Privacy policy
How we handle your data. In short: hosting in the EU, no ad trackers, no sharing for advertising. The German version is legally binding.
Last updated: September 20261. Controller
Cyan IT GmbH, Gewerbering 3, 94161 Ruderting, Germany, web@cyan-it.de. Data protection officer: Tobias Damasko, aigner business solutions GmbH, Goldener Steig 42, 94116 Hutthurm, Germany, tobias.damasko@aigner-business-solutions.com.
2. Account and login
For your account we process email address, display name and time of consent. Legal basis: Art. 6(1)(b) GDPR (contract). Login runs on our own identity service on EU servers.
3. Playing and AI analysis
In Free mode with your own API key everything runs locally in your browser; after sign-up we have no contact with your device.
In Premium scenarios your inputs – chosen options and your own words – are sent to an AI provider for analysis. Processing takes place in the EU under a data processing agreement. Your sessions belong to you; they are only shared if you actively share them.
4. Payment
Payments are handled by Mollie B.V., Amsterdam. We only receive status, amount and order number, never card details.
5. Organisations
If you use Vefraia through your organisation, it is the controller and we are the processor. Organisations only see aggregates for groups of five or more – no individual results, no profiles.
6. Recipients
Hosting: DigitalOcean, LLC, USA, data centre in Frankfurt am Main · AI processing: Anthropic, PBC, USA · Payment: Mollie B.V., Netherlands · Email: Scaleway SAS, France. DigitalOcean and Anthropic are based in the USA. We transfer data there on the basis of the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR) and, where the provider is certified, the EU-US Data Privacy Framework (Art. 45 GDPR).
7. Cookies and local storage
We only use strictly necessary cookies and storage (login, language, this notice). Legal basis: Section 25(2) TDDDG. No tracking or advertising cookies.
8. Retention
Account data until the account is deleted, invoicing data per statutory retention periods (up to 10 years). You can delete your sessions yourself at any time.
9. Your rights
Access, rectification, erasure, restriction, portability and objection (Art. 15–21 GDPR). You can withdraw consent at any time and lodge a complaint with a supervisory authority.
There are no automated decisions with legal effect under Art. 22 GDPR.