Privacy Policy
Last updated: October 7, 2026
Yellow Brick Road ("OZ", "we", "us") respects your privacy. This Privacy Policy explains what personal data we collect, why we use it, and how you can exercise your rights.
1. Data Controller
The data controller is:
Yellow Brick Road (OZ)
Website: https://yellowbrickroad.me
Email: [email protected]
2. Data We Collect
When you contact us through our website, we may collect:
- your email address;
- the country you provide;
- the subject and description of your request;
- the request type(s) you select;
- the reference number associated with your request;
- information you voluntarily include in your message.
Our website may also generate technical information required for security and operation, such as IP address, request metadata and security-related information.
Please do not submit unnecessary sensitive personal information through the contact form.
3. Why We Use Your Data
We use this information only to:
- receive and respond to investigation requests;
- communicate with you about a requested service;
- provide and secure our website and contact form;
- prevent spam, abuse and automated submissions;
- comply with applicable legal obligations.
We do not sell your personal information.
4. Legal Basis
Where the GDPR applies, processing is based on:
- Article 6(1)(b) GDPR where processing is necessary to respond to a request or take steps at your request before entering into a contract;
- Article 6(1)(f) GDPR where processing is necessary for legitimate interests such as website security, fraud prevention and abuse prevention;
- Article 6(1)(c) GDPR where processing is necessary to comply with a legal obligation.
Where another privacy law applies, we process personal information according to its applicable legal requirements.
5. Service Providers
We use third-party infrastructure providers necessary to operate the service, including:
- Cloudflare — website hosting, security and anti-abuse infrastructure;
- Cloudflare Turnstile — automated abuse and bot prevention;
- Elastic Email — delivery of contact-form messages to our email inbox;
- Proton Mail — email service used to receive and manage communications.
These providers may process information on our behalf and may process data in countries outside your country of residence.
You can review their respective privacy policies through their websites.
6. International Data Transfers
Yellow Brick Road is an international service. Depending on the services and infrastructure involved, personal data may be processed or stored outside the European Economic Area or your country of residence.
Where required by applicable law, appropriate safeguards are used for international transfers.
7. Data Retention
We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including handling your request, providing services, resolving disputes and meeting legal obligations.
We may delete or anonymize information when it is no longer required.
8. Your Rights
Depending on the law applicable to you, you may have rights to:
- access your personal data;
- correct inaccurate data;
- request deletion;
- request restriction of processing;
- object to certain processing;
- request data portability;
- withdraw consent where processing is based on consent.
To exercise your rights, contact:
We may request sufficient information to verify your identity before responding to a request.
If the GDPR applies to you, you may also lodge a complaint with your local data protection authority. In France, this is the CNIL.
9. Cookies and Similar Technologies
Yellow Brick Road does not intentionally use advertising cookies or third-party advertising trackers.
Cloudflare services, including Turnstile and security infrastructure, may use technical mechanisms necessary to provide security and operate the website.
10. Children's Privacy
Our services are not directed at children. We do not knowingly collect personal information from children where prohibited by applicable law.
11. Changes to This Policy
We may update this Privacy Policy when our services, infrastructure or legal obligations change. The latest version will always be published on this page with its effective date.
12. Applicable Privacy Frameworks
This Policy is intended to provide information consistent with applicable privacy laws, including, where applicable:
- the EU General Data Protection Regulation (GDPR);
- applicable United States state privacy laws, including the California Consumer Privacy Act (CCPA/CPRA).
Nothing in this Policy limits rights that cannot lawfully be excluded under the laws applicable to you.