Privacy
Last updated 29 July 2026
Short version: we store your Google account details, what you ask us to build, and your conversations with the agents. We count how people move through the site, using no third-party trackers and no advertising cookies. We don't sell anything to anyone.
Who's responsible
ZincirX Information Technology and Advisory Inc., trading as VAI Company, Teknopark Izmir, 35400 Urla, Izmir, Turkey. For anything in this policy, email agents@vaicompany.com.
What we collect
Only what the service needs to work:
- Your Google account details. When you sign in we receive your Google account ID, email address, name and profile picture. We use the email to send you build updates and your preview link.
- What you ask us to build. Your project name, description, target audience, feature list and style choices.
- Your conversations with the agents. Messages you send to Aria, Milo, Luna, Rex, Celine, Kai and Nova, and their replies, so the chat still makes sense when you come back.
- What we build for you. The generated site, its source code, and the written record of what each agent decided.
- Request timestamps, used only to enforce rate limits so one account can't exhaust the service.
- Which steps of the site you reach. We record events like “viewed the landing page”, “started a brief” and “redeemed a licence” so we can see where people get stuck. These are stored on our own server and sent nowhere else — there is no Google Analytics, no advertising pixel, and no third-party script on this site. We don't record what you type, only that you reached a step.
- A campaign tag, if you arrived from a link that had one. The
utm_sourcestyle parameters some links carry, kept so we know which channels work.
Analytics uses the same browser-local id the app already needs to work — it does not set an extra cookie or store anything new on your device. To rate-limit that endpoint against abuse we keep a salted, truncated hash of your IP address for a minute; the address itself is never written down, and the salt is regenerated every time the server restarts, so the hash can't be used to recognise you later.
We do not collect payment card details. Those go directly to Lemon Squeezy, who take the payment on our behalf — see below.
Cookies
Two, both strictly necessary. There is no cookie banner because there is nothing optional to consent to — neither is used for analytics, profiling or advertising.
| Cookie | What it does | Lifetime |
|---|---|---|
vai_session | Keeps you signed in. A signed token identifying your account — HttpOnly, so page scripts can't read it. | 30 days |
vai_oauth_state | A one-time value that proves a Google sign-in came back from the same browser that started it. Protects against sign-in request forgery. | 10 minutes |
Our funnel analytics deliberately doesn't appear in this table: it sets no cookie of its own, reusing the browser-local id the app already needs. If we ever add something that does set a cookie you can decline, this table changes and you'll get a consent choice before anything is stored.
Who else processes your data
Building software with AI means your brief is sent to model providers. These are the only third parties involved, and this is exactly what each one sees:
| Who | What they do | What they see |
|---|---|---|
| Sign-in, and the Gemini models that plan, design and build your project | Your name, email address and profile picture at sign-in; your brief and project content when a build runs | |
| Anthropic | Claude models used for the design-polish and visual-QA passes | Your project's content and screenshots of the site being built |
| Lemon Squeezy | Merchant of record — takes the payment and issues your licence | Your billing details and email. Card data goes to them, never to us |
| Hostinger | The server this runs on, and outbound email | Everything stored by the service, and the email address we send to |
All four are outside Türkiye, so using this service necessarily involves transferring your data abroad — there is no version of an AI build service where your brief stays on one server in Izmir. By signing in and briefing a project you are consenting to that transfer. If you'd rather not, don't submit a brief, and email us to have your account removed.
How long we keep it
- Projects and generated sites — until you delete them. Deleting a project from your Projects page removes its database rows, its generated files and its live URL.
- Chat history — until you clear it, which you can do per-agent or all at once from the studio.
- Account details — until you ask us to delete your account.
- Rate-limit timestamps — pruned automatically; they hold no content.
Your rights
We're established in Türkiye, so Turkish data protection law (KVKK, Law No. 6698) governs how we handle your data. Under it you can ask whether we hold data about you, ask for a copy, have it corrected or erased, and object to decisions made about you purely by automated means. If you're in the UK or EU, the equivalent rights under your own law apply too — we treat every request the same way regardless of where you are.
Two of these you can do yourself right now: delete any project from your Projects page, and clear your chat history from the studio.
There is currently no self-serve button to delete your whole account. Email agents@vaicompany.com from your account address and we'll erase everything tied to it within 30 days. We'd rather tell you that than pretend a button exists.
Security
Traffic is encrypted in transit. Your session cookie is HttpOnly, so page scripts cannot read it. Access to the server is restricted to the operator.
We're a small operation and we won't pretend otherwise: we hold no security certifications. If you have a vulnerability to report, email agents@vaicompany.com and we'll respond.
Children
This service isn't intended for anyone under 16, and we don't knowingly collect their data.
Changes
If this policy changes materially we'll email account holders rather than quietly editing the page. The date at the top always reflects the current version.