Privacy Policy
Last updated 20 October 2026
Who is responsible
Desyn is the controller of the personal data described here for the hosted Service. Contact: hello@desyn.app. When a Pro customer uses Desyn for their organisation, we may act as their processor; see the data processing addendum.
What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Account: email, name, sign-in method, settings | To give you an account and keep it secure | Contract |
| Your Content: designs, uploads, generated assets, comments | To store, render, share and export your work | Contract |
| Billing: plan, invoices, Stripe customer id | To charge for Pro and keep records the law requires | Contract, legal obligation |
| Usage: credits used, AI runs, feature usage | To apply plan limits and fair use, and to improve Desyn | Contract, legitimate interest |
| Technical: IP address, device and browser, logs | To run, secure and debug the Service | Legitimate interest |
| Website analytics on desyn.app | To understand which pages help people | Consent (cookies), legitimate interest (cookieless counts) |
We do not sell personal data, we do not use Your Content to train AI models, and we do not show ads.
AI providers
When you use hosted AI features, the prompt and the parts of your design needed to answer it are sent to the model provider through OpenRouter (text) or Fal (images and video). If you add your own API keys or connect a local model, requests go to the provider or server you chose instead, under your agreement with them.
Who processes data for us
| Provider | Purpose |
|---|---|
| Hetzner Online | Server hosting for the application, database and render worker |
| Amazon Web Services (S3, SES) | File storage for uploads, assets and exports; transactional email |
| Stripe | Payments, invoices and the billing portal for Pro |
| OpenRouter | Routing AI text requests to model providers when you use hosted AI |
| Fal | Image and video generation and editing when you use hosted AI |
| PostHog (EU cloud) | Product analytics |
| DataFast | Website visit analytics on desyn.app, only after consent |
| Axiom | Operational logs and error monitoring |
Some of these providers may process data outside the European Economic Area. Where they do, we rely on safeguards such as the EU Standard Contractual Clauses.
How long we keep it
- Account and content: while your account exists, and up to 30 days after deletion.
- Billing records: as long as tax law requires (typically up to 10 years).
- Logs: up to 30 days. Analytics: up to 12 months.
Your rights
You can ask to access, correct, delete or export your personal data, object to or restrict processing, and withdraw consent at any time. Most of this you can do yourself in your account settings; for the rest, email hello@desyn.app. You can also complain to your local data protection authority.
Cookies
See the cookie page for every cookie and storage key, and to change your choice.