GDPR

Categories. Service records we may process include installation and authentication identifiers, entitlement and subscription-verification records, usage counters, operational metadata, the dates an installation connected (iPhone, Android, or the website, kept 30 days), agreement-acceptance records, push tokens we hold, your vanzen.ai account (email, password hash, plan, and Stripe customer and subscription ids), file-attachment job payloads for a short time, waitlist name, email, industry, time, and consent, and beta applications (email, survey answers, campaign tag, application time, and consent and Beta Terms acceptance). We do not keep your chats. vMask Chat masks recognized personal details on your device before send. Direct Chat and search are processed as described in the Privacy Policy. If you turn on chat sync, we also hold encrypted sync copies for at most 30 days and your linked devices' general names, public keys and link and sync times.

Lawful bases. Contract (GDPR Art. 6(1)(b)): entitlements, chat dispatch, file attachments, vanzen.ai accounts and web billing. Legal obligation (Art. 6(1)(c)): web payment records that tax law requires us to keep. Consent (Art. 6(1)(a)): waitlist; beta applications; Direct Chat and search sends you start. Legitimate interest (Art. 6(1)(f)): abuse prevention, security, and allowance enforcement.

We do not need special-category data to operate VanZen. Please do not send it. When you ask VanZen to edit a picture of a person, the result is compared with the original so the person stays recognizable. This is not used to identify anyone, and nothing from it is kept.

Your rights include access, rectification, erasure, restriction, objection, and data portability, and the right to withdraw waitlist or beta consent. Email info@vanzen.ai. We will respond within one month, or as the law allows.

Processors are named in the Privacy Policy, including Cloudflare, Apple, Google, Stripe, Linkup, SerpAPI, and Expo. We do not let those providers use your details for their own advertising. A weather question sends a place name to Nominatim (OpenStreetMap) and its coordinates to the U.S. National Weather Service or MET Norway, as the Privacy Policy describes. Cloudflare also runs the bot check on web sign-in and the beta form (Turnstile) and delivers the emails we send.

Where processing takes place. VanZen runs on servers we operate in Luxembourg, in the European Union. Some processors are in the United States; information they handle for us is transferred there under an adequacy decision, including the EU–U.S. Data Privacy Framework where the provider is certified, or under the European Commission's standard contractual clauses. You may ask us for more information about these safeguards.

We do not make automated decisions with legal or similarly significant effects.

You may lodge a complaint with a supervisory authority, including the one where you live or work. In Luxembourg this is the Commission nationale pour la protection des données (CNPD), cnpd.public.lu. You may also write to us first at info@vanzen.ai.