Privacy Policy

Last updated: October 1, 2026

This policy explains what personal data Veyriz AI ("Veyriz", "we") processes when you use veyriz.com, why, who we share it with, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR).

1. Who is responsible for your data

The data controller is Veyriz AI, Sweden. Contact us about anything in this policy at contact@veyriz.com.

2. What we collect

• Account data: your email address and, if you sign up with email, your password (stored only as a secure hash). If you sign in with Google, we receive your email address, name and profile picture from Google.
• Your chats: the messages you send, the AI's replies, chat titles, and reduced-size copies of images you attach.
• Usage data: how many tokens you have used, your plan and when your limits reset.
• Payment data: if you subscribe to Veyriz Pro, your payment is handled by Stripe. We never see or store your full card details. We receive information such as your subscription status, payment history and the country of your card.
• Technical data: IP address, browser information and server logs needed to run and protect the service, and the result of an automated bot check (Cloudflare Turnstile) when you sign up, log in or reset your password.

We store a few strictly necessary items in your browser's local storage – your login session and simple settings such as the chat and AI model you last used. We do not use advertising or tracking cookies, and fonts and scripts are served from our own server.

3. Why we use it and our legal basis

• To provide Veyriz – create and run your account, answer your messages, save your chats and apply your plan's limits. Legal basis: performance of a contract (GDPR art. 6(1)(b)).
• To handle payments and accounting – process subscriptions, refunds and keep accounting records. Legal basis: performance of a contract and legal obligation (art. 6(1)(b) and (c)).
• To keep Veyriz secure – prevent fake accounts, abuse, fraud and attacks, and troubleshoot errors. Legal basis: our legitimate interest in a secure and working service (art. 6(1)(f)).
• To send service emails – account confirmation and password reset. Legal basis: performance of a contract. We do not send marketing emails.

You need to give us your email address to create an account; without it we can't provide the service. We do not sell your personal data, we do not use your chats to train AI models, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

4. Who we share data with

We use carefully selected service providers that process data on our behalf, under data processing agreements:

• AI model provider – your messages and attached images are sent to our AI model provider to generate replies. The provider does not use this data to train its models, but may keep it for a limited time to detect misuse, as permitted by its terms.
• Supabase – database and login (accounts, chats and usage data).
• Railway – hosting of the website and server.
• Resend – sending account emails (EU region).
• Cloudflare – automated bot protection (Turnstile).

Some data is also shared with parties that act as independent controllers under their own privacy policies:

• Stripe – payments. Stripe processes payment data to carry out payments and, as an independent controller, to prevent fraud and meet its legal obligations.
• Google – only if you choose to sign in with Google.

Some of these providers are based in, or access data from, countries outside the EU/EEA – mainly the United States. Such transfers are protected by the EU–US Data Privacy Framework or the EU Standard Contractual Clauses. You can contact us to get more information about these safeguards.

5. How long we keep your data

• Account, chats and usage data are kept while you have an account. You can delete individual chats at any time.
• When you delete your account, your account, chats and usage history are deleted immediately from our live systems. Copies in our providers' backups are overwritten within 30 days.
• Payment and accounting records are kept for 7 years, as required by Swedish bookkeeping law (bokföringslagen). Stripe also keeps payment records according to its own legal obligations.
• Server logs are kept for up to 30 days.

6. Your rights

You have the right to:

• get access to the personal data we hold about you, and a copy of it;
• have incorrect data corrected;
• have your data deleted;
• receive your data in a structured, machine-readable format (data portability);
• object to processing based on our legitimate interests, and ask us to restrict processing.

You can delete your account yourself: open the chat, click your email at the bottom of the sidebar and choose Delete my account. For other requests, email contact@veyriz.com. We reply within one month.

If you think we handle your data incorrectly, you can lodge a complaint with the Swedish Authority for Privacy Protection (IMY) or the data protection authority where you live.

7. Security

We use encrypted connections (HTTPS), hashed passwords, access rules that make sure each account can only reach its own data, and bot protection. No system is completely secure, but we work to protect your data and will inform you and the authorities as required by law if a breach affects you.

8. Age limit

Veyriz AI is only for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

9. Changes

We may update this policy. If we make significant changes, we will tell you on the website or by email before they take effect. The date at the top shows when the policy was last updated.