Your GDPR Rights

Last updated: 26 March 2026

1. Introduction

Vyrable is committed to respecting and upholding your data protection rights under both the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (EU GDPR). This page explains your rights in detail and how to exercise them.

This page should be read alongside our Privacy Policy, which provides full details on how we collect, use, and protect your personal data.

2. Your Rights Under GDPR

As a data subject, you have the following rights in relation to your personal data:

Right of Access (Article 15)

You have the right to request a copy of the personal data we hold about you. We will provide this in a structured, commonly used format (JSON or CSV) within 30 days of your request.

Right to Rectification (Article 16)

You have the right to request that we correct any inaccurate or incomplete personal data we hold about you. You can update most account information directly through your dashboard settings.

Right to Erasure (Article 17)

You have the right to request the deletion of your personal data ("right to be forgotten"). This applies when the data is no longer necessary for the purpose it was collected, you withdraw consent, or the data has been unlawfully processed. Some data may be retained where required by law (e.g., financial records for tax compliance).

Right to Restriction of Processing (Article 18)

You have the right to request that we limit how we process your personal data. This may apply where you contest the accuracy of data, the processing is unlawful, we no longer need the data but you require it for legal claims, or you have objected to processing pending verification.

Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, machine-readable format (JSON or CSV) and to transmit it to another controller. This applies to data you have provided to us and that is processed based on consent or contract performance.

Right to Object (Article 21)

You have the right to object to the processing of your personal data where we rely on legitimate interests as the legal basis. This includes the right to object to profiling based on legitimate interests. Where you object, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

Right to Withdraw Consent (Article 7(3))

Where we process your data based on consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

3. How to Exercise Your Rights

You can exercise your data protection rights in the following ways:

By Email

Send your request to hello@vyrable.ai with the subject line "GDPR Request". Please include:

  • Your full name and email address associated with your account
  • Which right you wish to exercise
  • Any additional details to help us locate and process your request

Via API (Self-Service)

Logged-in users can use the following API endpoints for immediate self-service:

GET /api/gdpr/export

Download a full export of your personal data in JSON format.

DELETE /api/gdpr/delete

Request permanent deletion of your account and all associated personal data. This action is irreversible.

Response Time

We will acknowledge your request within 48 hours and fulfil it within 30 days. If your request is particularly complex, we may extend this by up to two additional months and will notify you of the extension and reasons within the initial 30-day period.

All requests are free of charge. We may charge a reasonable fee or refuse to act on requests that are manifestly unfounded or excessive, in accordance with Article 12(5) GDPR.

4. Data Protection Officer

Our Data Protection Officer (DPO) oversees our compliance with data protection legislation. You can contact the DPO for any questions, concerns, or requests related to your personal data:

Email: dpo@vyrable.ai
Postal: Data Protection Officer, Vyrable, United Kingdom

5. Right to Lodge a Complaint

If you are unsatisfied with how we have handled your data or responded to your request, you have the right to lodge a complaint with a supervisory authority.

United Kingdom

Information Commissioner's Office (ICO)
Website: ico.org.uk
Helpline: 0303 123 1113
Live chat: ico.org.uk/global/contact-us/live-chat

European Union

If you are located in the EU, you have the right to complain to the supervisory authority in the EU Member State of your habitual residence, place of work, or the place of the alleged infringement. A list of EU data protection authorities is available at: edpb.europa.eu

6. Where Your Data Is Processed

Your personal data is primarily stored and processed in the United Kingdom and the European Economic Area (EEA). Our primary database is hosted in the EU (Frankfurt) and our application is served from EU edge locations.

Some of our sub-processors are based outside the UK/EEA (primarily in the United States). When data is transferred to these processors, we rely on Standard Contractual Clauses (SCCs), the UK International Data Transfer Agreement (IDTA), or adequacy decisions to ensure your data remains protected.

When you connect third-party platforms (such as LinkedIn, X/Twitter, or other social media services), your content may be transferred to and processed on servers in other jurisdictions in accordance with those platforms' own privacy policies.

For a full list of our sub-processors and their locations, see Section 7 of our Privacy Policy.

7. Legal Basis for Processing

We process your personal data under one or more of the following legal bases:

Legal BasisWhen We Use It
Consent (Art. 6(1)(a))Marketing emails, non-essential cookies (analytics, marketing), AI personalisation features
Contract (Art. 6(1)(b))Providing your account, processing subscriptions and payments, delivering the core Service
Legitimate Interest (Art. 6(1)(f))Service improvement, analytics, fraud prevention, security monitoring
Legal Obligation (Art. 6(1)(c))Tax and financial record-keeping, regulatory compliance, responding to lawful requests

Where we rely on legitimate interest, we have conducted a balancing test to ensure our interests do not override your fundamental rights and freedoms. You can request a copy of our legitimate interest assessments by contacting us.

8. Data Retention Periods

We retain your personal data only for as long as necessary for the purposes it was collected. The table below summarises our retention periods:

Data CategoryRetention Period
Account dataDuration of account + 30 days after deletion request
Generated contentDuration of account (deleted on account closure)
Payment records7 years (legal/tax obligation)
Server logs90 days
Analytics data26 months (anonymised after)
Support tickets3 years after resolution
Cookie consent records3 years (proof of consent)
AI interaction logs12 months (then anonymised)

After the retention period expires, data is either permanently deleted or fully anonymised so that it can no longer be linked to you.

9. Contact Us

If you have any questions about your GDPR rights or wish to exercise them, please contact us at:

General: hello@vyrable.ai
Data Protection Officer: dpo@vyrable.ai
Website: vyrable.ai