If you are in the European Economic Area or the United Kingdom, the GDPR gives you specific rights over your personal data. This page sets out how we meet those obligations and how to exercise those rights.
Last updated: August 2026
This statement explains how Vynex.ai complies with Regulation (EU) 2016/679, the General Data Protection Regulation, and with the UK GDPR as retained in UK law. It supplements our Privacy Policy, which describes in full what we collect and why.
It applies to visitors to vynex.ai, users of our free tools, clients of our services, and licence holders of the Vynex Studio desktop application.
For personal data collected through this website and our services, Vynex.ai is the data controller — meaning we decide what data is collected and for what purpose.
We have not appointed a statutory Data Protection Officer, as we do not meet the criteria in Article 37. Data protection enquiries are handled directly by our team at hello@vynex.ai.
Article 6 requires a lawful basis for every processing activity. Ours are as follows:
| Activity | Lawful Basis |
|---|---|
| Creating and maintaining your account | Contract performance — Art. 6(1)(b) |
| Delivering services you have engaged us for | Contract performance — Art. 6(1)(b) |
| Processing payments and issuing licences | Contract performance — Art. 6(1)(b) |
| Replying to a contact form enquiry | Legitimate interests — Art. 6(1)(f) |
| Keeping the platform secure and preventing abuse | Legitimate interests — Art. 6(1)(f) |
| Connecting your YouTube channel | Consent — Art. 6(1)(a) |
| Retaining invoices for tax and accounting | Legal obligation — Art. 6(1)(c) |
Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out beforehand. Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms, and you may object at any time.
We do not carry out automated decision-making or profiling that produces legal or similarly significant effects, and we do not process special category data.
Chapter III of the GDPR gives you the following rights:
You may ask whether we hold personal data about you and, if so, receive a copy along with details of why we process it, who we share it with and how long we keep it.
If anything we hold about you is inaccurate or incomplete, you may ask us to correct or complete it.
Often called the right to be forgotten. You may ask us to delete your data where it is no longer needed, where you withdraw consent, or where you object and we have no overriding legitimate grounds. We may retain the minimum necessary to satisfy a legal obligation, such as invoice records required by tax law.
You may ask us to pause processing — for example while we verify the accuracy of data you have contested.
Where processing is based on consent or contract and carried out by automated means, you may receive your data in a structured, commonly used, machine-readable format, or ask us to transmit it to another controller where technically feasible.
You may object to processing based on legitimate interests. You may object to direct marketing at any time, and we will stop without exception.
You have the right not to be subject to decisions based solely on automated processing that significantly affect you. We do not make such decisions.
Email hello@vynex.ai stating which right you wish to exercise. To protect your data we may ask you to verify your identity before we act, particularly for access or erasure requests.
Some providers we rely on operate outside the EEA and UK. Where personal data is transferred to such a country, we rely on an adequacy decision by the European Commission or UK government where one exists, and otherwise on Standard Contractual Clauses or the provider's participation in the EU–US Data Privacy Framework.
You may request further information about the safeguards applied to a specific transfer by contacting us.
We engage a small number of third parties who process personal data on our instructions under Article 28 agreements:
We do not sell, rent or trade personal data, and we do not share it with advertising networks or data brokers.
Article 25 requires data protection by design and by default. The clearest example on this site is our free tools.
The image compressor and watermark remover process your files entirely within your own browser. Your images are never transmitted to us, which means there is no copy on our servers to secure, retain, disclose or delete. The most reliable way to protect personal data is not to collect it in the first place.
Where a tool genuinely requires a server — retrieving a YouTube video or thumbnail cannot be done from the browser alone — we use the submitted link only to fulfil that request and do not build a profile from it.
If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the relevant supervisory authority within 72 hours of becoming aware of it, as required by Article 33.
Where the breach is likely to result in a high risk to you, we will also notify you directly and without undue delay, describing what happened and what you can do about it.
If you believe we have not handled your personal data properly, please contact us first so we can try to resolve it.
You also have the right to lodge a complaint with a supervisory authority — in the EEA, the authority in your country of residence, place of work or where the alleged infringement occurred; in the UK, the Information Commissioner's Office at ico.org.uk. Contacting us first is not a precondition for exercising that right.
For any data protection question or to exercise any right described above:
See also our Privacy Policy and Cookie Policy.
Book a free 30-minute strategy call. We'll review your goals and match you with the right services.
We reply within 4 hours · No spam, ever