Privacy policy
Data controller
YBB SOLUTIONS, LLC, a limited liability company organised in the State of Florida, United States, with its address at 7345 W Sand Lake Road, Ste 210, Office 1877, Orlando, Florida, United States. To exercise your rights or ask anything about this policy: legal@verbalyx.ai.
Where your data is processed
The company is established in the United States and your data is processed principally there, as well as on our providers' infrastructure. If you live outside the US, this involves an international transfer of data; the safeguards we apply are set out below.
What we process and why
Account data (email address and, if you provide it, a name) to provide the service. Billing data, handled entirely by Stripe: we do not store card numbers. Usage metrics (word and request counts) to apply your plan's limits and detect abuse; IP addresses are always stored pseudonymised through a keyed hash, never in the clear. Product analytics with PostHog, which runs cookieless until you consent.
Your text
Text from anonymous users and the free plan is not stored: we keep only the word count. To produce the result, the text is sent to our AI provider (Anthropic) through its API and is not used to train models. Document history is an optional feature of the paid plans and is stored encrypted with AES-256-GCM; you can turn it off or delete it whenever you like.
Providers
We work with processors under contract: Supabase (database and authentication), Vercel (hosting), Stripe (payments), Anthropic (AI processing), Resend (transactional email), PostHog (analytics) and Sentry (error logging). We do not sell your personal data and do not share it with third parties for advertising.
Retention
We keep your account data for as long as the account exists. When you delete your account we delete your personal data and your documents; we retain only billing records for the period required by US tax and accounting rules, and aggregate metrics that cannot identify you.
Your rights
You can access, correct, export and delete your data. The quickest route is "My account", which includes deleting your account and your data. You can also write to legal@verbalyx.ai; we will respond within 30 days at most.
If you live in the EU, the EEA or the UK
The GDPR applies to you. Our legal bases are: performance of the contract (account, providing the service, plan limits and billing), legitimate interest (security, abuse prevention, and the two help emails we send in the first days to anyone who creates an account, about the service they signed up for and each carrying an unsubscribe link) and your consent (cookie analytics and advertising). You have the rights of access, rectification, erasure, objection, restriction and portability, and to withdraw consent at any time. Transfers of data to the United States rely on the European Commission's standard contractual clauses signed with our providers. You may lodge a complaint with your country's supervisory authority — in Spain, the Agencia Española de Protección de Datos (aepd.es). To exercise any of these rights: legal@verbalyx.ai.
If you live in California
The CCPA, as amended by the CPRA, applies to you. You have the right to know what categories of personal information we collect and why, to request its deletion, to correct it, to limit the use of sensitive personal information, and not to be treated differently for exercising these rights. We do not sell or share your personal information as the CCPA uses those terms, and that includes the information of anyone under 16. To exercise your rights: legal@verbalyx.ai.
Children
The service is not directed at children under 13 and we do not knowingly collect their data. If we identify an account belonging to a child under 13, we delete it along with its data. If you believe a child in your care has given us data, write to us and we will resolve it.
Changes
If we change this policy materially we will notify you by email or within the service before the change takes effect.
Last updated: October 13, 2026.