Privacy Policy
What Kyronym collects, why it is needed, and the choices you have.
1. Who is responsible
Different Investments Ab Oy (Business ID 3247582-8), Infjärdsvägen 6 A 1, 65230 Vaasa, Finland. Contact: hello@kyronym.com. Different Investments Ab Oy is the data controller for Kyronym.
2. Data we process
- Projects: your brief, structured brand brief, anonymous project ID, naming runs, candidates, choices, tournament results, winner, domain checks and feedback.
- Technical and usage data: product events, timestamps, device/browser category, experiment variant, project ID and a pseudonymous visitor ID—but only after analytics consent. Raw briefs, prompts and email addresses are excluded from analytics events.
- Security and operations: rate-limit identifiers derived from IP addresses, configuration checks, error records and protected admin activity.
- Brand Kit: the selected winner, AI-prepared foundation, your edits, generation attempts, visual directions, selected direction, generated image concepts, Brand Reveal, canonical identity assets, package entitlements, immutable package manifests, download archives, progress and optional notes. Existing beta-interest records may also contain an email address and consent choice.
- Purchases: an opaque order reference, project and frozen identity version, price, currency, payment and refund status, Stripe Checkout, Payment Intent and Customer references where created, immediate-delivery consent, entitlement and download events. Stripe—not Kyronym—handles card and payment credentials. An email collected in Checkout is used for payment and receipt purposes and is not added to marketing lists.
- Affiliate activity: project/candidate reference, domain, TLD, registrar, placement and timestamp when you request a registrar redirect.
3. Why and legal basis
We process project data to provide the service you request (performance of a contract). We process necessary security, reliability, rate-limiting and limited operational records for our legitimate interests in protecting and operating Kyronym. Analytics, Google measurement and affiliate-network tracking require your consent where applicable. Brand Kit email is processed to provide the requested beta communication; you may withdraw at any time.
4. Storage and processors
Project, Brand Kit, order and operational records are stored in Cloudflare D1. Generated visual concepts, design review evidence, final assets and entitled Brand Identity archives are stored privately in Cloudflare R2, while D1 retains their project references, operational status and audit records. Cloudflare also hosts the application, runs the durable identity workflow and provides network services. Stripe hosts Checkout, processes payment details, supports receipts and returns verified payment, refund and dispute events to Kyronym. OpenAI processes the brief and related naming context during live naming. When you request visual directions, OpenAI receives the saved Brand Foundation, winner name and candidate reference needed to generate those concepts. After a direction is selected, language and image models receive the saved Foundation, selected direction, verified typography, color strategy and bounded project context to create visual identity concepts and support automated design review. Generated concept artwork is not delivered as a production asset. Kyronym’s engineering service reconstructs the approved design as an exact Primary vector logo and prepares its production exports. Optional responsive assets may be created internally, but they are not required or promised as part of the €49 product. Kyronym fails closed unless the Primary passes technical and independent commercial review. Deterministic package assembly does not send the finished package back to an AI model. Google Tag Manager and GA4 are loaded only after relevant consent and only when configured. Turnstile is used only when both production keys are configured. Dynadot and affiliate tracking are used only when relevant to a supported redirect and permitted by your choices; unsupported domain extensions may instead use a standards-based registry lookup without an affiliate link. Service providers may process data outside the EEA under their applicable transfer safeguards.
5. AI transparency
Kyronym uses language and image-generation models supplied by OpenAI to interpret briefs, create and assess candidates, draft recommendation reasoning and produce visual identity concepts. Outputs may be wrong, incomplete or unexpectedly similar to existing work. Visual concepts may require professional refinement before production or trademark use. API content is not used by OpenAI to train its models by default, but OpenAI may retain abuse-monitoring logs under its current API data controls. Demo mode is separately labelled and never presented as a personalized live run.
6. Retention
Kyronym does not yet run automated retention deletion. Projects, analytics, operator runs, admin/error records, affiliate records, Brand Kit foundations and earlier Brand Kit interests remain in D1 until manually deleted, no longer operationally needed, or deletion is requested, subject to legal obligations. This is the current practice—not a promise of indefinite storage. Shorter automated schedules are planned and will be published before they are enforced.
7. Cookies and local storage
Necessary storage preserves consent, project recovery and security. A secure HttpOnly purchase-access cookie binds a paid Brand Pack download to the browser that started Checkout; it is not used for advertising. Non-essential analytics and advertising storage is off by default. You can accept, reject or manage categories, and change them later. Rejecting non-essential storage does not block naming, Checkout or a purchased download.
8. Your rights
Depending on applicable law, you may request access, correction, deletion, restriction, objection and a portable copy of data you provided, withdraw consent, and complain to the Finnish Data Protection Ombudsman. Email hello@kyronym.com with the private project URL or ID. Because projects are anonymous, we may require evidence that you control that private link before disclosing or deleting it.
9. Children and sensitive information
Kyronym is not directed to children. Do not submit confidential third-party information, special-category personal data, credentials or regulated secrets in a brief.