Your GDPR Rights
Last updated: 26 March 2026
1. Introduction
Vyrable is committed to respecting and upholding your data protection rights under both the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (EU GDPR). This page explains your rights in detail and how to exercise them.
This page should be read alongside our Privacy Policy, which provides full details on how we collect, use, and protect your personal data.
2. Your Rights Under GDPR
As a data subject, you have the following rights in relation to your personal data:
Right of Access (Article 15)
You have the right to request a copy of the personal data we hold about you. We will provide this in a structured, commonly used format (JSON or CSV) within 30 days of your request.
Right to Rectification (Article 16)
You have the right to request that we correct any inaccurate or incomplete personal data we hold about you. You can update most account information directly through your dashboard settings.
Right to Erasure (Article 17)
You have the right to request the deletion of your personal data ("right to be forgotten"). This applies when the data is no longer necessary for the purpose it was collected, you withdraw consent, or the data has been unlawfully processed. Some data may be retained where required by law (e.g., financial records for tax compliance).
Right to Restriction of Processing (Article 18)
You have the right to request that we limit how we process your personal data. This may apply where you contest the accuracy of data, the processing is unlawful, we no longer need the data but you require it for legal claims, or you have objected to processing pending verification.
Right to Data Portability (Article 20)
You have the right to receive your personal data in a structured, commonly used, machine-readable format (JSON or CSV) and to transmit it to another controller. This applies to data you have provided to us and that is processed based on consent or contract performance.
Right to Object (Article 21)
You have the right to object to the processing of your personal data where we rely on legitimate interests as the legal basis. This includes the right to object to profiling based on legitimate interests. Where you object, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
Right to Withdraw Consent (Article 7(3))
Where we process your data based on consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
3. How to Exercise Your Rights
You can exercise your data protection rights in the following ways:
By Email
Send your request to hello@vyrable.ai with the subject line "GDPR Request". Please include:
- Your full name and email address associated with your account
- Which right you wish to exercise
- Any additional details to help us locate and process your request
Via API (Self-Service)
Logged-in users can use the following API endpoints for immediate self-service:
GET /api/gdpr/exportDownload a full export of your personal data in JSON format.
DELETE /api/gdpr/deleteRequest permanent deletion of your account and all associated personal data. This action is irreversible.
Response Time
We will acknowledge your request within 48 hours and fulfil it within 30 days. If your request is particularly complex, we may extend this by up to two additional months and will notify you of the extension and reasons within the initial 30-day period.
All requests are free of charge. We may charge a reasonable fee or refuse to act on requests that are manifestly unfounded or excessive, in accordance with Article 12(5) GDPR.
4. Data Protection Officer
Our Data Protection Officer (DPO) oversees our compliance with data protection legislation. You can contact the DPO for any questions, concerns, or requests related to your personal data:
Email: dpo@vyrable.ai
Postal: Data Protection Officer, Vyrable, United Kingdom
5. Right to Lodge a Complaint
If you are unsatisfied with how we have handled your data or responded to your request, you have the right to lodge a complaint with a supervisory authority.
United Kingdom
Information Commissioner's Office (ICO)
Website: ico.org.uk
Helpline: 0303 123 1113
Live chat: ico.org.uk/global/contact-us/live-chat
European Union
If you are located in the EU, you have the right to complain to the supervisory authority in the EU Member State of your habitual residence, place of work, or the place of the alleged infringement. A list of EU data protection authorities is available at: edpb.europa.eu
6. Where Your Data Is Processed
Your personal data is primarily stored and processed in the United Kingdom and the European Economic Area (EEA). Our primary database is hosted in the EU (Frankfurt) and our application is served from EU edge locations.
Some of our sub-processors are based outside the UK/EEA (primarily in the United States). When data is transferred to these processors, we rely on Standard Contractual Clauses (SCCs), the UK International Data Transfer Agreement (IDTA), or adequacy decisions to ensure your data remains protected.
When you connect third-party platforms (such as LinkedIn, X/Twitter, or other social media services), your content may be transferred to and processed on servers in other jurisdictions in accordance with those platforms' own privacy policies.
For a full list of our sub-processors and their locations, see Section 7 of our Privacy Policy.
7. Legal Basis for Processing
We process your personal data under one or more of the following legal bases:
| Legal Basis | When We Use It |
|---|---|
| Consent (Art. 6(1)(a)) | Marketing emails, non-essential cookies (analytics, marketing), AI personalisation features |
| Contract (Art. 6(1)(b)) | Providing your account, processing subscriptions and payments, delivering the core Service |
| Legitimate Interest (Art. 6(1)(f)) | Service improvement, analytics, fraud prevention, security monitoring |
| Legal Obligation (Art. 6(1)(c)) | Tax and financial record-keeping, regulatory compliance, responding to lawful requests |
Where we rely on legitimate interest, we have conducted a balancing test to ensure our interests do not override your fundamental rights and freedoms. You can request a copy of our legitimate interest assessments by contacting us.
8. Data Retention Periods
We retain your personal data only for as long as necessary for the purposes it was collected. The table below summarises our retention periods:
| Data Category | Retention Period |
|---|---|
| Account data | Duration of account + 30 days after deletion request |
| Generated content | Duration of account (deleted on account closure) |
| Payment records | 7 years (legal/tax obligation) |
| Server logs | 90 days |
| Analytics data | 26 months (anonymised after) |
| Support tickets | 3 years after resolution |
| Cookie consent records | 3 years (proof of consent) |
| AI interaction logs | 12 months (then anonymised) |
After the retention period expires, data is either permanently deleted or fully anonymised so that it can no longer be linked to you.
9. Contact Us
If you have any questions about your GDPR rights or wish to exercise them, please contact us at:
General: hello@vyrable.ai
Data Protection Officer: dpo@vyrable.ai
Website: vyrable.ai