Privacy policy

1. Who we are and what this policy covers

This site and the service are run by VRIZ ("we", "us"); the data controller is identified in section 14. For anything related to your personal data, write to us at privacy@vriz.io.

We process data in accordance with Law 172-13 on the Protection of Personal Data of the Dominican Republic and, where applicable, the rules of the country you use us from. This policy covers three different situations:

• If you visit this site or write to us through its form.
• If you are a customer: your account, your site and your use of the service.
• If you visit one of our customers' sites or send it a booking or a request. In that case the business is responsible for your data, and we process it on its behalf (section 8).

2. What data we collect

If you visit this site

• Contact form: name, business name, email address, WhatsApp number (if you give it), type of business, plan of interest and the message you write.
• Sample website form: your website link or your Instagram profile. By sending it you agree that we visit that website or profile to extract its public content, for the sole purpose of preparing your sample website, and that we send it to you through the contact details it lists.
• Minimal technical request data: the address of the page you sent the form from, your browser identifier (user agent) and, if you arrived from an ad, the name of its campaign. We do not record your IP address alongside the form.
• Appearance preference: your choice of light or dark mode is stored in your browser's local storage. It never leaves your device.
• Anonymous Learn feedback: the vote, the reason you choose, the optional text you write, the language, the article path and a random session identifier. We do not ask for an email address or link it to your IP address or to the contact form.

If you are a customer

• Your account data: email address, name, phone, business name, legal name (if you give it), what you need your site to do, business description, country and site language. And those of the people you invite to your team.
• Your site's content: the copy, photos, videos and documents you upload, and the business details that get published (address, hours, prices, social profiles).
• Your conversations with the assistant, including the files you send it.
• Service usage data: your site's versions, the design changes you request and your assistant usage against your plan's limits.
• Billing data: payment details are collected and processed by Paddle, our merchant of record (section 7). We receive your subscription status, plan, country and amounts — never your card details.
• A session cookie on the portal (vriz.app) to keep you signed in. It is essential to the service.

If you visit a customer's site

• Cookieless visit statistics: the page viewed, the page you came from and the browser type. We do not record your IP address or identify you. If the site uses Google Fonts typefaces or embeds videos or maps, your browser connects to those services (see the cookie policy).
• What you send through its forms: bookings, waitlist, event sign-ups, requests or a newsletter subscription (usually name, email, phone and any notes you write).
• If you subscribe to its newsletter, that business will send you notices by email through VRIZ. Every notice carries an unsubscribe link, and from then on you receive no more.

We do not collect identity documents or special categories of personal data, unless a customer asks for them in its forms; in that case the customer is responsible for having a legal basis to do so.

3. What we use it for

• Replying to your request and, where appropriate, preparing a proposal or a demo.
• Building, publishing and maintaining your site, and running the assistant.
• Charging for the service through Paddle.
• Sending you service emails: sign-in links, trial and subscription notices, and support replies.
• Protecting the service against abuse and fraud.
• Understanding which Learn articles are useful.
• Meeting legal, tax and accounting obligations.

We do not sell your data, we do not pass it to third parties for commercial purposes and we do not use it for advertising. Nor will we send you marketing you have not asked for.

4. Our legal basis

We process your data because you give it to us so that we can contact you (your consent), because it is necessary to perform the contract if you are a customer, because we have a legitimate interest in keeping the service secure, and because in some cases the law requires us to keep it.

5. Artificial intelligence and your data

So that the assistant can understand what you ask for and design your site, we send artificial intelligence providers the conversation, your business information, the files you attach and your site's content and code. They process it to return a response.

• We do not send them your payment details or the data your forms capture (bookings, contacts, subscribers, requests). If you ask the assistant for an operation on your modules — sending a notice, closing a day, publishing an event — it only gives the order: your customers' data never passes through the model.
• Design changes are prepared in an isolated environment, with no access to the internet or to our databases, which is destroyed at the end of each job.
• Nothing the AI prepares goes live until you approve it.

6. How long we keep it

• Requests that do not lead to a contract: up to 24 months from the last contact.
• Anonymous Learn feedback: up to 24 months from the last update to the response.
• Visit statistics: up to 3 months.
• Account, content and conversations: for as long as the contract lasts. If your site is paused at the end of the trial, we keep your content for 30 days. When the contract ends we keep it for up to 60 days so you can request your copy, and then we delete it.
• Billing data: for the period required by the applicable tax and accounting obligations.
• Data captured by a customer's forms: the customer decides; it is deleted with the customer's account.

You can ask us to delete your data sooner at any time, except what the law requires us to keep.

7. Who we share it with

Only with the providers needed to deliver the service:

Provider	Country	What for
Cloudflare, Inc.	United States	Hosting, content delivery network, databases, file storage, visit statistics, and the isolated environment where sites are designed.
OpenAI	United States	The model behind the assistant you talk to.
DeepSeek	China	The model that prepares design changes to your site. It only receives what is needed to design: the site's content and code, which are public, and your business description. Never booking, contact, form or payment data.
Amazon Web Services, Inc. (Amazon SES)	United States	Sending the service's emails and the notices customers send to their subscribers.
Paddle.com Market Limited	United Kingdom	Payment, invoicing, taxes and refunds.

Cloudflare, OpenAI, DeepSeek and Amazon Web Services act as data processors: they process data on our instructions and to deliver the service. Paddle is the merchant of record for our sales and processes payment data as an independent controller, under its privacy policy.

These providers are outside the Dominican Republic, so your data is transferred to the United States, the United Kingdom and, for design data only, China. We only work with providers who commit by contract to protect the data they receive.

We may also disclose data to an authority when the law requires it.

8. Data about your site's visitors

When your site collects data from your customers — a booking, a sign-up, a request — you are the controller of that data and we process it on your behalf: we store it, send it to your email or show it to you in your inbox, depending on your plan, and hand it over when you ask. We do not use it for any other purpose and do not send it to artificial intelligence providers. The terms of that processing are set out in the data processing agreement.

As the controller, it is up to you to tell your visitors how you process their data and to handle their requests. If a visitor to your site writes to us, we will pass it on to you and help you respond.

9. Your rights

You can ask us at any time for:

• Access — a copy of the data we hold about you.
• Rectification — that we correct anything wrong or incomplete.
• Erasure — that we delete it, where there is no legal obligation to keep it.
• Objection and restriction — that we stop processing it or limit its use.
• Portability — that we hand it over in a reusable format.
• Withdrawal of consent — at any time, without affecting what was processed before.

Write to privacy@vriz.io. We reply within 30 calendar days at most.

10. Security

Everything is served encrypted (HTTPS). You sign in to the portal with a link we email you, with no passwords that could leak. Access to data is restricted to the people who need to process it, and each site only sees its own data. No system is infallible: if a breach affecting your data ever occurs, we will tell you.

11. Cookies

This site does not use tracking or advertising cookies, and visit statistics on customer sites work without cookies. The portal uses one essential session cookie. The details are in the cookie policy.

12. Minors

This service is aimed at businesses and professionals. We do not knowingly collect data from anyone under 18. If you find that a minor has given us data, write to us and we will delete it.

13. Changes to this policy

If we change this policy, we will update the date shown at the top of the document. If the change is substantial and affects active customers, we will tell them by email.

14. Data controller

The controller of the data on this site and in the service is Alfonso Miguel Evangelista Concepción, trading as VRIZ, based in Santo Domingo, Dominican Republic. Contact: privacy@vriz.io.