Privacy Policy

Vyam is a project-planning workspace run by the operator of Vyam (“we”, “us”). We decide why and how your personal data is used, so we are the “controller” (in India, the “data fiduciary”) of the data described here.

You can reach us at privacy@example.com.

We do not ask for payment card details today. If paid plans are added, card details will be taken by a payment company and we will not see or store full card numbers.

We do not knowingly collect sensitive categories of data (such as health, religion or biometric data). Please do not put them in your projects.

We do not use your data to profile you, to make decisions that have legal or similarly significant effects on you, or to train any AI model, ours or anyone else’s. Nobody who runs Vyam, and no company we work with, may use what you create in Vyam to train a model.

We use the companies below to run parts of Vyam. They may only use your data to provide their service to us, under contracts that protect it. We do not sell personal data and we do not “share” it for cross-context advertising.

When you invite someone to a project, they are shown your name and email address and the project’s name, kind, deadline and description, so they can decide whether to join. Until they accept they cannot open the project, and if they decline they are taken off the team. You are told when they answer.

We may also disclose data when the law requires it, to protect people’s safety or our rights, or to a buyer if the business is sold (you would be told, and this policy would continue to protect your data).

When you ask Vyam to draft a plan, the description and choices you entered are sent to Google’s Gemini service, which writes the draft. When you make a document (a project report, a proposal, a PRD, a pitch deck and the like, from the Vault or by asking in Ask AI), the project’s name, description, constraints, dates, phases, task titles and the first names of its people (never email addresses), and the answers you typed to the template’s questions (for a cost analysis report also the names, kinds, amounts in rupees and how often of the costs on the project’s Costs page, the hours of its tasks, and the hourly rate and budget you typed), are sent to the same service, which writes the words for the template’s fixed sections; the Word, PowerPoint or PDF file is then made in your browser and is only kept if you save it to the Vault. When you select words in an open document and ask Vyam to improve, shorten, explain or change them (or type your own instruction), those selected words (at most 1,200 characters; for bullet points, a paragraph or a diagram, the words of that part of the document), your instruction, the document’s title and the name of the part they are in are sent to the same service, which writes the new words; nothing else from the document is sent, and the new words are only kept if you press Keep. When you press “Draft with AI” on a checklist item, the project’s name, description, constraints, dates, phases, task titles and the first names of its people (never email addresses) are sent to the same service, which writes a document that is saved in the Vault; it is a starting point, not legal advice. If you describe your project in your own words (typed or spoken), the same service first reads those words to work out the details, and the details it finds are shown to you to check. Please do not put passwords, secrets, or personal data about other people in that description. When you press the button of a helper (Project check on a project, or Plan my week on My work), Vyam first works out its results in your browser, and then sends those results (the project’s name and deadline, task titles, project names, dates and hours, never your email address or anyone else’s) to the same service so it can put them in order and write a short summary. These helpers are also run when you ask for them in Ask AI (“check this project”, “plan my week”). Nothing is sent unless you ask, and nothing in a project is changed by them.

Your data is not used to train AI models. Vyam sends it to Google’s Gemini API only under Google’s paid-services terms for developers, under which Google does not use the prompts or answers to improve or train its models. We use no free or consumer tier for this. Google may keep requests for a limited time to detect abuse and meet legal duties. A question that needs the web is also searched with Google Search, which Google handles under its own terms.

• Everyday questions in Ask AI go to a lighter Gemini model, and the final plan and harder questions go to a stronger one. Both only ever receive your messages and a short summary of your projects, so an answer can be about your work. A question that needs the internet is searched on the web by Google (Gemini’s Google Search); the pages it was read from are listed under the answer, and they open on their own sites, which are not run by Vyam and have their own privacy policies.
• When an answer used one of your files, a small thumbnail of the file stands where it was quoted. Which file it was is worked out in your browser from a marker in the answer; nothing about it is stored anywhere but in your chat.
• The draft is a suggestion. You review it and change it before anything is saved.
• No decision about you is made by the AI alone. It does not decide anything about your account or access.
• How long Google keeps prompts, and whether it may review them, depends on the terms of the Google service plan we use. See Google’s terms for the Gemini API.
• If the AI service is switched off, Vyam reads your words itself and makes a plan from built-in templates instead, and nothing is sent to Google.
• Speaking uses your browser’s own speech recognition (see section 4). You can always type instead.

Our providers may process data in countries other than yours, including the United States and India. When personal data leaves the European Economic Area, the United Kingdom or Switzerland, we rely on an adequacy decision, the EU–US Data Privacy Framework where a provider is certified, or the European Commission’s Standard Contractual Clauses (and the UK addendum). You can ask us for a copy of the safeguards that apply.

For Indian users, we transfer data outside India only to countries and providers that the government has not restricted.

• Account and project data: for as long as your account exists, so that Vyam can work.
• When we delete your account at your request: your account and the projects only you work on are removed. Projects that other people still work on stay with them, and your name on their history may remain, so their records still make sense.
• Backups: copies may remain in our provider’s backups for a limited time after deletion (normally no more than a few weeks), and then are overwritten.
• Server logs: kept for a short time for security and fault-finding.
• Legal duties: some records may be kept longer if the law requires it, such as billing records once paid plans exist.

Depending on where you live, you can ask us to:

• give you a copy of your personal data (in Settings, “Export my data”)
• correct data that is wrong (you can edit your profile and projects yourself)
• have your data deleted (write to us, and we will delete your account)
• restrict, or object to, some uses of your data
• move your data to another service (the export is a standard JSON file)
• withdraw a consent you gave, such as Google sign-in, without affecting what was done before
• not be subject to a decision made only by a machine that has legal or similar effects on you (we do not make any)

To use a right that Settings does not cover, write to privacy@example.com. We will reply within one month (or the shorter time your law requires), and we may need to check it is you. There is no charge unless a request is clearly unfounded or excessive.

You can also complain to your data protection authority, for example your national authority in the EU, the Information Commissioner’s Office in the UK, the Data Protection Board of India, or your state attorney general in the US. We would appreciate the chance to put things right first.

• Data is encrypted in transit (HTTPS) and at rest by our hosting providers.
• Passwords are never stored by us in readable form; our sign-in provider keeps only a salted hash.
• Every project’s data is protected by access rules in the database: only the people on a project can see it, and only owners and editors can change it.
• Access tokens for coding agents are shown once and stored only as a one-way fingerprint.
• No system is perfectly secure. If a breach puts your data at risk, we will tell you and the authorities as the law requires.

Vyam is not for children. You must be at least 16 to use it, and at least 18 if you live in India or another place where that is the age of majority for agreeing to this. If you are a parent and think a child has given us their data, contact us and we will delete it.

Vyam uses only the browser storage it needs to keep you signed in and to remember your own settings. It uses no advertising or analytics cookies. The details are in the Cookie Notice.

European Economic Area, United Kingdom and Switzerland. The rights in section 8 apply to you under the GDPR or UK GDPR. Our legal reasons are in section 3.

California, USA. In the last 12 months we collected the categories of personal information in section 2: identifiers (name, email, IP address), commercial information (the plan you choose, once plans exist), internet activity (technical logs), and content you provide. We collect them for the business purposes in section 3 and from the sources in section 2. We do not sell personal information or share it for cross-context behavioural advertising, and we do not use or disclose sensitive personal information for purposes beyond those the law allows. You have the right to know, delete, correct, and not be discriminated against for using these rights. You can use an authorised agent. We do not respond to “Do Not Track” signals because we do not track you across sites.

India. Under the Digital Personal Data Protection Act, 2023, this policy is our notice of what we process and why. You may give or withdraw consent, access and correct your data, have it erased, nominate someone to exercise your rights if you die or cannot, and seek redress. Our grievance contact is at privacy@example.com. We reply to a grievance within 30 days. If we do not resolve a complaint, you can approach the Data Protection Board of India. If we ever want to use your data for a new purpose, we will tell you and ask you again first.

Brazil. Under the LGPD you have rights to confirmation, access, correction, anonymisation or deletion, portability, information about sharing, and to withdraw consent. Write to us, or to the ANPD.

Canada, Australia, and other places. You can ask to see and correct your personal information and to complain to us, and then to your privacy regulator. The rights above are open to everyone, wherever you live.

This policy took effect on 2026-11-12. When we change it in a way that matters, we will tell you in the app or by email before the change takes effect, and show the new date. Older versions can be requested from us.

Questions or requests about your data: privacy@example.com.

This policy describes what Vyam does today. If a new feature collects or shares new data, this text is updated before it is released.