Legal

Privacy Policy

Last updated: 13 November 2026

1. Who controls your data

Vynthen, Addis Ababa, Ethiopia, is the controller of personal data processed through vynthen.com, app.vynthen.com, build.vynthen.com, the VYN CLI and related APIs (the "Services"). Privacy questions and requests: privacy@vynthen.com.

This Policy explains how we handle personal data in line with the privacy protections of the Constitution of the Federal Democratic Republic of Ethiopia (in particular Article 26), the Computer Crime Proclamation No. 958/2016, the Communications Service Proclamation No. 1148/2019, the Consumer Protection Proclamation No. 813/2013, and other applicable Ethiopian laws, together with recognised data-protection principles reflected in Ethiopia's developing data-protection framework.

2. Data we collect

• Account data: name, email address, password hash, plan, preferences, verification status and, if you use social sign-in, your GitHub or Google account ID, display name, avatar URL and email.
• Content and usage: prompts, messages, uploaded images, generated content, Build projects and files, token counts, model selections, timestamps, and error diagnostics.
• Billing data: Telebirr transaction references, sender name, amounts, plan and month selections, top-up screenshots you upload, wallet ledger entries and receipts.
• Device and technical data: IP address, browser and device type, session identifiers, CLI device names and last-seen times, and security logs.
• Connected accounts: OAuth access tokens for GitHub and Google, the scopes you grant, and the data needed to perform actions you request (repository metadata, Gmail messages, Drive files, calendar events).

3. How and why we use data

We process personal data to provide and secure the Services, authenticate you, generate responses and code, maintain your wallet and subscriptions, send transactional emails (including verification codes and billing notices), provide support, prevent abuse and fraud, enforce our Terms of Service, and comply with legal obligations. Our legal bases are performance of our contract with you, your consent (for optional integrations, marketing and non-essential cookies), our legitimate interests in operating and securing the Services, and compliance with applicable law.

4. AI processing and model providers

To answer a prompt or generate a project, we send the necessary content to model providers, including OpenRouter and the underlying model developers, which may process data outside Ethiopia. We send only what is needed for the request. We do not use your content to train our own models, and we configure providers where available to avoid training on API data. Provider retention and processing are governed by their terms and privacy policies. Do not submit special-category or highly sensitive data unless it is necessary and lawful for you to do so.

5. GitHub and Google integrations

When you connect GitHub, we may create repositories, commit files and read repository metadata on your behalf. When you connect Google, we may access Gmail, Drive and Calendar according to the scopes you approve. OAuth tokens are encrypted at rest using AES-256-GCM and are used only to perform actions you request. You can revoke access at any time in GitHub or Google settings, or by asking us to disconnect the account. Vynthen's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. How we access and use Google user data

Google data is accessed only after you connect your Google account and approve the scopes shown on Google's consent screen. We request Gmail, Google Drive and Google Calendar scopes. Gmail is used to read message metadata and snippets you ask about and, when you ask, to send mail. Drive is used to list and open files you request. Calendar is used to list your calendars and events and, when you ask, to create events. We do not use Google user data for advertising, to train our models, to build user profiles, or for any purpose unrelated to the features you request. Vynthen's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect Google at any time from Integrations, which deletes our stored tokens for that account.

7. Deleting data and revoking access

You can delete conversations and Build projects from the product, remove custom MCP servers and disconnect GitHub or Google from Integrations, and request full account deletion by emailing privacy@vynthen.com. We will delete or anonymise your personal data within 30 days, except records we must keep under Ethiopian tax or accounting law. To revoke Google access directly, visitmyaccount.google.com/permissions; for GitHub, use your GitHub authorised applications settings.

8. Cookies and similar technologies

We use strictly necessary cookies for sessions, sign-in, OAuth state and security. We use local storage for your theme and sidebar preferences. We do not use advertising or cross-site tracking cookies. You can clear cookies in your browser, but sign-in and some features will stop working.

9. Sharing and disclosure

We share data with processors that help us run the Services: hosting and infrastructure providers (including our VPS provider), model and image providers, email delivery, and Telebirr payment verification. They act on our instructions and are bound by confidentiality and security obligations. We may disclose data if required by Ethiopian law, a court order, or a lawful request from a competent authority, or where necessary to protect rights, safety or the integrity of the Services. We do not sell personal data.

10. International transfers

Some processors are located outside Ethiopia, including in the United States and the European Union. Where we transfer personal data abroad, we take reasonable steps to ensure an appropriate level of protection through contractual safeguards, provider security commitments and data minimisation.

11. Retention

We keep account data while your account is active. Messages, projects and files remain until you delete them or your account. Verification codes expire after 10 minutes. OAuth tokens remain until you revoke them or disconnect the integration. Security and access logs are kept for up to 90 days unless needed for an investigation. Billing and tax records are kept for the period required by Ethiopian tax law, generally up to seven years. When data is no longer needed, we delete or anonymise it.

12. Security

We use TLS in transit, scrypt password hashing, AES-256-GCM encryption for stored provider tokens, encrypted wallets with an immutable ledger, least-privilege access, rate limiting and audit logs. No system is perfectly secure. If a personal-data breach occurs, we will investigate, mitigate, notify affected users without undue delay, and notify competent authorities where required by Ethiopian law.

13. Your rights

Subject to applicable law, you may request access to your personal data, correction of inaccurate data, deletion, restriction of or objection to processing, portability of data you provided, and withdrawal of consent. You can update your name in Settings, delete conversations and projects in the product, and contact us for other requests. We may need to verify your identity. We aim to respond within 30 days. If you are not satisfied, you may complain to the competent Ethiopian authority or seek a remedy in court.

14. Children

The Services are not directed to children under 18. Minors may use the Services only with the consent and supervision of a parent or guardian who accepts our Terms. If we learn that we have collected data from a child without the required consent, we will delete it.

15. Marketing

We send transactional messages necessary to operate your account. We send product news only with your consent, and you can opt out at any time without affecting essential messages.

16. Changes and contact

We may update this Policy. Material changes will be announced on the Services or by email before they take effect. Contact privacy@vynthen.com for privacy requests, or security@vynthen.com for security reports. Postal contact: Vynthen, Addis Ababa, Ethiopia.