Privacy Policy

1. Scope and Data Controller

Vinyü is a digital wellness platform for yoga, meditation, breathwork, restorative, sound therapy, and related practices. This policy covers data processing performed through our public domain, the web app, and the connected services we use to authenticate users, host profiles, process bookings, and facilitate live or on-demand sessions.

Vinyü is currently in a beta or pilot stage. Some features, integrations, booking flows, payment methods, or instructor tools may change while we stabilize the service.

If you use Vinyü as a student or instructor, you agree that we process your data in accordance with this document and the settings you choose within the app. If you do not agree, please stop using the service.

2. Applicable Legal Framework in Chile

Personal data processing at Vinyü is governed by applicable Chilean law. As of this publication, the primary reference is Law No. 19,628 on protection of private life. We also draft this document in view of Law No. 21,719, which creates the Personal Data Protection Agency and modernizes the regulatory framework, with general entry into force scheduled for December 1, 2026.

Some provisions of this document therefore explain both currently enforceable rights and the enhanced standards Vinyü aims to adopt progressively before the new framework takes effect.

3. Data We May Collect

• Account and access data: name, email address, user ID, authentication provider, profile photo, and basic data you authorize when signing in with Google.
• Profile data: public name, bio, photo, platform role, language, and other preferences tied to your experience.
• Service usage data: classes viewed or booked, library purchases, reviews, ratings, access history, and actions required to maintain the session and product functionality.
• Payment and booking data: payer email, payment identifiers, payment status, amount, payment method, commissions, and records tied to bookings or refunds. Vinyü does not store full card numbers in its own database.
• Live session and audiovisual data: display name in the room, associated room, camera or microphone permissions, and minimal technical data needed to connect to video services. If you play embedded content, the player provider may receive technical data such as your IP and browser information.
• Instructor or application data: when you activate or prepare instructor mode, we may process your name, bio, academy or school, payout details, and verification history. Some drafts may be stored locally on your device while you complete the process.
• Technical and security data: approximate IP address, browser, device, error logs, session tokens, and data needed to prevent abuse, fraud, unauthorized access, or security incidents.

4. Purposes and Legal Bases for Processing

We process your data only for specific purposes related to the operation of Vinyü. These include creating and managing your account, authentication, booking and delivering classes, accessing purchased content, payment management, support, and platform security.

Depending on the nature of each operation, processing may rely on your consent, the execution of a contractual or pre-contractual relationship with you, legal or regulatory obligations, or legitimate interests in security, operational continuity, and fraud prevention—always within the limits authorized by applicable Chilean law.

5. How We Use Your Information

• Create and manage your account, authenticate you, and keep your session active.
• Enable bookings, purchases, confirmations, library access, and attendance at live sessions.
• Display your profile, preferences, and—where applicable—public instructor profiles and reviews.
• Process payments, internal reconciliations, refunds, payment releases, and fraud prevention.
• Provide support, resolve incidents, moderate abusive behavior, and enforce our Terms.
• Improve the stability, security, accessibility, content, and overall functioning of the platform.

6. Processors and Third Parties

To operate Vinyü we use specialized providers that process data on our behalf or within the flow you activate when using the app. These may include authentication and database services like Supabase, identity providers like Google, hosting and infrastructure like Vercel, payment gateways like MercadoPago, and video or real-time services like Twilio.

We may also use third-party players for on-demand content. When you access that content or initiate a payment, the relevant provider processes certain information under its own policies and terms.

Some of these providers may operate infrastructure or storage outside Chile. In those cases, we seek to use recognized providers and reasonable contractual or operational measures to safeguard information, without prejudice to the risks inherent in digital services delivered via distributed infrastructure.

• We only share data with third parties when necessary to provide the service, comply with legal obligations, respond to valid requests, or protect rights, security, and operational continuity.
• We do not sell your personal data to third parties as a business model.

7. Google Sign-In and Google Data

If you choose to sign in with Google, Vinyü receives only the data that Google and your consent settings allow for authentication and account setup—typically name, email, and profile photo. We use that information to identify you, complete your basic profile, and facilitate access to bookings, library, and sessions.

We do not use data obtained via Google Sign-In for purposes unrelated to your account access, nor do we sell it to third parties. If we request additional permissions in the future, we will update this policy and the corresponding consent flow.

8. Locally Stored Data

Some preferences and usage drafts may be saved in your browser or device to improve your experience—for example, language, visual theme, enabled payment settings, temporary instructor onboarding data, or local purchase states.

In particular, your language preference is saved in both browser local storage and a functional cookie called vinyu_lang. This cookie is necessary so that server-rendered pages—such as legal documents—can be displayed in your chosen language without requiring you to be signed in. It has a maximum duration of 12 months and is not used for advertising or tracking purposes.

This local data helps maintain continuity of use but does not replace official service records when a booking, payment, or authenticated access is involved.

9. Data Retention

We retain information for as long as necessary to operate Vinyü, fulfill contractual and legal obligations, resolve disputes, prevent fraud, and maintain accounting and security records. The specific period depends on the type of data and the role with which you use the platform.

When data is no longer needed, we aim to delete, anonymize, or isolate it as technically appropriate and in accordance with applicable law.

10. Your Rights as a Data Subject

Under currently applicable Law No. 19,628, you may request information about your data, its origin, recipients, and purposes; ask for correction if it is erroneous, inaccurate, misleading, or incomplete; and request deletion or blocking in cases provided by law—for example, if it lacks a legal basis, has expired, or you no longer wish to receive commercial communications.

Additionally, in view of Law No. 21,719 entering into force on December 1, 2026, Vinyü recognizes the enhanced rights of access, rectification, erasure, opposition, portability, and blocking as the applicable standard, under the terms and limits established by law at the time of the request.

• You can update some of your information from your profile or account settings.
• You can exercise your rights by writing to our contact email, clearly stating your request and sufficient identification details to verify your ownership.
• If you signed in with Google, you can also manage permissions from your Google account.
• We do not charge for ordinary rights-exercise requests where Chilean law requires them to be free.

11. Sensitive Data, Wellness, and Minors

Vinyü is a wellness and movement platform, not a medical service. We do not ask for clinical records or sensitive health data as a regular condition of use. Please do not include medical history, mental health, sexual life, beliefs, or other sensitive data in public fields such as bios, reviews, or open messages, unless strictly necessary and done under your own responsibility.

If through a support request or security incident you share sensitive data, we will aim to treat it in a restricted manner and only for the purpose that justifies its handling, in accordance with applicable law.

The service is not deliberately directed at minors without valid supervision or authorization. If we detect improper processing of minors' data or unauthorized account use, we may restrict access and take reasonable corrective measures.

12. Security and Incidents

We adopt reasonable technical and organizational security measures to protect information, but no internet-connected system can guarantee absolute security. We recommend using a strong password, protecting your devices, and logging out on shared devices.

If we detect an incident that compromises the security of your data, we will evaluate the mitigation, support, and communication measures appropriate to the severity of the situation and the law applicable at the time of the incident.

13. Marketing and Communications

We will not use your data for direct marketing beyond what is necessary for the operation of the service, unless there is a sufficient legal basis or your consent where required. You can always request the cessation of promotional or direct marketing communications.

14. Changes to This Policy

We may update this Privacy Policy to reflect changes in the product, our providers, or applicable law. We will publish the current version at this same URL and indicate the update date. If the change materially affects how we process your data, we will aim to notify you through reasonable means within the platform or using available contact details.