On this page
- 1. Who we are and how to contact us
- 2. Who this policy covers
- 3. What data we process, why, and on what legal basis
- 4. Where data comes from
- 5. Store data and Shopify
- 6. AI processing
- 7. Improving the Service and AI training
- 8. Who receives data
- 9. International transfers
- 10. Your rights
- 11. Is providing data required?
- 12. Cookies
- 13. Security
- 14. Google user data
- 15. Changes
This Privacy Policy explains how Vrandex Media, obrt za usluge ("Vrandex", "we", "us"), trading as Vrandex Studio, processes personal data when you visit vrandexstudio.com, join our waitlist, use the Vrandex Studio app (app.vrandexstudio.com, the phone app and the embedded Shopify page), or when your employer or client uses Vrandex Studio and shares your data with us.
Vrandex Send, our separate email-sending service, has its own privacy policy.
1. Who we are and how to contact us#
Controller: Vrandex Media, obrt za usluge, owner Toni Vrandečić, Ulica Velimira Terzića 13, 21000 Split, Croatia, OIB [OIB].
Privacy contact: privacy@vrandexstudio.com
We have not appointed a data protection officer, because the law does not require one for our activities. Send any privacy question or request to the address above.
2. Who this policy covers#
- Website visitors of vrandexstudio.com.
- Waitlist and pilot sign-ups.
- App users: people with a Vrandex Studio account (customer owners, staff, agency staff, client staff).
- People whose data our customers put into the Service (for example staff named in brand materials, people shown in uploaded photos). For this data our customer is the controller and we act as its processor under our Data Processing Agreement; this policy explains what we do as processor for transparency, but the customer's own privacy notice governs.
Our Service is business-only. We do not knowingly collect data from children; users must be at least 18.
3. What data we process, why, and on what legal basis#
| Purpose | Data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Website operation and security | IP address, browser and device data, pages visited, timestamps (server logs) | Legitimate interest in running a secure website (Art. 6(1)(f)) | Logs up to 30 days, security logs up to 12 months |
| Website analytics (only if you accept analytics cookies) | Pseudonymous usage data, approximate location, device data | Consent (Art. 6(1)(a)) | Up to 14 months |
| Waitlist and pilot sign-up | Name, email, company, store URL, message, consent record | Steps before a contract (Art. 6(1)(b)); for marketing emails, consent (Art. 6(1)(a)) | Until the pilot or launch decision, max. 24 months; consent records 3 years after withdrawal |
| Account and login | Name, email, password hash (handled by Clerk), Google account ID and profile picture if you sign in with Google, workspace membership and role | Contract (Art. 6(1)(b)) | Life of the account, then deleted within 90 days |
| Providing the Service | Everything you put in the Workspace (brand data, briefs, emails, images, comments), usage of features, Credits | Contract (Art. 6(1)(b)) | Life of the account; deleted within 30 days after the 30-day export period ends |
| Store connections (Shopify, WooCommerce, or through Vrandex Send) | Shop name and domain, products, prices, stock, collections, discounts, and order data needed to calculate sales totals per product (see section 5) | Contract (Art. 6(1)(b)) | While connected; deleted within 30 days of disconnect or Shopify uninstall |
| Email-platform connections (Klaviyo, Mailchimp) | Account ID and name, lists/segments names and counts, campaign drafts and statistics (opens, clicks, revenue totals) | Contract (Art. 6(1)(b)) | While connected; deleted on disconnect or immediately on request |
| AI features | Your prompts, briefs, brand data, product data and images sent to AI providers to generate Output | Contract (Art. 6(1)(b)) | See section 6 |
| Billing and invoicing | Company name, billing address, VAT/OIB number, contact name and email, plan, payment status (card data is handled by Stripe, not stored by us) | Contract (Art. 6(1)(b)); legal obligation for invoices and tax records (Art. 6(1)(c)) | Invoices and accounting records 11 years as required by Croatian law |
| Support | Messages, screenshots, account information | Contract (Art. 6(1)(b)); legitimate interest in helping you (Art. 6(1)(f)) | 3 years after the case is closed |
| Service emails (sign-in codes, security notices, "your email is ready", billing) | Email, name | Contract (Art. 6(1)(b)) | Sending logs 12 months |
| Product news and marketing emails | Email, name, company, interaction with our emails | Consent (Art. 6(1)(a)); or, for existing customers, our legitimate interest in telling them about similar services, with an opt-out in every email (Art. 6(1)(f)) | Until you unsubscribe |
| Phone app notifications | Push subscription endpoint and keys, device type | Consent (you allow notifications) | Until you turn notifications off or the subscription expires |
| Security, fraud and abuse prevention | Login events, IP addresses, audit logs, actions in the Workspace | Legitimate interest in keeping the Service secure (Art. 6(1)(f)); legal obligation where applicable | Up to 12 months (365 days) |
| Improving the Service | Usage data; de-identified design data (see section 7) | Legitimate interest in improving our product (Art. 6(1)(f)), with an opt-out | See section 7 |
| Legal claims and compliance | Relevant records | Legitimate interest / legal obligation | As long as needed for the claim or obligation |
Where we rely on legitimate interest, we have balanced it against your rights; you can ask for details and you can object (section 10).
4. Where data comes from#
Most data comes from you. Some comes from: your employer or client who invites you; Google, if you sign in with Google (name, email, profile picture); connected services you authorise (Shopify, WooCommerce, Klaviyo, Mailchimp, Vrandex Send); our payment provider (payment status).
5. Store data and Shopify#
When you connect a Shopify store, we access the data you authorise: products, inventory, collections, discounts and orders. We read orders only to calculate sales totals per product (for example units sold, revenue, returns, best-sellers, items bought together). We do not store customer names, email addresses, phone numbers or postal addresses, and we never use your shoppers' data to contact them.
We do not sell Shopify data, and we do not use any Shopify data to train or improve AI models unless you give separate explicit consent. We support Shopify's privacy webhooks: we answer customer data requests and redaction requests, and we delete shop data within 30 days after you uninstall the app.
6. AI processing#
To generate emails, texts and images, we send the relevant parts of your Workspace (briefs, Brand DNA, product data, images you choose) to AI providers listed in section 8 and on our Sub-processors page.
- Anthropic (text, layout, the Orbi agent) does not use API data to train its models under its commercial terms.
- Google Gemini is used only through paid services, under which Google does not use the data to improve its products.
- fal.ai runs several image models; it may keep and use anonymised derived data under its terms.
- Higgsfield (hero images): under Higgsfield's terms, inputs submitted through non-Enterprise accounts may be used by Higgsfield to improve its models, and data used for training cannot be removed later. Workspace owners can switch Higgsfield off in Workspace settings → "Use Higgsfield for images"; then no prompts or images from that workspace are sent to Higgsfield, and another image model is used instead.
The AI does not make decisions about you that have legal or similarly significant effects. Orbi only prepares drafts and suggestions that a person approves.
AI-generated images carry machine-readable "AI-generated" markings.
7. Improving the Service and AI training#
We use usage data to understand which features work and to fix problems.
Unless the workspace owner switches it off (Workspace settings → Privacy → "Help improve Vrandex Studio"), we may use de-identified design data (layouts, block structures, design choices, edits, approvals and AI-written texts with personal data removed) to improve the Service, including to evaluate and train AI models. We remove names, email addresses, phone numbers and other identifiers before use. We never use Shopify data (without separate consent), uploaded photos, logos, images generated by third-party image models, or data from your Klaviyo, Mailchimp or Vrandex Send accounts for this. De-identified data is kept for as long as it is useful for improvement; if you switch the setting off, we stop collecting new data from your Workspace.
8. Who receives data#
We share personal data only with:
- Sub-processors who help us provide the Service: hosting, database, storage, login, email, AI and payment providers. The full list, with each provider's location and transfer safeguard, is on our Sub-processors page.
- Connected services you choose (Shopify, WooCommerce, Klaviyo, Mailchimp, Vrandex Send), on your instruction.
- Professional advisers (accountant, lawyer) under confidentiality.
- Authorities, where the law requires it.
- A successor business, if our business is transferred (for example to a company owned by our owner), under this policy.
We do not sell personal data and do not share it for advertising.
9. International transfers#
Some providers are located outside the European Economic Area, mainly in the United States. Where we transfer personal data outside the EEA, we use: an adequacy decision (for example the EU-US Data Privacy Framework, for certified recipients); or the European Commission's Standard Contractual Clauses, with additional measures where needed. You can request a copy of the relevant safeguards at privacy@vrandexstudio.com.
10. Your rights#
You have the right to: access your data; correct it; delete it; restrict processing; data portability; object to processing based on legitimate interest (including the service-improvement use in section 7) and to direct marketing at any time; and withdraw consent at any time, without affecting earlier processing.
Send requests to privacy@vrandexstudio.com. We answer within one month (extendable by two months for complex requests, with notice). We may need to verify your identity. If your data is in a customer's Workspace (section 2.4), we will pass your request to that customer and help them answer it.
You also have the right to complain to a supervisory authority, in Croatia the Agencija za zaštitu osobnih podataka (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr, or the authority in your country.
11. Is providing data required?#
Account and billing data are required to provide the Service and issue invoices; without them we cannot contract with you. Analytics, marketing and notifications are optional.
12. Cookies#
We use strictly necessary cookies for login and security, and analytics or error-replay cookies only with your consent. See our Cookie Policy. On the website you can open "Cookie settings" in the footer; the app uses only necessary cookies today.
13. Security#
We protect personal data with technical and organisational measures, including encryption in transit (TLS) and at rest, access control with multi-factor authentication, least-privilege access, encrypted storage of connection tokens, logging and monitoring, backups, and vendor due diligence. If a personal data breach occurs that is likely to put you at risk, we notify the authority within 72 hours and inform affected people where required.
14. Google user data#
If you sign in with Google, we receive only your name, email address and profile picture from Google, and use them only to create and secure your account. We do not use Google user data for advertising, do not sell it, and do not use it to train AI models. To remove the Google connection from your account, write to privacy@vrandexstudio.com.
15. Changes#
We may update this policy. We will post the new version here with its date and, for material changes, notify account owners by email or in the app.