Privacy Policy

This Privacy Policy explains how Vanday Labs LLC ("Vanday," "we," "us"), a Texas limited liability company, collects, uses, and shares personal data when you visit vanday.ai (the "Site") or use the Vanday digital asset management service (the "Service").

Controller vs. processor. When we process personal data about website visitors, prospects, and the individuals who administer customer accounts, we act as a controller and this Policy applies. When we process personal data contained in a customer's uploaded content or account on the customer's behalf, the customer is the controller and we act as a processor; that processing is governed by our customer agreements and the customer's own privacy notices.

1Personal data we collect

• Account & profile data: name, business email, role, organization, workspace settings. Authentication is handled by our identity provider (Clerk); your password (if you use one) is stored by Clerk, not by Vanday.
• Usage & device data: log data, IP address, browser/device type, pages viewed, feature usage, timestamps.
• Content metadata: file names, types, sizes, dimensions, and AI-generated tags and captions associated with assets you upload. (The asset files themselves are Customer Content processed on your behalf.)
• Communications: messages you send to support, sales, or via forms.
• Cookies & similar technologies: we use a small number of cookies to keep you signed in (session cookies set by Clerk) and to remember your workspace preferences. We use Google Analytics for site analytics, which sets cookies to measure visits and traffic sources. We do not use advertising cookies.

2How we use personal data and legal bases (GDPR/UK GDPR)

• Provide, maintain, and secure the Service and accounts — Performance of a contract.
• Customer support and communications — Performance of a contract / legitimate interests.
• Product improvement and analytics (aggregated where possible) — Legitimate interests.
• Marketing communications (with opt-out / consent where required) — Consent / legitimate interests.
• Security, fraud prevention, and enforcing our terms — Legitimate interests / legal obligation.
• Complying with law and responding to legal requests — Legal obligation.

We rely on legitimate interests only where not overridden by your rights. Where we rely on consent, you may withdraw it at any time.

3AI processing

The Service uses third-party AI models (currently OpenAI) to generate descriptive tags, captions, and metadata from uploaded assets. We send only the data needed for tagging and rely on OpenAI's standard API terms, which do not permit OpenAI to use submitted content to train its foundation models.

4How we share personal data

We share personal data with the following categories of recipients:

Always-on subprocessors

The Service relies on the following vendors to host, operate, and support the Service. They process personal data only to provide their services to us and are bound by contract to protect it.

• Clerk — Authentication and user identity.
• Fly.io — Application hosting and infrastructure.
• Cloudflare — DNS routing for vanday.ai.
• Netlify — Hosting of our marketing site and blog.
• OpenAI — AI tagging and captioning for uploaded assets.
• Resend — Transactional and product email delivery.
• Google Analytics — Website traffic analytics (Google LLC).

Optional integrations you initiate

You may choose to connect third-party services through Vanday — for example, social platforms (Instagram, Facebook, X, LinkedIn, Pinterest) for publishing, design tools (such as Canva) for asset reuse, or cloud storage providers for asset imports. When you connect one of these services, we share with it only the data needed to perform the action you initiated. Current integrations are listed at vanday.ai/integrations.

Newsletter

If you opt in to our newsletter, your email is processed by Kit (ConvertKit) for delivery and list management.

Other recipients

• Professional advisers, auditors, and authorities where required by law or to protect rights and safety.
• In a business transfer (merger, acquisition, or asset sale), subject to this Policy.

We do not sell personal data, and we do not "share" it for cross-context behavioral advertising as those terms are defined under U.S. state privacy laws.

5International data transfers

We are based in the United States. Where we transfer personal data from the EEA, UK, or Switzerland to a country without an adequacy decision, we use appropriate safeguards, including the EU Standard Contractual Clauses and the UK International Data Transfer Addendum. Contact us at privacy@vanday.ai for a copy of the relevant safeguards.

6Retention and deletion

We retain personal data for as long as needed to provide the Service and for legitimate business or legal purposes.

• When you delete an individual asset from Vanday, the file and its metadata are removed from our active systems promptly; residual copies in routine backups expire on our standard backup cycle.
• When your account is closed (by you or by us), associated personal data and Customer Content are deleted or anonymized within 90 days, subject to legal retention requirements.
• We may retain limited records (e.g., billing history, security logs, legal correspondence) for longer where required.

7Security

We maintain administrative, technical, and organizational safeguards designed to protect personal data, including:

• Encryption in transit (TLS for all traffic to and from the Service).
• Encryption at rest for our application data volumes.
• Access controls limiting employee access to personal data on a need-to-know basis.
• Hashing of sensitive credentials (e.g., API tokens we issue) and encryption of stored third-party integration tokens.
• Operational monitoring and logging.

No system is perfectly secure, and we cannot guarantee absolute security.

8Your rights

EEA/UK/Switzerland: you may have the right to access, rectify, erase, restrict, or object to processing; to data portability; and to withdraw consent. You may also lodge a complaint with your supervisory authority.

California (CCPA/CPRA) and other U.S. states: you may have the right to know/access, delete, and correct your personal data; to opt out of sale or sharing (note: we do not sell or share); to limit use of sensitive personal information; and to non-discrimination for exercising your rights.

To exercise rights, email privacy@vanday.ai. We will verify your request and respond within the time required by law. If your data is held on behalf of a customer (we are processor), we will refer you to that customer.

9Children

The Service is for business use and is not directed to children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided personal data to us, contact privacy@vanday.ai and we will delete it.

10Changes to this policy

We may update this Policy; we will post the new version and update the "Last updated" date, and provide additional notice for material changes.

11Google user data (Google Drive integration)

If you choose to connect Google Drive, Vanday requests only the drive.file scope. This means Vanday can access only the specific files you explicitly select to import — never your entire Drive, and never files you don't choose. We use this access solely to bring the files you pick into your Vanday workspace so you can organize, tag, search, and publish them.

Like other images in your workspace, files you import from Google Drive are processed by our third-party AI provider (currently OpenAI) to generate descriptive tags and captions, as described in AI processing above. We send only the data needed for tagging, and this content is not used to train AI models.

Limited Use. Vanday's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide and improve the Google Drive import feature you asked for.
• We do not sell Google user data, and we do not use it for advertising.
• We do not transfer Google user data to others except as needed to provide the service, to comply with applicable law, or as part of a merger, acquisition, or sale of assets (with notice to you).
• We do not allow humans to read your Google user data unless (a) you give specific consent, (b) it is necessary for security purposes (such as investigating abuse), (c) it is required to comply with applicable law, or (d) the data has been aggregated and anonymized.

You can disconnect Google Drive at any time in Settings → Integrations, which revokes Vanday's access, and you can also revoke access from your Google Account permissions page.

12Contact