What we hold,
and what we don't.
This is the human-readable privacy notice. The longer photo policy explains specifically what happens to your photograph. What follows covers everything else. Last updated 29 May 2026.
The minimum we need.
A photograph. The one you upload to compose the reading. Resized in your browser before it leaves your device. Erased within twenty-four hours.
The reading itself. The composed text and projected portrait, attached privately to your account. Stored so you can re-open it later from /enter.
A payment record. If you commission the Atlas, Stripe handles the card; we see only the success / failure status, the amount, the tier, and the shipping address (Edition tier only).
Standard request logs. IP, user-agent, request paths. Kept for 30 days for security and debugging. Never combined with the reading.
To compose the reading. Nothing else.
The photograph is used to compose the reading. The reading is stored so you can re-open it. The payment record is held for accounting and refund handling. Request logs are kept for security. That is the full list of purposes.
Vaesyn does not sell your data. Vaesyn does not buy your data. We run a Meta pixel and Google Analytics to measure and improve the advertising that brings people here and to understand how the site is used, and that is the extent of it. Your photograph is never shared with any advertiser or analytics provider, and the twenty-four-hour erasure remains absolute.
In one place, on Google Cloud.
All Vaesyn infrastructure runs inside a single Google Cloud project in the us-central1 region. Composing models are commercial APIs (OpenAI) whose terms prohibit training on submitted images. Payment is processed by Stripe. Outgoing transactional email is sent by Resend. Advertising measurement runs through Meta Platforms, Inc. Site analytics run through Google Analytics (Google LLC). That is the complete list of subprocessors.
As short as possible.
Photographs: erased within twenty-four hours.
Readings: stored until you ask us to delete them. You can see and delete every reading attached to your account at /me.
Payment records: held for seven years for US tax and financial-record retention. Otherwise deleted on request.
Request logs: 30 days, then rotated.
Read, export, delete, refuse.
You can request a copy of everything we hold about you, in machine-readable form. You can ask us to delete it all. You can ask us to stop processing it. The right is yours, regardless of where you live.
Write to the desk from the email on your account and we respond within seven days.
The session, the pixel, and the count.
We use a single first-party session cookie to keep you signed in to your membership.
We also run the Meta pixel, which sets a _fbp cookie. It is used only to measure our advertising: whether the ads that bring people to Vaesyn are working. It is not used to profile you, and your photograph is never attached to it.
Google Analytics sets _ga cookies to count visits and understand how the site is used. The same limits apply: no profiling, and your photograph is never attached to it.
Vaesyn is not for children.
Vaesyn is intended for readers sixteen and over. If we learn we have inadvertently composed a reading for a child under sixteen, we delete it immediately and refund any payment.
The atelier, plainly named.
Vaesyn is operated by the atelier behind it. For any question about how your data is handled, write to the desk. Postal address available on request.
One photograph, briefly seen. The reading is the object.