legal duties.
| Category | Examples | Source |
| Account data | Name, email, password (stored hashed), country, language, account type, subscription plan | Us |
| Profile data | Photo, headline, skills, portfolio, rates, business name, links | Us |
| Age and supervision data | Confirmation of age 18+; for supervised use, the adult’s declaration that a minor aged 13 to 17 uses the account | Us |
| Verification and KYC status | Whether Stripe has verified your identity and tax details; account restrictions and the reason for them. Stripe collects ID documents directly; we do not store copies of your ID | Stripe |
| Tax reporting data | Legal name, address, date of birth, tax ID or VAT number, country of residence, gross payments received, number of transactions | Us and Stripe |
| Payment data | Payment history, amounts, refunds, chargebacks and card trust status (number of successful payments). Card details are collected and stored only by Stripe. We do not receive or store any card numbers or card details | Stripe |
| Payout data | Payout status and history, and fees deducted. Bank account details are collected and stored only by Stripe or Airwallex. We do not receive or store any bank details | Stripe, Airwallex |
| Project and ledger data | Project offers, contract type, amounts in Security Hold, approvals, disputes, cancellations, earnings ledger, certification progress | Us and other users |
| Messages and files | Chat messages, uploaded files, deliverables, Skill Challenge entries | Us and other users |
| Webinar and tutoring data | Bookings, attendance, cancellations, and recordings where the Host records a session and has told participants | Us and Hosts |
| Reviews | Ratings and written reviews you give and receive | Us and other users |
| Verification contacts | Notes from verification calls or emails (Section 7) | Us |
| Support data | Emails and support tickets | Us |
| Technical and security data | IP address, device and browser type, log-in times, error logs, security events | Automatically, through Cloudflare, Vercel, Render and Axiom |
| Cookie data | See Section 8 and our Cookie Policy | Automatically |
| Affiliate Business data | Business name, contact person, listing content, commission percentage shown, listing renewal history | Affiliate Businesses |
We do not intentionally collect sensitive data (such as health, religion or biometric data). Please do not put it in your profile, messages or files.
3. Why we use your data and our legal basis
Where a law requires a legal basis (for example, UK GDPR or the Swiss revFADP), we rely on the bases below.
| Purpose | Data used | Legal basis |
| Create and run your account and subscription | Account, profile, payment data | Contract |
| Match Clients and Talents; show profiles, listings and reviews | Profile, reviews, Project data | Contract |
| Process payments, Security Holds, refunds and payouts | Payment, payout, Project and ledger data | Contract |
| Identity and tax verification (KYC) | Verification status, tax reporting data | Legal obligation |
| Report seller earnings to tax authorities where platform reporting rules apply | Tax reporting data, payout and ledger data | Legal obligation |
| Prevent fraud, chargebacks and payment abuse; set payout waiting periods | Payment, card trust status, technical data | Legitimate interests (keeping payments safe) and legal obligation |
| Enforce the no-circumvention and no-zero-budget rules; keep minors safe | Messages, files, Project data, supervision data | Legitimate interests (user safety, legal compliance) |
| Run webinars and tutoring | Booking, attendance and, where used, recording data | Contract |
| Track certification progress and issue certificates | Ledger, Project and assessment data | Contract |
| Customer support and dispute handling | Support, messages, Project data | Contract and legitimate interests |
| Security, debugging and service improvement | Technical data, logs | Legitimate interests |
| Service emails (receipts, security alerts, changes to terms) | Account data | Contract and legal obligation |
| Marketing emails | Name, email | Consent only, which you can withdraw at any time |
| Non-essential cookies | Cookie data | Consent |
| Comply with law enforcement or court requests; establish or defend legal claims | Any relevant data | Legal obligation and legitimate interests |
We do not sell your personal data, and we do not share it for cross-context behavioural advertising.
4. Automated checks and decisions
4.1 Message scanning. Our systems automatically scan chat messages and Project descriptions for contact details, off-platform payment requests and zero-budget arrangements. When something is detected, we may show an in-app notice to the sender or recipient, and flag the conversation for human review. We use this only to enforce our Terms and protect users. We do not use message content for advertising.
4.2 Payout waiting periods. Our system automatically decides the payout waiting period for each payment. The decision is based on the amount and on whether the card is “trusted” (at least 3 successful payments without a chargeback or dispute). This can delay when you receive money.
4.3 Verification restrictions. Stripe may automatically restrict payouts if verification or tax details are missing. We receive this status and display it in your profile.
4.4 Your right to human review. If an automated decision significantly affects you (for example, a payout hold or a restriction on your account), you can ask for a person to review it, explain your point of view and contest the decision by contacting https://yoschmedia.com/contact/.
5. Who we share your data with
5.1 Our service providers. Your data is transferred across our cloud infrastructure and stored by the providers below. They act on our instructions under data processing agreements. Stripe and Airwallex also act as independent controllers for their own legal duties, such as anti-money-laundering checks.
| Provider | What they do for us | Data they handle | Main location |
| Vercel | Hosting of the platform front end | Technical data, page requests | Germany, EU (Frankfurt), with a global edge network |
| Render | Hosting of our back-end services | All Platform data processed by our servers | Germany, EU (Frankfurt) |
| Supabase | Database, file storage and log-in | Account, profile, Project, message, file and ledger data | Germany, EU (AWS Frankfurt) |
| Stripe | Payments, Security Hold, Connect accounts, KYC, tax information collection and reporting support, PCI-DSS card security | Payment, payout, verification and tax data | United States and Ireland |
| Airwallex | Payouts and currency conversion | Payout and identity data | United Kingdom (Airwallex (UK) Limited); may transfer data to Airwallex group companies and partners outside the UK |
| Axiom | Application logging and monitoring | Technical data, error logs | United States |
| Cloudflare | Content delivery, DNS, security and bot protection | IP address, technical data | Global network (United States) |
| Resend | Sending service and transactional emails | Name, email, email content | United States |
| HostGator | Hosting of the landing page (WordPress and WooCommerce) | Technical data, landing page form and shop data | United States |
| CleanTalk | Spam and bot protection for landing page forms | IP address, email entered in forms, browser and behaviour signals (such as mouse and keyboard activity) | United States |
| Tidio | Live chat on the landing page (with your consent) | Chat messages, name and email if given, technical data | Poland, EU / United States |
| Mixpanel | Website analytics on the landing page (with your consent) | Usage and device data, pages viewed | United States |
| Automattic (WooCommerce) | Shop usage statistics on the landing page (with your consent) | Usage and technical data | United States |
| Google (Google Fonts) | Delivering fonts on the landing page | IP address, browser data | United States [remove if fonts are self-hosted] |
| [Arbitration provider] | Independent arbitration of Client–Talent disputes, only if a party refers a dispute | Project, message and payment records relevant to the dispute | [location] |
5.2 Other users. Your public profile, listings, reviews and certification badges are visible to other users and, where you make them public, to visitors. When you enter a Project, webinar or tutoring session, the other party sees the information needed to do business with you, such as your name, messages and files.
5.3 Tax authorities and regulators. Where platform reporting rules apply (for example, the OECD Model Reporting Rules in the UK, Canada and New Zealand, the Australian Sharing Economy Reporting Regime, or US Form 1099-K), we or Stripe on our behalf report seller data to the relevant tax authority.
5.4 Legal and safety reasons. We may disclose data to police, courts or authorities when the law requires it, or where it is reasonably necessary to protect someone’s safety, prevent fraud, or establish, exercise or defend legal claims.
5.5 Business transfers. If we sell, merge or transfer all or part of our business, your data may pass to the new owner, who must continue to protect it under this policy.
6. International transfers, retention and security
6.1 International transfers. Our providers store and process data in the countries listed in Section 5, mainly the United States. Your data may therefore leave your country. Where the law of your country requires safeguards, we use them. These include the UK International Data Transfer Addendum or UK–US Data Bridge, EU and Swiss Standard Contractual Clauses, the Swiss–US Data Privacy Framework where the provider is certified, and contractual safeguards required under the laws of Japan, Singapore, Thailand, Australia, New Zealand, Canada and the UAE. You can ask us for a copy of the relevant safeguard.
6.2 How long we keep data.
| Data | How long |
| Account and profile data | While your account is open, and then for up to 7 years after your last transaction, to meet tax obligations. To delete your account, send a request through our online contact form (see Section 9.1). We will then replace your name with an anonymous label (for example “deleted_user_123”) and remove your profile from public view. The remaining data is kept for up to 7 years after your last transaction for tax purposes, and then deleted |
| Payment, payout, ledger and tax reporting records | Up to 7 years after the transaction, for tax purposes. Stripe also holds payment, payout and tax records under its own legal retention duties, and we may retrieve them from Stripe when needed |
| Project records, messages and files | No fixed deletion period at present. Kept for as long as needed for disputes, arbitration, fraud prevention and legal claims, or until you ask us to delete them through our online contact form, unless we must keep them by law |
| Webinar and tutoring recordings | No fixed deletion period at present. Kept until the Host deletes them or you ask us to delete them through our online contact form |
| Verification call or email notes | No fixed deletion period at present. Kept for as long as needed to show that verification took place, or until you ask us to delete them, unless needed for an open investigation |
| Technical and security logs | 30 days |
| Marketing consent records | No fixed deletion period at present. Kept as proof of your consent or withdrawal of consent |
When data is no longer needed, we delete it or anonymise it.
6.3 Security. We protect data with encryption in transit (TLS), encryption at rest at our providers, access controls with least-privilege permissions, logging and monitoring, and DDoS and bot protection. Card data is handled only by Stripe under PCI-DSS. If a personal data breach is likely to put your rights at risk, we will notify you and the relevant regulator where the law requires it, within the required time (for example, 72 hours under UK GDPR).
7. Children and supervised minors
7.1 Under 13. We do not accept users under 18, and the Platform is not directed at or advertised to minors. It is never for children under 13. We do not knowingly collect personal data from children under 13. If we learn we have, we delete it. If you believe a child under 13 has given us data, contact us through our online contact form at https://yoschmedia.com/contact/.
7.2 Ages 13 to 17. Minors cannot hold accounts. A parent or legal guardian with a verified Premium Account may let their child aged 13 to 17 use that account under supervision, as set out in our Terms. In that case:
- the account and profile are in the adult’s name, and the account, contracts, payouts and tax data belong to the adult;
- the adult is responsible for any data about the minor that is shared on the Platform, and must keep it to a minimum (no photos, school details, contact details or location of the minor);
- we record that the adult has declared supervised use, so we can apply extra safety checks;
- we do not use any data about the minor for marketing or profiling.
7.3 Age and identity checks. To protect minors, we may contact an account holder by email, phone or video call, or ask for verification through Stripe. We keep a short record of the check and its outcome (Section 6.2). We do not keep copies of identity documents ourselves.
8. Cookies, external links and the affiliate section
8.1 Cookies. Our platform at https://app.yoschmedia.com/ uses only strictly necessary cookies: for log-in (Supabase), security and bot protection (Cloudflare) and payment fraud prevention (Stripe). Our landing page at https://yoschmedia.com/ also uses strictly necessary cookies for cookie choices (Complianz), the shop basket (WooCommerce) and spam protection (CleanTalk). With your consent only, the landing page also uses functional cookies for live chat (Tidio) and analytics cookies (Mixpanel, Burst Statistics and WooCommerce). You can accept, reject or change your choices at any time through the cookie banner and the “Cookie settings” link on the landing page. The full list of cookies, their purpose and duration is in our Cookie Policy.
8.2 External links and affiliate offers. The Platform contains advertisements and business profiles with external links. Clicking these links redirects you to third-party websites, and we show a notice before you leave. Any tracking cookies, data collection or affiliate attribution technologies used beyond that point are governed solely by the relevant business’s privacy policy. We do not access, store or process any transaction or tracking data related to those external programs. [We may record that an outbound link was clicked, without any data from the third-party site, to count listing views and keep the Platform secure.]
8.3 Affiliate Businesses’ own data. We process the business contact and listing data that Affiliate Businesses give us to publish and renew their listings and to bill them.
9. Your rights
9.1 Rights everyone has with us. Wherever you live, you can ask us to:
- give you a copy of your personal data (access);
- correct inaccurate data;
- delete your data, unless we must keep it (for example, tax and payment records);
- send your data to you or another provider in a machine-readable format (portability);
- stop or limit certain uses, including objecting to uses based on legitimate interests;
- withdraw consent (for marketing or non-essential cookies) at any time;
- have a person review a significant automated decision (Section 4.4).
Send requests through our online contact form at https://yoschmedia.com/contact/, choosing “Privacy request” as the topic. We may need to verify your identity first. We reply within one month (UK, Switzerland), 45 days (US states), 30 days (Canada, Australia, Singapore, Thailand, UAE), 20 working days (New Zealand), or without undue delay (Japan), and may extend where the law allows. Requests are free unless they are clearly unfounded or excessive.
9.2 United States. Residents of California and other states with privacy laws have the right to know, access, correct and delete personal data, and not to be discriminated against for using these rights. We do not sell personal data or share it for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics. You may use an authorised agent. We honour Global Privacy Control signals as an opt-out where applicable.
9.3 Complaints. Please contact us first so we can try to help. You can also complain to your local regulator:
| Country | Regulator |
| United Kingdom | Information Commissioner’s Office (ICO) |
| Switzerland | Federal Data Protection and Information Commissioner (FDPIC) |
| United States (California) | California Privacy Protection Agency |
| Canada | Office of the Privacy Commissioner of Canada |
| Australia | Office of the Australian Information Commissioner (OAIC) |
| New Zealand | Office of the Privacy Commissioner |
| United Arab Emirates | UAE Data Office |
| Singapore | Personal Data Protection Commission (PDPC) |
| Thailand | Personal Data Protection Committee (PDPC) |
| Japan | Personal Information Protection Commission (PPC) |
9.4 Contact us. YOSCH MEDIA LTD, 71-75 Shelton Street Covent Garden London WC2H 9JQ UNITED KINGDOM. Online contact form:https://yoschmedia.com/contact/.
9.5 Changes to this policy. We may update this policy. We will tell you about material changes by email or in-app notice before they take effect, and show the date of the last update below.
Last updated: 27.10.2026.