Privacy Policy

This Privacy Policy explains how Evenrud Ventures ENK, org. no. 937 984 170, Røahagan 37A, 0754 Oslo, Norway ("vyrd", "we", "us", "our") collects, uses, stores, and shares your personal data when you use https://vyrd.ai(the "Service").

We are the data controller under the EU General Data Protection Regulation (GDPR), the Norwegian Personal Data Act (personopplysningsloven), and applicable US state privacy laws including the California Consumer Privacy Act (CCPA) as amended by the CPRA.

Questions or requests: contact@vyrd.ai

We collect only data that is necessary to provide and improve the Service. We do not sell your personal data.

We do notuse your conversation data or profile data to train general AI models. Your data is sent to Anthropic only to generate a response for your specific request and is subject to Anthropic's data processing agreement.

The Service uses large language models (LLMs) provided by Anthropic PBC("Claude") to generate coaching responses and idea analysis, to propose experiment designs, to generate content (ideas, drafts, summaries), and to classify things you write (notes, action outcomes, published-post results, and experiment conclusions) into proposed updates to your company memory. When you take one of these actions, we transmit the relevant content — which may include your idea text, profile summary, conversation history, and the note or result, experiment reflection, or marketing-asset reflection you submitted — to Anthropic's API. Proposed memory updates are shown to you and only saved when you confirm them; nothing is written to your company memory automatically.

Separately, to save you re-typing, the assistant may keep the factual fields of your business profile (such as your description, stage, or current challenge) up to date from what you tell it in chat. This is distinct from company memory and can be turned off at any time in Settings. It never affects billing, and it is not used for advertising.

Anthropic processes this data as a data processorunder a Data Processing Agreement (DPA). Anthropic's servers are located in the United States. Data transfers to the US are covered by the EU-US Data Privacy Framework (DPF) and/or Standard Contractual Clauses (SCCs). See Section 6 for transfer details.

AI responses are generated automatically. We do not review individual conversations unless you contact support or there is a security or legal obligation to do so.

We use only strictly necessary cookies required to keep you signed in and protect the Service from abuse. These cookies are exempt from consent under the Norwegian Electronic Communications Act (eKom-loven § 2-7b) because they are necessary for the Service to function.

We use privacy-friendly product analytics (Vercel Analytics) to understand which features are used, but only if you accept optional analyticsin the cookie banner shown on your first visit. If you choose "Essential only", no analytics are loaded at all. You can change your mind by clearing the stored preference (see localStorage below). We do not use advertising cookies or third-party tracking pixels.

Browser localStorage

We also use your browser's localStorage (a client-side storage mechanism distinct from cookies) to preserve your session state between page loads. This data is stored only on your device and is never automatically sent to our servers.

When you sign out, all account-scoped localStorage keys are cleared automatically (only your cookie-consent choice and theme are kept), so the next person to sign in on the same browser does not inherit your interface state. You can also clear all localStorage at any time through your browser's settings. Clearing it does not affect data stored in your account on our servers.

We do not sell your personal data. We share your data only with the following subprocessors, each under a Data Processing Agreement:

We may also disclose your data:

• To comply with a legal obligation, court order, or lawful request from a public authority (Art. 6(1)(c));
• To protect the rights, property, or safety of vyrd, our users, or the public;
• In connection with a merger, acquisition, or sale of assets — you will be notified by email before your data is transferred.

Some subprocessors are located outside the European Economic Area (EEA), including in the United States. Where personal data is transferred outside the EEA, we rely on one or more of the following safeguards:

• EU-US Data Privacy Framework (DPF): Anthropic, Vercel, and Stripe are certified by the US Department of Commerce, providing an adequacy level recognised by the European Commission.
• Standard Contractual Clauses (SCCs):Where DPF certification is not in place, we rely on the European Commission's approved SCCs (Module 2 — controller to processor).

You may request a copy of the applicable safeguards by contacting contact@vyrd.ai.

We keep your workspace data until you delete your account — cancelling a subscription pauses your account but does not delete anything, and we do not purge paused accounts on a timer. After you delete your account, we anonymise or delete your data within 30 days, except where longer retention is required by law (billing records) or technically unavoidable (encrypted backups, purged on a rolling 30-day cycle).

Under the GDPR and Norwegian personopplysningsloven, you have the following rights. Contact contact@vyrd.ai to exercise any of them. We will respond within 30 days (Art. 12(3)).

We will not charge a fee for exercising your rights. If a request is manifestly unfounded or excessive (Art. 12(5)), we may charge a reasonable fee or refuse and explain why.

If you are a California resident, the CCPA as amended by the CPRA gives you additional rights alongside the GDPR rights in Section 8:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we collect, why we use it, and who we share it with.
• Right to Delete: Request deletion of your personal information, subject to certain exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out of Sale or Sharing: We do not sell or share your personal information for cross-context behavioural advertising. No opt-out is required.
• Right to Limit Sensitive PI Use: We do not collect sensitive personal information as defined by the CPRA.
• Right to Non-Discrimination: We will not discriminate against you for exercising CCPA/CPRA rights.

To submit a California privacy request, email contact@vyrd.aiwith the subject line "California Privacy Request". We will verify your identity before processing. You may designate an authorised agent to submit a request on your behalf.

In the preceding 12 months, we have not sold personal information.

We implement appropriate technical and organisational measures to protect your personal data. Measures include:

• Encryption in transit (TLS 1.2+) for all data between your browser and our servers
• Encryption at rest for database storage (Supabase AES-256)
• Row-Level Security (RLS) policies ensuring each user can only access their own data
• API rate limiting to prevent abuse
• Passwords are never stored in plaintext — authentication is managed by Supabase Auth
• Access to production systems is restricted to essential personnel

No internet service is completely secure. In the event of a personal data breach posing a risk to your rights and freedoms, we will notify Datatilsynet within 72 hours (Art. 33) and notify affected users without undue delay (Art. 34) where required.

Paid plans renew automatically until cancelled. You can cancel future renewals from Account Settings or by contacting support@vyrd.ai.

Cancelling does not delete your data. When a subscription ends, your workspace is paused, not erased — your conversations, notes, and analyses are kept so you can export them or resubscribe and continue where you left off. Your data is only removed when you delete your account (or ask us to). We do not run a countdown or purge paused accounts.

Payment card data is processed by Stripe, Inc. and is never stored on our servers. We receive only a Stripe customer ID and payment status.

Refunds: Refunds are handled in accordance with applicable Norwegian consumer law (forbrukerkjøpsloven). For digital services fully performed with your prior explicit consent, the right of withdrawal under Angrerettloven § 22 may not apply. Specific refund terms are shown at checkout. Contact support@vyrd.ai for refund requests.

We use AI to generate coaching advice and business analysis. This constitutes automated processing but does not produce legal or similarly significant effects on you (Art. 22 GDPR). All AI outputs are advisory. No automated decision grants or denies you access to services, credit, or legal rights.

Credit deductions for AI feature usage are determined automatically based on your subscription plan. Contact support@vyrd.ai if you believe a credit charge was made in error.

The Service may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies.

We may update this Privacy Policy from time to time. For material changes, we will notify you by email and/or a prominent notice on the Service at least 14 days before the change takes effect. The "Last updated" date at the top reflects the most recent revision.

Continued use of the Service after the effective date constitutes acceptance. If you do not accept the changes, you must stop using the Service and delete your account.

• Contract performance (Art. 6(1)(b)): Account management, AI coaching, content generation, billing.
• Legitimate interests (Art. 6(1)(f)): Security, fraud prevention, rate limiting, anonymised service improvement. We have assessed that these interests do not override your rights.
• Legal obligation (Art. 6(1)(c)): Retaining financial records for 7 years under Regnskapsloven § 13; responding to lawful authority requests.
• Consent (Art. 6(1)(a)): Marketing emails only. Withdrawable at any time without affecting prior processing.

If you are located in Norway or the EEA and believe we are processing your personal data unlawfully, you have the right to lodge a complaint with your local supervisory authority.

We would appreciate the opportunity to address your concerns first. Please contact contact@vyrd.ai before lodging a formal complaint.

Personal data

Any information relating to an identified or identifiable natural person (GDPR Art. 4(1)).

Data controller

The entity that determines the purposes and means of processing personal data.

Data processor

An entity that processes personal data on behalf of the controller.

GDPR

EU General Data Protection Regulation (Regulation (EU) 2016/679), enforceable in Norway via the EEA Agreement.

Personopplysningsloven

Norwegian Personal Data Act implementing the GDPR in Norwegian law.

CCPA/CPRA

California Consumer Privacy Act (2018) as amended by the California Privacy Rights Act (2020).

DPF

EU-US Data Privacy Framework — an adequacy decision by the European Commission covering US data transfers.

SCCs

Standard Contractual Clauses — EU Commission-approved contract terms for data transfers to third countries.

Datatilsynet

Norwegian Data Protection Authority — supervisory authority for GDPR compliance in Norway.

Regnskapsloven § 13

Norwegian Accounting Act section 13 — requires financial records to be kept for 7 years.