Privacy Policy
This policy describes what personal data we collect when you use supaintro, why we collect it, who else processes it, and what you can ask us to do with it.
Last updated
Who we are
Vyan Labs, a sole proprietorship of Sourish Sarmah, of Guwahati, Assam, India, is the controller of the personal data described here. Contact us about anything in this policy at support@vyanlabs.in.
What we collect
| Category | What it is | Where it comes from |
|---|---|---|
| Account data | Name, email address, hashed password, session records | You, at sign-up |
| Project inputs | Product name, product URL, written description, uploaded logo, whether you want narration | You, when creating a project |
| Generated content | Storyboards, scene compositions, rendered audio and video, and their intermediate assets | Produced by the service from your inputs |
| Purchase records | Order references, plan purchased, amount, currency, status, entitlements | Our merchant of record, on purchase |
| Support correspondence | The emails you send us and our replies | You |
| Technical logs | IP address, user agent, request paths, timestamps, error traces | Automatically, when you use the service |
We do not collect payment card details. Those are entered on our merchant of record's checkout and never reach our systems.
We do not ask for special category data, and you should not put it into project inputs. A launch video for a software product should not require it.
Why we use it, and our legal basis
| Purpose | Data used | Basis (UK/EU GDPR) |
|---|---|---|
| Creating and running your account | Account data | Performance of a contract |
| Generating your video | Project inputs, generated content | Performance of a contract |
| Processing payments and entitlements | Purchase records, account data | Performance of a contract |
| Support and correspondence | Support correspondence, account data | Performance of a contract, and legitimate interests |
| Security, abuse prevention, debugging | Technical logs | Legitimate interests in keeping the service working and secure |
| Legal, tax, and accounting records | Purchase records | Legal obligation |
We do not use your data for advertising, we do not build profiles for marketing, and we do not carry out automated decision-making that produces legal effects for you.
Who else processes it
Producing a video requires sending parts of your project to third-party AI providers and running the service on third-party infrastructure. Each processor, what it receives, and where it operates is listed on the subprocessors page, which is kept current as part of the code.
In outline: AI providers receive text from your project, a screenshot of your product page, and the video the service generates, each only for the step it runs. Infrastructure providers hold the database, your uploads and finished media, and ordinary request logs. Our merchant of record processes payments, and payment details never reach us. Every processor is named on the subprocessors page with the category of data it receives.
We do not sell personal data, and we do not share it for cross-context behavioural advertising.
International transfers
We operate from India and several of our processors are in the United States, so your data is transferred internationally. Where data originates in the UK or the European Economic Area, those transfers rely on Standard Contractual Clauses or another lawful transfer mechanism in our agreements with each processor.
How long we keep it
| Data | Retention |
|---|---|
| Account data | While your account exists, then deleted within 30 days of a deletion request |
| Project inputs and generated content | While the project exists. Deleting a project removes them |
| Purchase records | As long as tax and accounting law requires, typically several years, even after account deletion |
| Technical logs | A short operational window, typically up to 90 days |
| Support correspondence | Up to 24 months after the conversation ends |
| Backups | Deleted data persists in backups until they expire on their normal rotation |
Your rights
Depending on where you live, you have some or all of the following rights. We apply them to everyone rather than checking your jurisdiction first, except where the law requires otherwise.
- Access. Ask what we hold about you and get a copy.
- Correction. Have inaccurate data fixed.
- Deletion. Have your account and its data deleted, subject to records we must keep by law.
- Portability. Receive your data in a machine-readable format.
- Objection and restriction. Object to processing based on legitimate interests, or ask us to restrict it.
- Withdraw consent. Where processing relies on consent, withdraw it at any time.
- Non-discrimination. We will not degrade the service because you exercised a right.
To exercise any of these, write to support@vyanlabs.in from the address on your account. We respond within 30 days. You may also delete individual projects yourself from within the application.
If you are in the UK or EEA and you think we have handled your data badly, you can complain to your supervisory authority. We would rather you told us first, but that is your right, not a precondition.
India: Digital Personal Data Protection Act
We operate from India and comply with the Digital Personal Data Protection Act, 2023 for data subject to it. You may access, correct, and erase your personal data, nominate another person to exercise your rights in the event of death or incapacity, and raise a grievance with us. Grievances go to support@vyanlabs.in and are acknowledged within seven days.
California
California residents have the rights to know, delete, correct, and opt out of sale or sharing under the CCPA as amended by the CPRA. We do not sell personal information and do not share it for cross-context behavioural advertising, so there is nothing to opt out of, but the rights to know, delete, and correct apply and are exercised through the same address above.
Security
Data is encrypted in transit with TLS and at rest by our database and storage providers. Passwords are hashed, never stored in readable form. Access to production data is limited to those who need it to run the service. No system is perfectly secure, and we do not claim otherwise; if a breach affects your data and the law requires notification, we will notify you and the relevant authority within the required timeframe.
Children
The service is for business use and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has given us data, write to us and we will delete it.
Cookies
We use a small number of strictly necessary cookies and no analytics or advertising cookies. Details are in the cookie policy.
Changes
We will update this policy as the service changes. Material changes are notified by email or in the application. The version in force is the one on this page, dated at the top.