Privacy Policy

Last updated: 12 October 2026

This Privacy Policy explains how Mischyfs GmbH, as provider of the product Vrenni, processes personal data.

1. Controller

Mischyfs GmbH 8700 Küsnacht UID: CHE-249.880.415

2. Product

Vrenni is a collaborative AI workspace for individuals, teams, and organisations. Depending on use, users may create accounts, manage workspaces, invite members, conduct chats, upload files, connect services, and run AI-supported tasks and workflows. Vrenni includes the web service, native companion clients and a standalone macOS app with local workspaces and a choice of local or remote inference.

3. Roles under data protection law

When used directly by individuals, Mischyfs GmbH generally processes personal data as a controller.

When used by companies, organisations, or teams, the respective customer may be the controller for content, workspace data, member data, prompts, files, and outputs. Mischyfs GmbH then processes such data, where applicable, as a processor / commissioned processor under the AVV/DPA.

For its own purposes, in particular account administration, security, billing, contract administration, support, product operation, abuse prevention, and legal obligations, Mischyfs GmbH remains a controller.

4. Categories of personal data processed

Depending on use, we process in particular the following data:

• Contact data: name, email address, organisation, role, communication data.
• Account data: login data, authentication information, language, settings.
• Workspace data: organisation, workspaces, roles, members, permissions.
• Usage data: times, interactions, technical events, feature use.
• Content data: prompts, chat histories, files, inputs, outputs, agent configurations, and other content that users enter or upload in Vrenni.
• Optional local integration data: Apple Mail metadata, message content, calendar metadata, event details, and related tool results when a user enables the macOS Apple Mail or Apple Calendar integrations.
• Optional Google integration data: account identity, authorisations, mail, calendar and linked Drive attachment data as described in section 8.1.
• Support data: messages to support or contact addresses, problem descriptions, attachments, communication history.
• Payment and invoice data: plan, billing address, payment status, transaction information, where paid functions are used.
• Technical data: IP address, browser, device, operating system, referrer, log data, security events.
• Website and product analytics data: aggregated or pseudonymous usage information via Umami, e.g. page views, referrers, browser/device type, country-level statistics, and selected operational events.

5. Purposes of processing

We process personal data in particular for the following purposes:

1. providing, operating, and improving Vrenni;
2. creating and managing user accounts and workspaces;
3. authentication, role management, and access control;
4. performing AI functions within Vrenni;
5. storing and displaying chats, files, inputs, and outputs;
6. providing the local and cloud integrations and workflow triggers that a user enables;
7. inviting members and sending necessary service communications;
8. support, error analysis, and communication;
9. security, abuse prevention, fraud detection, and system stability;
10. billing and payment processing, where paid services are used;
11. fulfilling legal, regulatory, and contractual obligations;
12. website analytics and product statistics in aggregated or data-minimising form;
13. enforcing rights, contracts, and policies.

6. Legal bases

Where the GDPR applies, we rely on the following legal bases depending on the case:

• performance of a contract or pre-contractual measures;
• legitimate interests, in particular secure operation, product improvement, abuse prevention, support, and enforcement of rights;
• consent, where such consent is required;
• legal obligations;
• vital interests or public interests only in exceptional cases, where legally relevant.

Under Swiss data protection law, we process personal data in good faith, proportionately, for specified purposes, and transparently.

7. AI functions, inference infrastructure, and customer content

Vrenni-managed online AI functions use infrastructure including CSCS (Swiss National Supercomputing Centre) and Infomaniak Network SA. In the standalone macOS app, users can instead run a model on their Mac or select a remote inference service, including their own configured API provider or host. Remote inference receives the conversation context needed for the task, which can include retrieved integration content and file extracts. Local inference processes that context on the Mac. A local workspace alone does not mean local inference. Separately agreed enterprise deployments follow the applicable contract or order form.

Customer content is not used to develop, train, or improve general AI models unless this is expressly agreed in a separate contract or by separate consent. Inference infrastructure providers are not instructed to use customer content for their own model training.

AI outputs may be incomplete, inaccurate, outdated, or unsuitable. Users must review results before using them.

8. Optional native app integrations

Vrenni offers native companion clients and a standalone macOS app. The native apps do not contain payment or subscription checkout. The standalone app uses central sign-in and reports account, device and usage information for entitlement and accounting; that reporting does not synchronise local chats or workspace files to the existing website.

On macOS, users may optionally enable Apple Mail and Apple Calendar integrations through the app settings and macOS permissions. These integrations require the user's account/calendar selection and applicable access grants.

When a user enables an integration, Vrenni may process the local data needed for the selected tools, such as mail accounts, messages, message bodies, calendars, event metadata, event notes, and tool results. Write actions such as sending mail or creating, updating, or deleting calendar events follow the approval settings shown in the macOS app.

In older companion clients, an optional device-sharing bridge can route selected local tools and results through Vrenni's backend to other authorised sessions. The standalone macOS app instead executes personal integrations on the Mac: choosing a remote workspace does not grant its host access to the Mac or its integration credentials. Messages, assistant answers and files shared with that workspace are available to its host and authorised participants and can contain information derived from integrations.

8.1. Google integrations: Gmail, Google Calendar and Drive

Connecting Google is optional and separate from signing in to Vrenni. Google asks the user to authorise the requested permissions. Vrenni receives account identifiers, an email address and access/refresh tokens; it does not receive the user's Google password. Available actions depend on the client, permissions granted by Google, and the resources and tools enabled in Vrenni.

• Gmail: Vrenni can search and read messages and threads, including subjects, senders, recipients, timestamps, labels, message bodies and attachments. This supports user-requested search, summaries, replies, attachment import and email workflows. Sending includes the recipients, text and attachments selected for the task. The web connector can also request draft and mail-modification permissions; the standalone Mac connection requests read and send access.
• Google Calendar: Vrenni can read calendar lists, events and availability, including titles, descriptions, times, locations, organisers, attendees, recurrence, reminders, conference links and attachment references. Enabled tools can create, update or delete events and send the associated invitations or updates, subject to the applicable permissions and approval settings.
• Google Drive: the standalone app requests read-only Drive access to retrieve files attached to events in an authorised Google Calendar. It checks the event's attachment reference before downloading that file, and can export supported Google documents as PDF. The Google permission is broader than one file; Vrenni's current tool uses it for these calendar attachments, not a general Drive synchronisation or Drive writes.

For web integrations, Vrenni processes connector data on its servers and stores OAuth credentials encrypted. Enabled email/calendar triggers can receive change notifications and fetch the data needed for configured workflows in the background. Imported files, workflow inputs, outputs and execution records may be retained in the relevant workspace or service records.

In the standalone Mac app, Google credentials are stored in macOS Keychain and API requests are made from the Mac. Retrieved content, imported attachments and tool results can be saved in its local workspace. They can also enter the selected model's context: if that model is remote, the relevant content is transmitted to the selected provider, including through Vrenni's managed service where applicable. Sending email or invitations transmits content to Google and the specified recipients. Shared workspace content follows that workspace's access settings. Vrenni offline mode disables its cloud Google tools; Apple Mail/Calendar may still have locally available data and their own system synchronisation settings.

Google API data is used for the connected features described here, not sold, used for advertising or used to train or improve general-purpose AI models. This restriction includes derived data and overrides the general training-consent wording in section 7. Staff access is limited to specific user-authorised support, necessary security investigation or legal obligations. Vrenni's use and transfer of Google API information follows the Google API Services User Data Policy, including its Limited Use requirements.

Users can disconnect the relevant connection in Vrenni and remove Google's authorisation in Google Account connections. Disconnecting removes the credentials for that Vrenni connection; it does not automatically revoke other device connections or delete already imported files, chat content, outputs or workflow records. Remove stored content in the relevant workspace or request deletion at team@vrenni.ai. Server-held copies follow section 11; local files and device backups remain under the user's control. Revoking access or deleting Vrenni copies does not delete the original mail, events or files in Google.

With Gmail modification permission enabled, web workflows can, after explicit approval, add or remove existing user-defined labels on an ingested message, mark it read or unread, or archive it. Archiving only removes the inbox label; it does not delete the message. These actions do not change other messages and are not triggered merely by connecting an account.

9. Recipients and service providers

We may disclose personal data to service providers where this is necessary for operation, security, communication, analytics, or payment. Depending on use, plan, and deployment, this currently includes in particular:

• ETH Zurich, Swiss National Supercomputing Centre (CSCS), for Swiss hosting, compute, and inference infrastructure;
• Infomaniak Network SA for hosting, infrastructure, storage, and inference;
• Apple iCloud Mail/SMTP for sending and receiving team, support, and service emails, where used;
• Umami Cloud for cookieless website and product statistics without analysis of customer content;
• Stripe for optional payment processing, where paid payments are enabled or used;
• authorities, courts, advisers, or other recipients where required by law or necessary to enforce rights.

The current subprocessor list is available online.

10. International data transfers

We prefer processing in Switzerland and, where possible, in Europe. For service providers outside Switzerland, the EEA, or other countries with an adequate level of data protection, we ensure appropriate safeguards where legally required. These may include standard contractual clauses, adequacy decisions, recognised certification mechanisms, or other legally permitted safeguards.

11. Retention period

We store personal data only for as long as this is necessary for the respective purposes, legal retention obligations exist, claims may be asserted or defended, or consent exists.

The main standard periods are:

When a user requests account deletion in the product, active sessions are revoked immediately. If the account has no Business organisation, deletion generally happens immediately in active systems. If the account has a Business organisation, deletion is scheduled after a 7-day grace period; signing in before the scheduled deletion date cancels the deletion. Vrenni deletes the user's personal account data and data from workspaces and chats owned by that user in active systems. Content in workspaces or chats that the user does not own may be preserved for the relevant customer or other participants; the user's membership and direct account identifiers are removed or anonymised where technically possible. Legal, billing, security, and backup retention remain reserved as described above.

12. Security

We take appropriate technical and organisational measures to protect personal data. These measures include in particular access restrictions, role-based permissions, secure transmission, system monitoring, backups, confidentiality obligations, and service provider review, to the extent implemented in each case. Further security information may be provided to business customers on request or as part of personalised contract documentation.

13. Rights of data subjects

Data subjects may, under applicable law, request in particular access, rectification, deletion, restriction, disclosure/portability, objection, and withdrawal of consent.

Requests may be submitted through the website form or to team@vrenni.ai.

Where Vrenni processes personal data on behalf of a business customer, it may be necessary for us to refer the request to the respective customer or process it only according to that customer’s instructions.

14. Right to lodge a complaint

Data subjects may contact the competent data protection supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC). In the EEA, local data protection supervisory authorities may also be competent.

15. Children and young people

Vrenni is not directed at children under 16 years of age. Persons under 16 may not create an account. Persons under 18 may use Vrenni only with the consent of a parent or legal guardian. Administrators of enterprise workspaces must be at least 18 years old and authorised to represent the organisation.

16. Changes

We may amend this Privacy Policy if Vrenni, our processing activities, or legal requirements change. The current version will be published on the website.