Privacy Policy

Veyrnox Ltd (“we”) is the data controller for personal data processed through Veyrnox.ai. Registered office: Suite RA01, 195-197 Wood Street, London, England, E17 3NU. Contact: privacy@veyrnox.com.

What we collect

• Account data — email address, authentication identifiers, and if you sign in with Apple or Google, the identifier they share.
• Usage data — the prompts, chat messages and reference files or images you submit, the generations and chat replies you request, credit balance and ledger history, and job status.
• Publish data — connected social account details, media you upload, captions, schedules and posting analytics needed to publish to the accounts you select.
• Technical data — IP address, browser and device information, and request logs needed to keep the service secure.
• Payment data — credit packs are sold through Stripe Managed Payments, under which Stripe, Inc. is the Merchant of Record and seller of record, and charges and remits any VAT or sales tax. Stripe collects your payment details, billing address and any tax information as its own controller, under its own privacy policy. We receive the payment reference, amount, currency, country and email so we can add the credits to your account. We never see or store full card numbers.

Why we process it

• To run the service and fulfil your generations (performance of a contract).
• To keep an accurate credit ledger and prevent abuse (legitimate interests).
• To meet legal obligations, including tax and content-provenance requirements.
• To send service messages. We do not send marketing email without consent.

Where your data lives

We run on Supabase for the database and authentication, and on Cloudflare for edge hosting and object storage. Account data, credit ledger, generation metadata and your chat conversations sit in our Supabase database, which is hosted in the European Union (Frankfurt, Germany). Generated media is stored in the European Union, in Cloudflare R2 with an EU jurisdictional restriction. Your prompts, chat messages and reference files or images are transmitted to the third-party model provider that runs the model you selected, through our model gateway, for the sole purpose of producing your output. For chat we ask the gateway to use only providers that do not store your content or use it to train models. If you switch on Web search, your question is also sent to a web search provider. When Web search runs through our own search, that provider is Exa (exa.ai): it receives your question as the search query, and the text of the pages it finds is sent, through our model gateway, to the model provider along with your question so the answer can cite sources.

Some of the companies that process your personal data are outside the United Kingdom and the EEA: our edge hosting, the model providers, and Stripe, Inc. (United States), which is the Merchant of Record for credit pack purchases. Where your personal data is processed outside the United Kingdom or the EEA, we rely on the UK International Data Transfer Agreement or the EU Standard Contractual Clauses with the company concerned. If we move the database to another region we will update this page before the move takes effect.

YouTube data in Veyrnox Publish

Social Cinema uses YouTube’s privacy-enhanced embedded player for selected free-to-watch series. Before you press play, YouTube receives the technical information needed to display the thumbnail, title, playability and content restrictions. When you play a video, YouTube receives playback and device data and may set or read cookies according to the Google Privacy Policy. We do not download or store a copy of the embedded video.

When you connect a YouTube channel to Veyrnox Publish, we ask Google for permission to identify your channel, read its supported channel and video statistics, and upload the videos you select. This consent is separate from Google sign-in. We use the read access to show your connected channel and basic posting analytics. We use upload access only to carry out your Post now or Schedule post instructions.

We store the connected channel details, granted permissions, posting history and analytics in our Supabase database. Access and refresh tokens are encrypted before storage and used by our server to make the authorized YouTube API calls, including scheduled uploads. Selecting a Library video does not by itself upload it to YouTube. When you post or schedule it, we send the selected video and its title and description to YouTube.

Disconnecting a channel removes its stored access and refresh tokens and stops further publishing and analytics collection for that connection. It does not delete videos already uploaded to YouTube. Account details, posting history and previously collected analytics remain part of your Veyrnox account; you can request their deletion using the contact and data-rights process below. You can also revoke Veyrnox Publish’s access through your Google Account.

We do not use data obtained through the YouTube API to train AI models or for advertising targeting. Veyrnox Publish’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

How we protect your data

We use the following safeguards to protect personal data, including sensitive Google user data obtained through the YouTube API, against unauthorized access and disclosure:

• Encryption in transit — we use HTTPS/TLS to encrypt data sent between your browser and Veyrnox.ai, and between our servers and Google’s APIs and our database.
• Protection of stored OAuth tokens — YouTube access and refresh tokens are encrypted with AES-256-GCM before they are stored in our database. The encryption key is held separately in a server-side secret. Tokens are used by our servers for the features you authorize and are not returned to the browser in connected-account responses.
• Access controls — our APIs verify your signed-in identity and check that the connected accounts and associated data belong to you. Connected-account and analytics tables use database row-level security, with access through controlled server-side operations rather than direct browser access.

Planned model processor: BytePlus

BytePlus Pte. Ltd. (Singapore) is a planned processor for selected Seedance video models. These models are not currently available on Veyrnox.ai. When enabled, choosing one of these models will send your prompt and any reference images to BytePlus ModelArk in Singapore to generate your video. This processing takes place outside the United Kingdom and the EEA; storing the finished video in our EU storage does not keep the generation processing within those regions.

We will enable these models only after the applicable data-processing and international-transfer arrangements are in place. We will update this notice when the models become available.

Retention

• Generated media is kept for 90 days, then deleted automatically.
• Completed Publish uploads stay in your Publish uploads until removed. A file used by a draft, scheduled or in-progress post cannot be removed until that post finishes or is canceled; its metadata remains in the posting history. Abandoned uploads are deleted after 24 hours. Removing an unused file queues its storage deletion after its upload link expires, normally within 20 minutes.
• Chat conversations are kept until you delete them. Deleting a chat removes it and its messages from our database straight away.
• Our database is backed up daily and each backup is kept for around seven days, so a chat you delete can remain in a backup for up to that long before it expires.
• Images you upload to a chat are kept in our storage only long enough to answer, and are deleted within 24 hours. An image you pick from your Library for a chat stays in your Library, and is sent to the model provider to answer. If you choose a video, your browser takes a few still frames from it and those are attached as images; the video itself is not uploaded.
• Ledger records are kept for as long as your account exists plus the period required by tax law. A chat reply’s entry in your credit history records which model, which options and the Credits charged; it never contains the text of your messages.
• Request logs are kept for a short security window and then discarded.

Sharing

We share data only with the companies needed to run the service: authentication and database hosting, edge hosting and storage, AI model providers and the model gateway that routes requests to them, web search providers when you switch on Web search (Exa, when it runs through our own search), Resend for the emails we send about your account, and Stripe, Inc. for credit pack purchases. Stripe, Inc. acts as its own controller for the purchase it makes as Merchant of Record. When you schedule a Publish post, we send its media and caption to the social networks you select. Uploading a file alone does not send it to a social network. We do not sell personal data.

Your rights

You can access, correct, export or delete your data, and object to or restrict certain processing. See GDPR & Data Rights for how. You may also complain to the UK Information Commissioner’s Office or your local supervisory authority.

Cookies

We use only the cookies and local storage strictly necessary to keep you signed in and the service working. No third-party advertising trackers. If you open a friend’s referral link, we keep that link’s code in your browser’s local storage for up to three days so it can be linked to your account when you sign up, then remove it.

Referrals

If you join through someone’s referral link, we record which account referred yours. That person can see how many friends joined through their link and is never told who you are. If you buy a Credit Pack, they may earn Credits as described in the Terms; the reward is reversed if that purchase is refunded or disputed.

Children

The service is not intended for anyone under 18.

Changes

We will post material changes here and note the date at the top of this page.