Privacy Policy

Last updated 8 October 2026

Who we are

Ongaro Samuele, Via Venezia 22, 37069 Villafranca di Verona (VR), Italy, is the controller of the personal data described here. You can reach us at support@vyyna.com about anything on this page.

The short version

The images and videos you create are kept in private storage for 30 days — with a plan, for as long as the plan runs and 30 days after it ends — and are then deleted for good. Only you can reach them, from any device you sign into. They are not stored inside the app, so downloading one - or saving it to your photo library - is how you keep it. To create a result, your photo is sent securely to the AI processing provider that produces it, and only for that purpose. Nothing you upload or make is published, shown to anybody else, or used to train a model — the providers who do the processing are barred from training on it by the contracts we hold with them. We keep the information needed to run your account, your credits and our service — and nothing more. If you use the Studio, we also read the shop address you give us and keep the brand and product details we find there, which is described below.

What we store

• An anonymous identifier for your installation, so credits and purchases work.
• Your credit balance and an immutable record of every credit movement.
• Purchase records received from the app stores and from Stripe, and the plan you are on.
• Metadata about each creation: which trend, when, whether it succeeded, and how long it took.
• Each creation for 30 days — with a plan, for as long as it runs and 30 days after it ends — in private storage separate from our servers. The date is shown on each creation. It is reachable only through a short-lived link issued to you, and it is deleted automatically when that date comes — or immediately, the moment you delete it.
• If you create an account: your email address and display name.
• If you use the Studio: the shop address you gave us, the brand details read from it — name, colours, typefaces, logo, the words on the site — and, for each product you add, its name, its description, its price and its photographs. You can correct any of it, and deleting a brand or a product deletes what was read for it. Billing details you enter for an invoice, including a VAT number, are held by our payment provider.
• For each thing that happens — a trend opened, a creation started, credits spent — the time, which trend, the outcome, your platform and app version, and the country the request came from. This is how we know which trends work and where the app is used. It records what happened and never what was in it: no photographs, no descriptions, no message you typed.
• If you turn on notifications: the token your phone gives us to send them, stored encrypted.
• When something breaks, a record of the error - what went wrong and where in our software - so we can fix it. It is scrubbed before it is written: no email address, no photograph, no link, no message you typed.

What we do not store

• The photos you upload, beyond the moment they are being processed.
• Any creation past its date — 30 days, or with a plan 30 days after the plan ends.
• Anything at all on our own servers: creation files live in separate private storage.

A photo you choose is cropped on your phone before it is sent, so the part you framed out never leaves the device. A video is different only because a phone cannot cut one: the whole clip goes to private storage, the seconds you kept are cut from it, and the original is deleted the instant that cut exists. Only those seconds — with their sound — reach the provider, and nothing outside them is ever kept.

When its date comes — 30 days, or with a plan 30 days after the plan ends — a creation is deleted permanently, including for us, and it cannot be recovered. Downloading it, or saving it to your photo library, is how you keep something for good; from that point it is yours and this policy no longer governs it.

AI processing

Creating a result requires sending your photo to a third-party AI processing provider. This happens only when you tap create, only for the creation you asked for, and you are asked to agree before the first time. Processing copies are deleted according to our processing policy and the provider’s retention terms.

Those providers apply their own content checks and will refuse a request they consider unsafe. When that happens the creation fails and you are told; we do not see or keep what was refused. What you may upload is set out in the terms, and you can report anything you believe breaks them at support@vyyna.com.

Reading your shop

When you give the Studio the address of a shop, we fetch its publicly available pages on your instruction and read what they contain: the brand’s colours, typefaces, logo and wording, and a product’s name, description, price and photographs. We read only what the site serves to an ordinary visitor, we honour a site that refuses automated readers, and we keep what we extracted rather than the pages. A read that finds nothing usable is not charged.

This is done to perform our contract with you — it is the thing you asked for. The terms require you to be entitled to ask: the shop must be yours or one you are authorised to act for, and the brand and the photographs must be yours to use. A brand kit and its products are visible only to the account that created them. Delete a brand, a product or your account and what was read for it goes with it.

Why we are allowed to process this

• To give you what you asked for — creating a result, holding your credits, running your account. This is the performance of our contract with you.
• To keep purchase and credit records. We are required to keep these by tax and accounting law, which is why they outlive the rest of your data.
• To send your photo to the AI provider. You are asked to agree before the first time, and you can stop at any point by not creating.

Who else sees your data

• Specialist AI image and video processing providers, which produce the result from the photo you upload. Which providers we use can change as models and prices do. Each receives nothing beyond the media and the instructions the result you asked for requires. Write to us if you want to know who is processing for us today.
• What those providers may do with your photo. Their licence from us is limited to one purpose: producing the result you asked for. None of them may use your photos or your results to train their models, and you keep ownership of everything you send and everything you get back. We ask for their copy to be deleted as soon as the result exists, and where a provider lets us set that deadline we set it to hours rather than days. Stated honestly, because it is also true: they may keep anonymous, aggregated technical data about how their service was used, which can be derived from what passed through it but is not your photo and does not identify you.
• Cloudflare, which stores your creations for as long as they exist — thirty days, or, with a plan, for as long as the plan runs and thirty days after it ends.
• Apple and Google, which process purchases made in the app. We never see your payment details.
• Stripe, which processes purchases made on this website. It receives your email address and the details of the purchase, and it — not we — holds your card: we never see your card number. Stripe issues the receipt and keeps the payment record for as long as financial law requires. See Stripe’s privacy policy.
• RevenueCat, which checks with Apple and Google that a purchase really happened before we add credits to your balance. It receives the anonymous identifier for your installation and the details of the purchase, never your email address and never your payment details.
• Google, if you choose to sign in with Google. Google tells us your email address and name and nothing else; we tell Google nothing about what you do here. The same applies to Apple if you sign in with Apple in the app.
• Resend, which delivers the email containing your sign-in code. It receives your email address and that message, and only when you ask to sign in.
• Nobody else. We do not sell your data, and we do not share it for advertising. There is no advertising identifier in this app and no third party tracks you across other companies’ apps or websites.

Where your data is

Your creations are stored in the European Union, and the email carrying your sign-in code is sent from within it. Producing a result, and checking a purchase, may involve sending data outside the EU; where it does, the transfer is covered by the European Commission’s standard contractual clauses and by the processing agreement we hold with the provider concerned.

How long we keep things

• Creations: 30 days; with a plan, as long as it runs and 30 days after it ends; then deleted permanently.
• Uploaded photos: only while the result is being produced.
• Your account: for as long as you have one. If you delete it, 30 days — then destroyed.
• Purchase and credit records: kept as long as tax law requires, detached from you once your account is destroyed.

Age

Vyyna is not for children. You need to be at least 13, and old enough to agree to our terms where you live. We do not knowingly collect data from anyone younger; if you believe we have, write to us and we will delete it.

Your rights

You can delete your account from inside the app, or from this page. Your creations are deleted immediately and permanently — signing in again does not bring them back. The account itself — your email, your name, your credits and your saved trends — is held for 30 days, so signing in within that window restores it; after 30 days it is destroyed for good, the address is free to be used again, and nobody can restore it, including us. You can also delete every creation without closing your account, from the app’s settings.

You also have the right to ask us for a copy of your data, to have it corrected, to have it sent to another service, to object to how we use it, and to restrict that use. Write to support@vyyna.com and we will answer within 30 days. If you think we have got this wrong, you can complain to your national data protection authority — in Italy, the Garante per la protezione dei dati personali.

Your country, and your address

We work out which country a request comes from, so we know which markets the app is used in and which language to translate next. It is worked out on our own machine, from a table that travels with our software rather than by asking a geolocation company, so no third party ever sees your address. Two letters are stored. Your IP address is not.

This website

The website sets one cookie of its own, a random identifier for your browser. It is what makes your wallet, your sign-in and your creations yours across pages, and it is not shared with anyone: there is no advertising cookie, no tracking script and no analytics company. With your consent — the notice you see the first time, whose answer is kept for a year in a second small cookie — we also record what you do here the way the app does: which pages you open, when your visit starts and ends, and what you download or copy. It records what happened and never what was in it. Choose “only necessary” and none of that is recorded; what you buy, make, keep and delete is still written down, because it is what the service is. You can change your answer by clearing the site’s cookies, and it is all covered by your rights above.

Separately, we count how many people open each page. That count uses no cookie and needs no consent, because it identifies nobody: a visit is recorded as an irreversible hash of your IP address and browser, keyed by a secret and mixed with today’s date — so it stays the same if you reload a page today, and cannot be matched to you tomorrow. Your IP address is never stored. We work out which country you are in from a table that ships with this website rather than by asking a geolocation company, so nobody outside Vyyna sees your address at all. If you arrived from an advert, the campaign tag in the link is stored alongside it, so we know which advert worked.

Contact

Questions: support@vyyna.com