Privacy policy
What data we process, why, who receives it and how long we keep it.
Effective October 4, 2026
1.Who processes your data
This policy explains what data Vayai collects, why, who we share it with and how long we keep it. We process personal data under the EU and UK GDPR and Russia’s Federal Law No. 152-FZ on personal data. Users in Russia also give a separate consent to personal data processing.
The controller of your personal data is the operator of Vayai:
Operator details will be listed here before payments open.
2.What data
Account data: your email address, sign-up date, language, the consents you gave with their date and version, your plan and credit balance.
What you create and tell us: uploaded photos, prompts and template field values, generated results, your templates, conversations with the assistant, your profile answers (what you sell, where, how many creatives you need, an optional logo), support requests and reports.
Payments: amount, currency, what you bought, status and payment ID. Your card details go to our payment processor Lava.top — Vayai never sees or stores them.
Technical data: IP address and browser details in server logs, usage events (such as “generation started” or “pack purchased”) and error logs. Prompts and email addresses are kept out of events and error logs.
Uploaded photos are checked automatically for explicit content and for whether a person is present. We don’t identify who is pictured and don’t create biometric face templates: the “person in photo” flag only stops such photos from being used in tools where they aren’t allowed.
3.Purposes and legal bases
Providing the service — sign-in, running jobs, storing results, credits and payments, support. Legal basis: performance of our contract with you (the terms of service); for users in Russia, also consent.
Safety and rule enforcement — checking prompts and uploads, preventing fraud, handling reports. Legal basis: our legitimate interests and legal obligations.
Accounting — keeping payment and tax records. Legal basis: legal obligation.
Improving Vayai — usage events help us see where the service is hard to use, and your profile answers help us suggest templates and plans. Legal basis: legitimate interests; the profile is optional and you can edit or delete it under My work → Profile. News and offers by email are sent only with your separate consent, and you can unsubscribe at any time.
Results and assistant replies are generated by AI, and the interface says so. An account block or template removal can be appealed and is reviewed by a person.
4.Who receives data
We don’t sell personal data. We share it only with service providers that help run Vayai, and only as much as each needs for its task.
Third-party AI model providers receive prompts, uploaded photos and job settings while a generation, upload check or assistant reply is being processed. They don’t receive your email or payment data.
Infrastructure: website hosting — Vercel; database, sign-in and file storage — Supabase; background job processing — a cloud hosting provider; email delivery — an email service; error monitoring — Sentry (without prompts, email addresses or cookies). Payments are processed by Lava.top, which receives your email, the amount and what you bought, and tells us the payment status.
We disclose data to public authorities only when the law requires it.
5.International transfers
Some providers and their servers are located outside your country, including outside the EU, the UK and Russia — for example, in the United States. We can’t complete your jobs without these transfers.
For users in the EU and UK, transfers to countries without an adequacy decision rely on the European Commission’s standard contractual clauses or other safeguards recognised by the GDPR. For users in Russia, cross-border transfers are made on the basis of consent and in line with Article 12 of Law No. 152-FZ.
6.Retention
Results: 30 days, or 90 days on the Pro and Ultra plans. Uploaded photos: 30 days, or longer while a stored result or your profile logo still uses them; photos that fail the check are deleted immediately.
Prompts and provider responses in job logs: 90 days, after which only the cost is kept. Assistant conversations: 30 days, with email addresses and phone numbers masked. Aggregated demand signals from conversations are pseudonymised and kept for 12 months.
Account data, templates and profile answers: for as long as your account exists. Payment and credit records: as long as accounting and tax law requires (usually 5 years), including after account deletion, in anonymised form.
7.Your rights
Depending on where you live, you have the right to access your data and get a copy, correct it, have it deleted, restrict or object to processing, withdraw consent, and receive your data in a portable format.
You can do a lot yourself: edit or delete your profile, or delete your whole account, under My work → Profile. For anything else, contact us using the details below. We reply within one month (within 10 working days for users in Russia).
If you believe your rights have been violated, you can complain to a supervisory authority — in the EU or UK, the data protection authority where you live; in Russia, Roskomnadzor. We’d appreciate the chance to sort it out first.
Vayai isn’t intended for anyone under 18, and we don’t knowingly collect their data.
9.Data protection contacts
Send personal data requests to the contacts below. Write from your account email or include it in your request, so we can find your data and confirm the request comes from you.
- Contact form: the support page