Vyndra — Privacy Policy
In force since: March 1, 2026
Vyndra is a brand registered by SHOP IQ AI SRL, a Romanian limited liability company, registered with the Romanian Trade Register under number RO 52494632, whose registered office is located at Strada 22 Decembrie nr. 22, Sc. C, 600197, Romania ("SHOP IQ AI SRL", "Vyndra", "we").
The purpose of this privacy policy ("Privacy Policy") is to inform you, regardless of your status (client, employee of the client, candidate, subcontractor, partner or user of our website) ("you"), of how we process your personal data in the context of our relationship.
This Privacy Policy complies with the applicable legal provisions on personal data protection, and in particular with Regulation (EU) No. 2016/679 of the European Parliament and of the Council of 27 April 2016 (the "GDPR") and Romanian Law No. 190/2018 on measures for the implementation of the GDPR.
We reserve the right to modify this Privacy Policy at any time.
1. Who is the data controller of your personal data?
SHOP IQ AI SRL is the data controller for the processing described in Article 2 of this Privacy Policy.
2. What data processing is carried out, the legal bases, the type of data and the retention periods?
| Purposes | Legal bases | Data collected | Retention periods |
|---|---|---|---|
| Sending commercial prospecting | SHOP IQ AI SRL's legitimate interest in sending prospecting emails to clients or prospects who are professionals. | Automatically deleted after three (3) years from collection or last contact or affirmative action on your part. | |
| Website operation | SHOP IQ AI SRL's legitimate interest in improving the functionality of the site. User consent where required. | Login data, browsing data. | Cookies may be placed on the user's device for a maximum period of thirteen (13) months. Information collected through trackers is kept for up to twenty-five (25) months, after which it is deleted or anonymised. |
| Management of the contractual relationship (account creation, invoicing, complaint management…) | SHOP IQ AI SRL's legitimate interest in managing its contracts with clients and service providers. | Identification data; economic and financial data; login data. | Kept for five (5) years from the termination of the contract. |
| Responding to inquiries and contact requests | SHOP IQ AI SRL's legitimate interest in responding to information requests. | Deleted after the request has been processed. | |
| Recruiting a candidate (application processing, CV database) | SHOP IQ AI SRL's legitimate interest in processing job applications. Consent is requested to retain CVs in our database. | Identification data; CV and cover letter. | Processed for the duration of the application, then deleted. With consent, retained for up to two (2) additional years. |
| Management of data subject rights requests | Legal obligation. | Identification data. | Kept for the time necessary to process the request, then archived for the duration of the applicable statute of limitations. |
3. How is your data collected?
We collect personal data directly from you when you use our platform, website, or services. If data is collected indirectly, you will be informed at the time of collection.
4. Who receives your data?
Within the limits of their responsibilities, the following categories of recipients may access your data:
- Authorized SHOP IQ AI SRL personnel.
- Service providers (hosting, platform operation, billing, technical support).
- Authorized personnel of our subprocessors.
- Courts, mediators, auditors, lawyers, debt collectors, and supervisory authorities, where legally required.
5. International data transfers
Where possible, we choose processors located in the European Union.
However, we may transfer your data outside the European Union — for example, when using cloud or AI model providers. Such transfers are carried out in accordance with the GDPR, and SHOP IQ AI SRL puts in place all required guarantees to secure your personal data, including through the use of processors located in countries offering an adequate level of protection or by applying the European Commission's standard contractual clauses, supplemented where necessary by additional safeguards.
Our main AI infrastructure subprocessors include:
- Google Cloud (Vertex AI) — AI model hosting and inference (United States)
- fal.ai — AI media generation services (United States)
- OpenRouter — AI model routing and access gateway (United States), which in turn provides access to models from providers including OpenAI and Anthropic
- Vercel AI Getway — AI model routing and access gateway (United States), which in turn provides access to models from providers including OpenAI and Anthropic
Details of all subprocessors are maintained in our Vyndra Trust Center.
6. Use of personal data in relation to AI systems
We do not use your personal data to train any AI models unless you provide explicit opt-in consent (e.g., for custom or private fine-tuning).
To maintain and improve our platform:
- We collect aggregated telemetry data (such as feature adoption, error rates, and performance metrics) strictly to maintain and improve the stability, security, and usability of our platform.
- We may review user inputs and outputs on a limited basis. This review is performed only by authorized personnel under strict confidentiality obligations, and solely for the purposes of debugging, ensuring service quality, and developing product improvements.
Note: Ownership of outputs, promotional use, and subscription plan differences are contractual matters addressed separately in our Terms & Conditions.
7. What are your rights over your personal data?
In accordance with applicable law, you have the following rights when your personal data is processed:
- Right of access — to obtain confirmation of whether your personal data is being processed and to obtain a copy of it.
- Right to object — to the processing of your data for legitimate reasons.
- Right to withdraw your consent — at any time where the legal basis for processing is consent.
- Right to data portability — to receive your personal data in a structured, commonly used and machine-readable format, where the legal basis is a contract or consent.
- Right to rectification — to request correction of incomplete or inaccurate data.
- Right to restriction of processing — in certain cases defined by law.
- Right to erasure — subject to the conditions in Article 17 of the GDPR.
- Right not to be subject to automated decision-making, including profiling.
- Right to determine the fate of your data after your death.
You may exercise your rights by contacting us using the details in Article 8.
If you believe your rights have not been respected, you have the right to lodge a complaint with the competent data protection authority: the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) in Romania, or the supervisory authority of your country of residence.
8. How to contact us?
If you have any questions or requests regarding your personal data, including the exercise of your rights, you can contact us:
- By post: Strada 22 Decembrie nr. 22, Sc. C, 600197, Romania
- By e-mail: privacy@vyndra.ai