Privacy policy

How we handle your data — and the documents you upload.

This is the English translation of the German original. In case of discrepancies, the German version prevails.

As of: 31 August 2026

Controller

Tayfun Gülcan, Franz-Liszt-Straße 38, 38106 Braunschweig, support@vryne.com — full details in the imprint.

The organisation itself is responsible for the content it uploads; we process it on its behalf under Art. 28 GDPR.

No data protection officer has been appointed; the requirements of Art. 37 GDPR and § 38 BDSG are not met.

Which data we process

Account: e-mail address, first and last name, display name, optionally a profile picture
Sign-in: there are no passwords. Sign-in works through a one-time link sent to the stored address.
Sessions: session identifier, timestamps as well as the IP address and browser identifier of the sign-in
Organisation: name, identifier, memberships, roles and invitations
Documents: the uploaded files, the text extracted from them, its sections and the associated vectors
Conversations: questions, answers, tool steps and the cited passages
Usage: credits consumed per person and period, activity entries about uploads, invitations and similar events
Messages from us: the e-mail address to which we send sign-in links, invitations and purchase confirmations
Purchases: the credit package ordered, order number, invoice number and the net amount paid. We do not see credit card or bank details — those are held exclusively by the payment provider.
Reach: page views in aggregated form, without cookies and without recognition (see the cookie policy)
Public organisation: if an organisation makes its knowledge base public, the display name and role are visible there; the organisation’s name and description are public and indexed by search engines (details in the terms of use).

In addition, the hosting provider keeps customary server logs (see subprocessors). We do not analyse them and do not combine them with accounts.

Legal bases

Performance of a contract (Art. 6 (1) lit. b GDPR) for account, organisation, documents, chat, the sending of sign-in and invitation links as well as the processing of a credit purchase
Legal obligation (Art. 6 (1) lit. c GDPR) for the commercial and tax-law retention of invoice data
Legitimate interest (Art. 6 (1) lit. f GDPR) for operational security, abuse detection, request-rate limiting and cookieless reach measurement — you may object to this at any time

Providing the account data is necessary for use; without it no access can be set up. There is no legal obligation to provide it.

Disclosure

Your content is not sold and not evaluated for advertising. To provide the service we use service providers — the full list is under subprocessors.

No training on your content. The model provider receives only the text passages needed for the respective question.

For public organisations there is a special case: the uploaded documents can then be queried by anyone — without an account and without signing in. The organisation’s name and description are publicly indexable. The organisation makes that decision; it is then also the controller under data protection law for the published content.

E-mail delivery

Sign-in links, invitations and purchase confirmations are currently sent by Resend. What is transmitted is the recipient address and the content of the respective message — no documents, no conversations.

Resend is a temporary arrangement, and we say so openly. The provider is based in the USA and therefore does not match what Vryne otherwise promises. We are actively looking for a delivery service based and processing in the EU and will replace it as soon as the choice is made; we will announce the change — as with every new service provider — with 30 days’ notice. Until then, the exception under transfer to third countries applies to this one building block.

Payment

You buy credits via CopeCart (CopeCart GmbH, Berlin). CopeCart acts as the merchant: the purchase contract for the credit package is concluded there, CopeCart issues the invoice, pays the VAT and processes the payment.

When you click “Buy with payment obligation”, you open a page from CopeCart; your organisation’s identifier is passed along as a tracking key so that the credit lands in the right account. Everything else — name, billing address, payment method — is collected by CopeCart under its own responsibility; its privacy policy then applies. After a successful payment, CopeCart reports the order number, product and amount back to us. We do not see payment data.

Web search

If web search is enabled for your organisation, a model can search on its own for a question and fetch individual pages. The search query — not the document — leaves our service: it goes to a search instance we operate ourselves, which passes it on to public search engines, and fetching a page is visible to its operator. Whether a model searched is shown as a tool step next to the answer.

Connected AI apps (MCP)

If you connect Vryne to an AI app such as Claude or ChatGPT through the MCP connector, you grant that app read access to an organisation’s knowledge base via OAuth. For this we store the app’s registration data (name, addresses), the consent given, and access and refresh tokens (hashed). What the app requests is transmitted to the app’s provider at the user’s request (Art. 6(1)(b) GDPR or on behalf of the organisation); the provider’s privacy terms apply there. The connection can be removed at any time under Settings → Connected apps; consent and tokens are then deleted.

Transfer to third countries

Your documents, conversations and vectors do not leave Germany.

There is one exception: e-mail delivery via Resend. The recipient address and the message content are transmitted to the USA. The basis is standard contractual clauses under Art. 46 (2) lit. c GDPR. As said above: this is a temporary arrangement, not a permanent state — we are looking for a European replacement.

For everything else — hosting, database, storage, language models, payment, reach measurement — no transfer to a third country takes place. More under digital sovereignty.

No automated decision-making

Answers are produced with the help of language models but do not make decisions about individuals. Automated decision-making in individual cases, including profiling under Art. 22 GDPR, does not take place.

Labelling of AI-generated content

Answers, images, diagrams and tables are produced by generative AI. Under Art. 50 (2) of the EU AI Act we label this content so that it can be recognised as artificially generated:

Images generated by an answer carry a permanent EXIF marking (“Created using generative AI”) in the image data and a visible “AI-generated” badge below the image. The marking remains when the image is downloaded.
Diagrams and tables are marked with an “AI-generated” badge in the interface.
Text answers are recognisable in Vryne as an assistant message; when exporting or forwarding them, you should make the AI origin clear if you are responsible for doing so.

For text content, no reliable invisible watermark exists as of 2026; we rely on EXIF metadata (images) and visible labels — in line with the generally recognised state of the art and as far as technically possible. The labelling obligation under Art. 50 (2) applies to us as the provider; the obligation to inform members about the AI nature of the system (Art. 50 (1)) lies with the organisation deploying it.

Tenant separation

Every document, every conversation and every vector belongs to exactly one organisation. The separation is checked server-side on every access, not only in the interface.

Storage periods

Documents and conversations: until deletion by the organisation
Deleted documents: text sections and vectors are removed together with the document, the original file is removed from storage afterwards
Inactive organisations: after at least six months without a sign-in and without a request, we may delete them together with their content after prior notice
Accounts and memberships: until deletion on request
Sign-in sessions: expire after 7 days without use
One-time sign-in links: 90 minutes
Purchase transactions in the credit account: 10 years, due to commercial and tax-law retention periods
Sent e-mails at the delivery service: retained according to its policy, usually a few days for delivery logs

Backups at the hosting provider may persist for a short additional period and are overwritten on a regular cycle.

Your rights

Access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR). Name, display name and profile picture can be changed in the settings yourself; administrators can delete documents, conversations and the entire organisation there. For access, data export and the deletion of an individual account, a message to support@vryne.com is enough — we answer within one month.

You have the right to lodge a complaint with a data protection supervisory authority; the authority responsible for us is the State Commissioner for Data Protection of Lower Saxony (Landesbeauftragte für den Datenschutz Niedersachsen), Hanover.

Cookies and reach measurement

Only technically necessary cookies are set. Reach measurement is cookieless and can be switched off at any time — via Privacy settings in the footer of every page. Details in the cookie policy.

Changes

If the service changes, this policy changes with it. The version in force is always available on this page, recognisable by the date at the top.

Back to the privacy centre.