01Overview.
This policy explains how VYRA Data Inc. ("VYRA", "we", "us") collects, uses, shares, and protects personal information. It covers our websites, our SaaS products (Vyra Insights, Vyra Life, Vyra Code, and the VYN AI teammate), and our services: website development, SEO, static Meta ads, app development, CRM development and implementation, and AI implementation. When we build a site for a client, it usually lives on a client.vyradata.com address, and this policy governs the parts of it that VYRA operates.
We collect as little as we need, and we are direct about what we do with it. We do not sell your personal information.
VYRA is based in Halifax, Nova Scotia, Canada. Our Privacy Officer is reachable at privacy@vyradata.com. We handle personal information under Canada's federal privacy law, PIPEDA, and, for Quebec residents, under Quebec's Law 25. We also honour comparable rights for residents of the United States, the European Union, and the United Kingdom, as described in the regional sections below.
A quick note on roles. For our own websites and products, VYRA decides why and how your information is used. When we operate a product, an ad account, or a CRM on behalf of a business client, that client usually makes those decisions and we act on their instructions. In that case, this policy tells you how we handle information generally, but the client's own privacy notice governs their use of it.
02Information we collect.
We collect information from a few different sources.
Information you give us.
- Your name, email address, phone number, company, and job title.
- The content of inquiries, support requests, account details, and messages you send us.
- Billing details you provide to buy a product or service. Payment card numbers go straight to our payment processor; we do not store full card numbers.
- Anything you choose to type or upload into VYN, our products, or a form on our sites.
Information we collect automatically.
- Basic device and browser data, such as browser type, operating system, and language.
- Usage data, such as pages visited, links clicked, referring page, and timestamps.
- Approximate location derived from your IP address.
- Cookie and similar identifiers, but only in line with your cookie choices. See the Cookies section.
Information from your use of VYN and the products.
- The prompts and messages you send to VYN and the responses it returns.
- Records of the features you use and the actions you take, so we can run and improve the service.
- Content you connect or upload for a product to work on.
Information from third parties.
- Our payment processor confirms whether a payment succeeded and shares limited details such as the card's last four digits.
- Analytics and advertising providers give us aggregated measurement about how our campaigns and sites perform.
- If you reach us through a client's site or a referral, we may receive the contact details you shared there.
Sensitive information.
We do not ask for sensitive information such as health data, financial account numbers, biometric data, or government ID unless a specific service genuinely needs it. Where the law treats a category of information as sensitive, we handle it with extra care and, where the law requires, we ask for your express consent before we collect or use it. We do not knowingly send sensitive information through advertising tools.
We do not sell your personal information.
03How we use your information.
We use personal information to:
- Provide, operate, secure, and improve our websites, products, and services.
- Respond to your questions, requests, and support tickets.
- Set up and manage accounts and process payments.
- Send service messages, such as receipts, security notices, and important changes.
- Send marketing messages only where you have opted in, and always in a way that complies with Canada's anti-spam law, CASL. You can unsubscribe at any time, and we honour unsubscribe requests within 10 business days, as CASL requires.
- Meet our legal, tax, and regulatory obligations, and enforce our agreements.
We rely on a lawful basis for each use. In plain terms:
- To perform our contract with you, for example to deliver a product you signed up for or a service you hired us to do.
- With your consent, for example for non-essential cookies and opt-in marketing. You can withdraw consent at any time.
- For our legitimate interests, for example to keep our services secure, prevent fraud, and understand how our sites are used, balanced against your privacy.
- To meet legal obligations, for example tax records and responses to lawful requests.
04AI and your data.
When you interact with an AI feature such as VYN, we tell you that you are talking to an AI, not a person.
Here is how public VYN works. Your chat inputs are used to generate a response grounded in approved public website information. VYN can prepare an inquiry draft, but the browser sends it only after you choose Send this to VYRA. A human reads every submitted inquiry before VYRA replies.
Under the business and enterprise terms of the third-party model providers we use, they do not train their models on your content. VYRA does not train its own models on your content without your written opt-in. We may use aggregated, de-identified data, which cannot reasonably be linked back to you, to measure and improve the services.
VYN chat and prompt data is kept for about 90 days, unless we need it longer to run the service, resolve a dispute, or meet a legal duty. We do not make decisions that have a significant effect on you based solely on automated processing without a route to human review. See the Automated decisions section.
Grounded answers are slower to build and impossible to fake.
07Data retention.
We keep personal information only as long as we need it for the purposes in this policy, to meet our legal obligations, to resolve disputes, and to enforce our agreements. When it is no longer needed, we delete it or anonymise it so it can no longer identify you.
How long we keep information depends on why we hold it:
- Account and billing records last as long as your relationship with us plus the period tax and other laws require.
- Inquiries and support messages are kept while we may still need them to help you or to keep a record of what happened.
- Marketing contact details stay until you unsubscribe.
- Where Analytics is enabled, Google Analytics 4 retains event data for 14 months.
- VYN chat and prompt data is kept for about 90 days, unless we need it longer to run the service, resolve a dispute, or meet a legal duty.
08Security.
We protect personal information with safeguards that fit its sensitivity, including:
- Encryption of data in transit and at rest.
- Multi-factor authentication on administrative accounts.
- Role-based, least-privilege access, so people can reach only what their job requires.
- Monitoring and logging to detect and investigate unusual activity.
- Security review of the vendors we rely on.
No system is perfectly secure, but we work to keep the risk low and to respond quickly if something goes wrong. To report a vulnerability or a security concern, email security@vyradata.com.
09If there is a data breach.
If a security breach creates a real risk of significant harm, we report it to the Office of the Privacy Commissioner of Canada and notify affected people as soon as feasible. We keep records of breaches for 24 months.
For Quebec, we report confidentiality incidents to Quebec's regulator, the CAI, and notify affected individuals where the law requires it.
For the EU and the UK, where a breach is reportable, we notify the relevant supervisory authority within the timeframe the applicable law sets, and we notify affected individuals where the risk to them requires it.
10International data transfers.
Some of our providers are located in the United States or in other countries, which means your information may be processed outside your home region.
- For EU and UK personal data, we use Standard Contractual Clauses. Where we rely on the EU-US Data Privacy Framework, we keep Standard Contractual Clauses as a fallback so your data stays protected.
- Before we transfer Quebec personal information outside Quebec, we run the assessment that Law 25 requires.
- Under PIPEDA, we require every provider that processes personal information on our behalf to give it comparable protection by contract.
11Automated decisions.
We do not make decisions that have a significant effect on you based solely on automated processing without a way to get a human to review them.
Where such processing does apply, residents of Quebec and of the EU and the UK can ask us for the main factors and personal information used in the decision, and can request that a person review it. Contact privacy@vyradata.com.
12Your privacy rights.
Depending on where you live, you may have the right to:
- Access the personal information we hold about you.
- Correct information that is wrong or out of date.
- Delete your personal information.
- Receive a copy of your information in a portable format.
- Object to or restrict certain processing.
- Withdraw consent where we relied on it, without affecting anything we did before you withdrew it.
To exercise any of these rights, email privacy@vyradata.com. We may need to verify your identity before we act, so that no one else can use your rights to reach your data. In most cases we reply within 30 days, and where a law sets a different clock we follow it. If we need more time for a complex request, we will tell you why and how long we expect to take. If your information is held by us on behalf of one of our clients, we will point you to that client, who is best placed to answer, and help where we can. You will not be treated differently for exercising a right, and using one is always free unless a request is clearly excessive or repetitive.
13Regional privacy rights.
Some regions add specific rights on top of the ones above. These sections explain the extras.
Canada.
Under PIPEDA you can ask to access and correct your personal information and to understand how we use it. If Quebec's Law 25 applies to you as a resident, you also have the right to data portability, and you can rely on VYRA's designated person in charge of protecting personal information, reachable at privacy@vyradata.com. Before we send Quebec personal information outside Quebec, we run the assessment Law 25 requires, and where an automated decision applies you can ask for the main factors used and a human review.
If you are not satisfied with how we handled your request, you can complain to the Office of the Privacy Commissioner of Canada or, for Quebec, to Quebec's CAI.
United States.
If you are a resident of California or another state with a comprehensive privacy law, you may have the right to know what personal information we collect and how we use it, to delete it, to correct it, and to opt out of the sale or sharing of personal information. We honour Global Privacy Control browser signals as a valid opt-out.
You can also ask someone to make a request for you as an authorized agent, and we may ask them to prove they act for you and ask you to confirm the request. If we turn a request down, you can ask us to look again, and where your state gives you a right to appeal we will tell you how to use it. We answer within the window your state sets, usually 45 days, and we will not treat you differently for using a right.
We do not sell your personal information. Even so, we provide a "Do Not Sell or Share My Personal Information" choice so you can exercise that right. To make any of these requests, email privacy@vyradata.com. You may also contact your state Attorney General.
Europe and the United Kingdom.
If you are in the EU or the UK, the GDPR and the UK GDPR give you the rights listed in the Your privacy rights section, exercised against the lawful bases described in How we use your information: performance of a contract, consent, legitimate interests, and legal obligations. You have the right not to be subject to a decision based solely on automated processing that produces a significant effect on you, and you can ask for human review.
If you have a concern, you can complain to the UK ICO or to your local data protection authority.
14Children's privacy.
Our websites, products, and services are not directed to children. We do not knowingly collect personal information from children, and where a minimum age of consent applies under local law we honour it. We do not knowingly send data about anyone under 13 through our advertising tools. If you believe a child has given us personal information, email privacy@vyradata.com and we will delete it.
15Changes to this policy.
We may update this policy from time to time. When we make a material change, we update the last-updated date at the top and give you notice where appropriate. If a change introduces a new purpose or new sharing that the law says needs your consent, we will ask for that consent before it applies to you, rather than treating your continued use as acceptance. For other changes, your continued use of the services after the change takes effect means you accept the updated policy.
16How to contact us.
- For privacy questions and to exercise your rights: privacy@vyradata.com.
- For security and vulnerability reports: security@vyradata.com.
- For general and legal questions: contact@vyradata.com.
We are based in Halifax, Nova Scotia, Canada. If you would rather write to us by mail, email privacy@vyradata.com and ask for our Privacy Officer, and we will give you a mailing address. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada, Quebec's CAI, the UK ICO, your EU data protection authority, or your US state Attorney General.