Privacy Policy

What Vyyna keeps about you, your brand and your pictures, who processes it, how long it is kept, and how to have it deleted.

Last updated 22 October 2026

Who we are

Ongaro Samuele, Via Venezia 22, 37069 Villafranca di Verona (VR), Italy, is the controller of the personal data described here. You can reach us at hello@vyyna.com about anything on this page.

The short version

The images and videos you create are kept in private storage until you delete them — deleting one removes it everywhere, for good. Only you can reach them, from any device you sign into. They are not stored inside the app, so downloading one - or saving it to your photo library - is how you keep it. To create a result, your photo is sent securely to the AI processing provider that produces it, and only for that purpose. Nothing you upload or make is published, shown to anybody else, or used to train a model — the providers who do the processing are barred from training on it by the contracts we hold with them. We keep the information needed to run your account, your credits and our service — and nothing more. If you use the Studio, we also read the shop address you give us and keep the brand and product details we find there, which is described below.

What we store

• An anonymous identifier for your installation, so credits and purchases work.
• Your credit balance and an immutable record of every credit movement.
• Purchase records received from the app stores and from Stripe, and the plan you are on.
• If you use a discount code, or receive the welcome gift: that your account used it, and a one-way fingerprint of your email address — a code made from it that cannot be turned back into the address.
• Metadata about each creation: which trend, when, whether it succeeded, and how long it took.
• Each creation, until you delete it, in private storage separate from our servers. It is reachable only through a short-lived link issued to you, and it is deleted immediately and permanently the moment you delete it. We record the day it was made.
• If you create an account: your email address and display name.
• If you use the Studio: the shop address you gave us, the brand details read from it — name, colours, typefaces, logo, the words on the site — and, for each product you add, its name, its description, its price and its photographs. You can correct any of it, and deleting a brand or a product deletes what was read for it. Billing details you enter for an invoice, including a VAT number, are held by our payment provider.
• If you give a photo to the Studio’s agent on app.vyyna.com: the photo itself, kept privately in your account so you can make more pictures from it, with the day you first uploaded it and how many pictures were made from it. Only you can see it, and it is deleted with your account.
• If you use the agent’s chat on app.vyyna.com: what you write in it, the questions it asks and your answers, the plan and the review of each picture, and the choices it keeps for the chat (its style, its lettering, its language). They stay with the chat until you delete it; deleting a chat deletes its messages and everything it decided. The pictures it made stay in your Project until you delete them.
• For each thing that happens — signing up, a chat started, a picture made, credits spent — the time, which trend, the outcome, your platform and app version, and the country the request came from. This is how we understand how Vyyna is used, spot abuse, and will later show you your own history. It records what happened and never what was in it: no photographs, no descriptions, no message you typed.
• If you turn on notifications: the token your phone gives us to send them, stored encrypted.
• When something breaks, a record of the error - what went wrong and where in our software - so we can fix it. It is scrubbed before it is written: no email address, no photograph, no link, no message you typed.

What we do not store

• The photos you upload in the app or for a trend, beyond the moment they are being processed. (Photos you give the Studio’s agent are kept for you - see above.)
• Any creation you have deleted: it is gone from storage at once.
• Anything at all on our own servers: creation files live in separate private storage.

A photo you choose is cropped on your phone before it is sent, so the part you framed out never leaves the device. A video is different only because a phone cannot cut one: the whole clip goes to private storage, the seconds you kept are cut from it, and the original is deleted the instant that cut exists. Only those seconds — with their sound — reach the provider, and nothing outside them is ever kept.

When you delete a creation it is deleted permanently, including for us, and it cannot be recovered. A copy you download, or save to your photo library, is yours; from that point this policy no longer governs it.

AI processing

Creating a result requires sending your photo to a third-party AI processing provider. This happens only when you tap create, only for the creation you asked for, and you are asked to agree before the first time. Processing copies are deleted according to our processing policy and the provider’s retention terms.

Those providers apply their own content checks and will refuse a request they consider unsafe. When that happens the creation fails and you are told; we do not see or keep what was refused. What you may upload is set out in the terms, and you can report anything you believe breaks them at hello@vyyna.com.

The agent. When you use the agent’s chat, what you write, the photograph of your product and your brand details are also sent to AI text and vision models, under the same commitments as below, so that they can understand the request, plan the picture, write its words and check the result. A request containing words for content we do not create is refused before anything is sent.

Reading your shop

When you give the Studio the address of a shop, we fetch its publicly available pages on your instruction and read what they contain: the brand’s colours, typefaces, logo and wording, and a product’s name, description, price and photographs. We read only what the site serves to an ordinary visitor, we honour a site that refuses automated readers, and we keep what we extracted rather than the pages. A read that finds nothing usable is not charged.

This is done to perform our contract with you — it is the thing you asked for. The terms require you to be entitled to ask: the shop must be yours or one you are authorised to act for, and the brand and the photographs must be yours to use. A brand kit and its products are visible only to the account that created them. Delete a brand, a product or your account and what was read for it goes with it.

Why we are allowed to process this

• To give you what you asked for — creating a result, holding your credits, running your account. This is the performance of our contract with you.
• To keep purchase and credit records. We are required to keep these by tax and accounting law, which is why they outlive the rest of your data.
• To make sure a discount code is used once per person. This is our legitimate interest in preventing abuse of an offer; the fingerprint is the least that does the job.
• To send your photo to the AI provider. You are asked to agree before the first time, and you can stop at any point by not creating.

Who else sees your data

• Specialist AI image and video processing providers, which produce the result from the photo you upload. Which providers we use can change as models and prices do. Each receives nothing beyond the media and the instructions the result you asked for requires. Write to us if you want to know who is processing for us today.
• What those providers may do with your photo. Their licence from us is limited to one purpose: producing the result you asked for. None of them may use your photos or your results to train their models, and you keep ownership of everything you send and everything you get back. We ask for their copy to be deleted as soon as the result exists, and where a provider lets us set that deadline we set it to hours rather than days. Stated honestly, because it is also true: they may keep anonymous, aggregated technical data about how their service was used, which can be derived from what passed through it but is not your photo and does not identify you.
• Cloudflare, which stores your creations for as long as they exist — until you delete them, or your account.
• Apple and Google, which process purchases made in the app. We never see your payment details.
• Stripe, which processes purchases made on this website. It receives your email address and the details of the purchase, and it — not we — holds your card: we never see your card number. Stripe issues the receipt and keeps the payment record for as long as financial law requires. See Stripe’s privacy policy.
• RevenueCat, which checks with Apple and Google that a purchase really happened before we add credits to your balance. It receives the anonymous identifier for your installation and the details of the purchase, never your email address and never your payment details.
• Google, if you choose to sign in with Google. Google tells us your email address and name and nothing else; we tell Google nothing about what you do here. The same applies to Apple if you sign in with Apple in the app.
• Resend, which delivers the email containing your sign-in code. It receives your email address and that message, and only when you ask to sign in.
• Google Analytics (Google Ireland Ltd), only if you accept cookies on vyyna.com or app.vyyna.com. It measures which pages are visited, how visitors arrive (for example from a search or an advert), the type of device and browser, and the approximate area, using its own cookies (named _ga), kept for up to 14 months. Its advertising features are switched off: it is used to count and improve, never to target you with ads. Google may process this data in the United States, under the EU–US Data Privacy Framework. See Google’s privacy policy.
• Nobody else. We do not sell your data, and we do not share it for advertising. There is no advertising identifier in this app and no third party tracks you across other companies’ apps or websites.

Where your data is

Your creations are stored in the European Union, and the email carrying your sign-in code is sent from within it. Producing a result, and checking a purchase, may involve sending data outside the EU; where it does, the transfer is covered by the European Commission’s standard contractual clauses and by the processing agreement we hold with the provider concerned.

How long we keep things

• Creations: until you delete them, or delete your account; then deleted permanently, at once.
• Uploaded photos: only while the result is being produced - except photos given to the Studio’s agent, kept until you delete your account.
• The agent’s chats: until you delete them, or your account.
• Your account: for as long as you have one. If you delete it, 30 days — then destroyed.
• Purchase and credit records: kept as long as tax law requires, detached from you once your account is destroyed.
• A used discount code or welcome gift and the fingerprint of the address that used it: kept after the account is destroyed, so the same address cannot use it again. It cannot be read back into your address.

Age

Vyyna is for businesses and adults. You need to be at least 18. We do not knowingly collect data from anyone younger; if you believe we have, write to us and we will delete it.

Your rights

You can delete your account from inside the app, or from our help center. Your creations and the photos you uploaded are deleted immediately and permanently — signing in again does not bring them back. The account itself — your email, your name, your credits and your brand kits — is held for 30 days, so signing in within that window restores it; after 30 days it is destroyed for good, the address is free to be used again, and nobody can restore it, including us. You can also delete your pictures without closing your account.

You also have the right to ask us for a copy of your data, to have it corrected, to have it sent to another service, to object to how we use it, and to restrict that use. Write to hello@vyyna.com and we will answer within 30 days. If you think we have got this wrong, you can complain to your national data protection authority — in Italy, the Garante per la protezione dei dati personali.

Your country, and your address

We work out which country a request comes from, so we know which markets the app is used in and which language to translate next. It is worked out on our own machine, from a table that travels with our software rather than by asking a geolocation company, so no third party ever sees your address. Two letters are stored. Your IP address is not.

This website

The website sets one cookie of its own, a random identifier for your browser. It is what makes your wallet, your sign-in and your creations yours across pages, and it is not shared with anyone; there is no advertising cookie. With your consent — the notice you see the first time, whose answer is kept for a year in two small cookies — we also record what you do here and on app.vyyna.com: which pages you open, when your visit starts and ends, and what you download or copy. It records what happened and never what was in it. With the same consent, Google Analytics measures the visit too, as described above. Choose “only necessary” and none of that is recorded, and Google Analytics is never loaded; what you buy, make, keep and delete is still written down, because it is what the service is. You can change your answer by clearing the site’s cookies, and it is all covered by your rights above.

Separately, we count how many people open each page. That count uses no cookie and needs no consent, because it identifies nobody: a visit is recorded as an irreversible hash of your IP address and browser, keyed by a secret and mixed with today’s date — so it stays the same if you reload a page today, and cannot be matched to you tomorrow. Your IP address is never stored. We work out which country you are in from a table that ships with this website rather than by asking a geolocation company, so nobody outside Vyyna sees your address at all. If you arrived from an advert, the campaign tag in the link is stored alongside it, so we know which advert worked.

Contact

Questions: hello@vyyna.com