Privacy Policy

1. What we collect

• Account data: email, display name, organisation name, role, authentication tokens (Supabase Auth).
• Project data: briefs, prompts, references, generated assets, comments, share links.
• Billing data: handled by our payment processor (Stripe). We never store full card numbers.
• Usage data: page views, generation counts, credit usage, error logs (via Vercel and Supabase).
• Communication data: emails you send us and our replies.

2. Why we process it

• To operate the Service and deliver the features you request.
• To bill you and prevent fraud.
• To diagnose bugs, monitor performance, and improve reliability.
• To send transactional emails (sign-in, billing receipts, invite notifications). Marketing email is opt-in only.

3. Where it lives

Application data sits in Supabase (Postgres, EU region). Generated assets live in Cloudflare R2 / Supabase Storage. Email is sent via Resend. Payments are processed by Stripe. We use Vercel for hosting and edge functions.

4. Model providers

Prompts and inputs you submit are sent to third-party model providers (OpenAI, Anthropic, Google, ElevenLabs, fal.ai) only to fulfil the specific request. We have negotiated zero-retention or strict data- processing terms with these providers where available; outputs are returned to your account.

5. Your rights (GDPR / CCPA / UK GDPR)

• Access: request a copy of the data we hold about you.
• Correction: update or correct your information.
• Deletion: close your account; we delete personal data within 30 days, subject to legal retention requirements.
• Portability: export your projects in JSON/PDF/Markdown.
• Objection: opt out of any non-essential processing.

Email privacy@yondervast.ai to exercise any of these rights.

6. Retention

Active accounts retain data indefinitely. Closed accounts are purged after 30 days, except billing records (kept 7 years for tax) and legal-hold data.

7. Cookies & tracking

We use first-party cookies for authentication and a minimal Vercel analytics ping. We do not run third-party advertising trackers.

8. Children

The Service is not intended for users under 16. We do not knowingly collect data from children.

9. Changes

We’ll notify you of material changes via in-app banner or email, at least 30 days before they take effect.

10. Contact

Data Protection · privacy@yondervast.ai · Yondervast LTD, United Kingdom.