Privacy that is clear, practical, and built for modern teams.

1. The roles Vyso plays

How Vyso handles data depends on the type of information involved.

2. Information we collect

3. Website analytics

Vyso uses Umami to understand how our websites are used and to improve navigation, onboarding, product experience, and website performance.

Our Umami analytics service is self-hosted and operated by Vyso.

Depending on the page and interaction, analytics data may include pages visited, referring page, browser type, operating system, device type, screen information, approximate country, anonymous session information, and selected website or product interaction events.

Vyso does not intentionally send Customer Content, passwords, authentication tokens, or sensitive account information to Umami.

Umami is used for aggregate website and product analysis. It is not used to serve third-party advertising.

Our standard Umami implementation does not require analytics cookies and is not intended to track users across unrelated websites.

4. Cookies and similar technologies

Vyso uses cookies and similar browser technologies where they are necessary to operate the Service or remember your cookie choice.

5. Legal bases for processing

Where the GDPR, UK GDPR, or similar privacy laws apply, Vyso processes personal information under one or more lawful bases.

We rely on the performance of a contract where processing is necessary to create and maintain an account, provide the Service, process uploads, perform transformations, deliver media, or administer a subscription.

We may rely on legitimate interests to secure the Service, prevent fraud and abuse, maintain reliability, debug technical problems, understand aggregate usage, and improve Vyso. Where we rely on legitimate interests, we consider those interests against the rights and interests of affected individuals.

We rely on consent where applicable, including where a technology, communication, or processing activity legally requires consent.

We may also process information where necessary to comply with legal obligations, including accounting, taxation, regulatory requirements, or lawful requests from authorities.

6. How we use information

Vyso uses information to provide and operate the Service, authenticate users, manage accounts and workspaces, process uploads, store assets, process temporary anonymous uploads, generate asset metadata, provide search functionality, perform image transformations, deliver optimized media, operate Library Health features, process subscriptions, provide customer support, prevent abuse, investigate security incidents, troubleshoot errors, and improve reliability and performance.

Vyso does not use Account Data to serve third-party advertising.

Vyso does not sell personal information.

7. AI-powered processing

Vyso uses automated and AI-assisted processing to help organize, understand, search, and maintain uploaded media.

Depending on the features used, this processing may include generating captions, generating tags, creating embeddings, identifying visually similar assets, supporting semantic search, detecting duplicate or near-duplicate assets, and analyzing media for organization and retrieval.

Vyso does not use Customer Content to train general-purpose foundation models for use outside the customer’s Vyso workspace.

If a requested feature uses an external AI or infrastructure provider, Customer Content is shared only to the extent reasonably necessary to provide that functionality and subject to applicable contractual protections. Current public provider disclosures are listed on the Subprocessors page.

Vyso does not authorize service providers to use Customer Content for their own independent advertising purposes.

Organizations that upload content to Vyso remain responsible for ensuring that they have an appropriate legal basis to process any personal information contained within that content.

8. Service providers and sub-processors

Vyso uses service providers where necessary to operate the Service.

These providers receive only the information reasonably necessary to perform the relevant service.

See the current provider details on the Subprocessors page.

9. International data transfers

Vyso and its service providers may process personal information in countries other than the country where you are located.

Where required by law, international transfers are protected through legally recognized mechanisms such as adequacy decisions, Standard Contractual Clauses, or other appropriate safeguards.

Unless expressly stated in your agreement with Vyso, we do not guarantee that all account, operational, or service data will remain within a particular geographic region.

10. Data retention

Vyso retains personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy.

Account information is generally retained while your account remains active and for a reasonable period afterward where necessary for legal obligations, accounting, security, or dispute resolution.

Customer Content is generally retained until you or your organization deletes it, the relevant workspace is terminated, or another applicable retention rule requires deletion.

Deleted information may remain temporarily in backups until it is removed through normal backup rotation.

Assets uploaded through anonymous onboarding are temporary. If an anonymous session is not claimed by an authenticated Vyso account, the associated files and processing information are automatically deleted after the configured temporary retention period.

Analytics, security logs, and operational logs are retained only for periods reasonably necessary for security, troubleshooting, product analysis, or legal obligations. They are then deleted or anonymized where appropriate.

11. Security

Vyso uses technical and organizational measures designed to protect information against unauthorized access, disclosure, alteration, or loss.

These measures include encryption in transit, encryption at rest where supported by the relevant infrastructure, authentication controls, access restrictions, least-privilege access practices, logging, monitoring, and restricted or signed access to stored assets where applicable.

No online service can guarantee complete security. Vyso continuously works to reduce security risks and respond appropriately to identified incidents.

12. Your privacy rights

Depending on where you live, you may have rights relating to your personal information. These may include rights to access information, correct inaccurate information, request deletion, restrict processing, object to certain processing, receive portable data, and withdraw consent where processing relies on consent.

Requests relating to Account Data can be sent to [email protected].

Vyso will respond within the timeframe required by applicable law.

If your personal information appears within Customer Content controlled by another Vyso customer, you should normally contact that customer first. Where required by law, Vyso will assist its customers in responding to valid data subject requests.

13. California privacy rights

Where applicable, California residents may have rights to know what categories of personal information are collected, request access to personal information, request deletion, correct inaccurate information, and obtain information about certain disclosures.

Vyso does not sell personal information.

Vyso does not share personal information for cross-context behavioral advertising.

14. Children’s privacy

Vyso is not intended for use by children under the age of 16.

We do not knowingly allow children under 16 to create Vyso accounts.

If you believe that a child has provided personal information to Vyso, contact [email protected].

15. Customer responsibilities

Customers remain responsible for Customer Content uploaded to Vyso.

Where Customer Content contains personal information about other individuals, the customer is responsible for having an appropriate legal basis for processing that information, providing any privacy notices required by law, obtaining consent where required, respecting applicable privacy and data protection laws, and responding to requests relating to that Customer Content.

Vyso will provide reasonable assistance where required under applicable processor obligations.

16. Security incidents

If Vyso becomes aware of a security incident involving personal information, we will investigate the incident and provide notifications where required by applicable law.

Where Vyso acts as a processor, we will provide affected customers with information reasonably necessary for them to meet their own legal obligations.

17. Changes to this Privacy Policy

Vyso may update this Privacy Policy from time to time.

When we make changes, we will update the Last updated date at the top of this page.

Where required by law or appropriate because of the significance of a change, we may also provide notice through the Service or by email.

18. Contact us

Questions about this Privacy Policy, privacy requests, or how Vyso handles personal information can be sent to:

[email protected]