Privacy Policy

This policy explains what personal data Vyrd collects, why, who we share it with, how long we keep it, and the rights you have. It covers https://vyrd.ai and the Vyrd app (the “Service”).

The controller responsible for your personal data is Evenrud Ventures, a Norwegian enkeltpersonforetak (sole proprietorship), org. no. 937 984 170, Røahagan 37A, 0754 Oslo, Norway (“Vyrd”, “we”, “us”). We follow the EU General Data Protection Regulation (GDPR) as it applies in Norway through the Personal Data Act (personopplysningsloven), and the UK GDPR for people in the UK.

Questions or requests: contact@vyrd.ai. We have not appointed a data protection officer; the founder handles privacy questions personally.

Data about other people. When you put other people's personal data into Vyrd (emails you forward, customers from a payment account you connect, names in your notes), you decide why it is processed, and we process it on your behalf as your processor under the data processing terms in section 13 of our Terms.

We collect what we need to provide the Service. We do not sell your personal data, and we don't use it for advertising.

Where we rely on legitimate interests, we have weighed them against your interests and rights. You can object (section 8). Where we rely on consent, you can withdraw it at any time without affecting what happened before.

We don't train AI models on your data, and our AI providers don't use it to train theirs.

Vyrd uses AI models from Anthropic (Claude) to write answers, analyses, research, plans, drafts and proposals. When you use one of these features, we send Anthropic what that feature needs, which can include your message, your business profile, a summary of your business context, and the item you are working on. Anthropic processes it on our behalf, may keep it for a limited time for safety and abuse monitoring under its commercial terms, and does not use it to train its models. Research and Radar also use Anthropic's web search, so your search topics are sent there too. To show each article Radar finds with its picture, our server reads the article page's share picture and loads it for you, so your browser never contacts the publisher and the publisher receives nothing about you.

You're talking to AI. Chat, voice and generated content are produced by AI, not by a person. AI can be wrong; see section 14 of the Terms. We don't read your conversations unless you ask us to (for example in a support request), or we must for security or legal reasons.

Voice. When voice is available and you start a voice conversation, your speech is streamed to OpenAI, which turns it into text and speaks Vyrd's answers. The questions go to Vyrd, which answers them from your data the same way Chat does. OpenAI processes this on our behalf and does not use it to train its models.

Company memory. When you ask Vyrd to learn from a note, an action outcome, a post result or an experiment, AI proposes an update. Nothing is saved to your company memory until you confirm it.

Profile updates from Chat. If you switch it on in Settings (it's off by default), Vyrd keeps the factual fields of your Business Profile (such as description, stage or current challenge) up to date from what you say in Chat.

Diary. Entries you write with the + button are shared with Vyrd's AI on purpose: the most recent ones are included in the business context that Chat and other AI features read. Saving an entry makes no AI call. You can stop sharing or delete an entry on the Diary tab, and it leaves the context from your next request. Private notes are never included. Answers written earlier, and memory you already confirmed, are not changed when you stop sharing. Weekly reviews keep the excerpts they were based on, so you can see where a review came from.

Marketing. Your marketing profile, planned weeks and posts are stored in your workspace. When you press Plan the week or Fill with Vyrd, or if you chose to let Vyrd plan every week (it then runs on Thursday evenings), we send your marketing profile, the week's slots, recent post titles and relevant business context to Anthropic, and email you when a weekly plan is ready. Images you upload are kept in private storage and shown to you through short-lived links. From the website in your profile, Vyrd reads your brand colours and font, your logo and the addresses of pictures on the page. A picture is copied into your workspace only when you pick it and confirm you have the rights to it. To draw text in your brand font, our server asks Google Fonts for the font by name only; your browser doesn't contact Google. Text you add to a picture is drawn by your browser, and the result is stored next to the original. If you plan a post, a reminder is queued with Upstash QStash for that time holding only internal IDs and the time, and we then email you through Resend with the first line of the caption, unless you switched post reminders off. Vyrd never posts for you. A post link you paste is stored as your own record.

Instagram connection. If you connect a professional Instagram account, Vyrd requests basic and Insights read permissions, verifies the account ID, username and account type with Meta, and stores the account identity, granted permissions and authorization expiry for your company. Access tokens are encrypted in a server-only credential store. This phase does not import posts, measurements or comments, publish content, send messages, or send Instagram data to AI providers. Disconnecting deletes Vyrd's stored credential and stops access; account metadata and any existing workspace history remain until account deletion. You can also remove Vyrd in Instagram's Apps and websites settings to revoke Meta's app grant. Account metadata is included in your export; credentials are never exported.

Comments preview. This pilot doesn't connect to a social account, import comments, send replies, or use AI on your drafts. Drafts you save stay in your workspace.

Connected sources. If you connect Stripe, Google Analytics, PostHog or Vercel, Vyrd reads from that account on your behalf, with read-only access where the service offers it (for Stripe, a restricted key you create with read permission only; for Google, the analytics.readonly scope; for PostHog, a personal API key limited to reading). Vercel tokens can't be limited to read-only, so Vyrd only calls Vercel's read endpoints. We don't send your Vyrd data to these services. When you ask Chat about your numbers, Vyrd reads just the figures that question needs and sends them to Anthropic with your message. Playground projects you build can also read them.

Google data. Vyrd's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use your Google Analytics data only to show you your own numbers in Vyrd: on your dashboard, in answers to questions you ask Chat, and in Playground projects you set up. We don't sell it, use it for advertising, or use it to train AI models, and no one at Vyrd reads it except with your permission, for security, or where the law requires.

Inbox. Vyrd shows you email you forward to it, and the inbox of an Outlook mailbox you connect when that is available, so you can read and answer in one place. AI reads a message only when you press Draft reply on it, and Vyrd learns only from text you choose to save with Teach Vyrd, after you confirm. Vyrd never sends email on its own; with Outlook, a reply goes out only when you press Send, from your own mailbox. Vyrd can't delete, move or change your mail. Inbox messages are deleted from Vyrd after 30 days, and disconnecting a mailbox removes its messages and credential straight away.

Playground. When a project runs (when you press Run now, or on the schedule you set), Vyrd reads the data its blocks name and keeps what each block received and produced for 30 days so you can inspect the run. AI steps send their input and your business context to Anthropic. “Email me” sends the result only to your own address. A project never sends anything to anyone else and never posts.

AI apps you connect (ChatGPT, Claude, Gemini). If you add Vyrd as a connector in an AI app and press Allow, that app can read your business overview, actions, company memory and the diary entries you shared (never private notes) for the one workspace you chose, and can add diary entries and actions or mark actions done when you ask it to. What it reads goes to the company behind that app under your own agreement with them; they are not our sub-processors for this. Disconnecting on the Connectors page stops access immediately.

Automated decisions. No decision with legal or similarly significant effects on you is made by automated means alone (GDPR article 22). AI output is advice you choose whether to use. Credits are counted automatically from the real cost of each AI call. If you think a charge is wrong, contact support@vyrd.ai and a person will look at it.

Under the Norwegian Electronic Communications Act (ekomloven § 3-15) and the equivalent EU and UK rules, we may store information on your device without asking only when it's strictly necessary for a service you asked for. Everything else needs your consent.

Analytics, only with your consent. If you accept optional analytics in the banner on your first visit, we load Vercel Web Analytics and PostHog (EU). Both count page views without setting cookies. PostHog runs in cookieless mode, stores nothing on your device, builds no profile of you, and receives only page views of our public pages (the page path, referring site and campaign tags), never anything from inside your account. If you choose “Essential only”, no analytics load at all. We don't use advertising cookies or tracking pixels.

Browser storage

We also keep a few things in your browser's localStorage. It stays on your device and is not sent to us on its own.

Some drafts (for example experiment or reflection drafts) are kept on your device for up to seven days so an interrupted edit isn't lost. They are cleared when you save or sign out, and they don't sync between devices. When you sign out, account-related keys are cleared; only your analytics choice and theme stay. To change your analytics choice, clear this site's data in your browser and choose again.

We use these providers (sub-processors) to run Vyrd. Each processes data only on our instructions under a data processing agreement.

We may also share personal data:

• when the law, a court order or a lawful request from a public authority requires it;
• when it's necessary to establish, exercise or defend legal claims, or to protect the safety of people;
• with a company that takes over Vyrd (for example if we become a limited company). We'll email you before your data moves, and this policy will keep applying to it.

Your Vyrd data is stored in the United States: our database provider, Supabase, hosts it in North Virginia. Some other providers also process data there. We only transfer personal data outside the European Economic Area when it is protected by one of these safeguards:

• the recipient is certified under the EU-US Data Privacy Framework, which the European Commission has found gives adequate protection (this decision also applies in Norway); or
• the European Commission's Standard Contractual Clauses, with the UK addendum for data from the UK, together with the extra measures a transfer needs.

You can ask us for a copy of the safeguards for any provider at contact@vyrd.ai.

Cancelling a subscription pauses your workspace; it doesn't delete anything, so you can export it or come back. We don't delete paused accounts on a timer. When you delete your account, your data is deleted straight away from the live system and disappears from backups within 30 days. Accounting records are kept as the law requires.

Under the GDPR (and the UK GDPR), you have these rights. Email contact@vyrd.ai to use any of them. We answer within one month. If a request is complex, we may need up to two more months, and we'll tell you within the first month if so. We may ask you to confirm your identity.

Using your rights is free. If a request is clearly unfounded or excessive, we may charge a reasonable fee or refuse, and we'll explain why.

Vyrd is a small Norwegian business and may not be covered by US state privacy laws such as the California Consumer Privacy Act, but we give everyone the same rights described in section 8: to know, correct and delete your personal information. We do not sell or “share” personal information for cross-context behavioural advertising, and we have not done so in the last 12 months. Some data we process, such as your account login and the content of email you forward to your Inbox, counts as sensitive personal information under California law. We use it only to provide the Service you asked for. We won't treat you differently for using your rights. You can use an authorised agent; we'll verify the request.

We protect your data with measures including:

• encryption in transit (TLS) between your browser and our servers;
• encryption at rest for the database and file storage;
• row-level security, so each account can only reach its own data;
• extra encryption (AES-256-GCM) for credentials of connected sources and mailboxes, and for forwarded email, readable only by our servers;
• passwords stored only as secure hashes by our authentication provider;
• rate limits to prevent abuse;
• access to production systems limited to the founder.

No online service is completely secure. If a personal data breach is likely to put your rights at risk, we will report it to Datatilsynet within 72 hours and tell you without undue delay when the law requires it.

We'd like the chance to put things right, so please contact contact@vyrd.ai first. You always have the right to complain to a data protection authority, in particular in the country where you live or work. In Norway:

In the UK, you can complain to the Information Commissioner's Office (ico.org.uk).

We update this policy when Vyrd or the law changes, and the date at the top shows the latest version. If a change matters to how your data is used, we'll tell you by email or in the app at least 14 days before it takes effect. If a change needs your consent, we'll ask for it and won't apply the change to you without it.