Privacy Notice
Last updated: 22 September 2026
This notice explains what personal data VUNIVA collects, why, and what you can do about it. It is written to match what the software actually does — the retention periods below are the ones enforced in code.
1. Who we are
Xigi Ltd ("we", "us") is the controller of the personal data described here.
| Company | Xigi Ltd |
| Registered number | 10261356 |
| Registered office | Hova House, 1 Hova Villas, Brighton & Hove, BN3 3DH, United Kingdom |
| Service | VUNIVA — https://vunivastudio.xigi.uk |
| General contact | vuniva@xigi.uk |
| Data protection contact | vuniva@xigi.uk |
We are not required to appoint a Data Protection Officer, and have not appointed one. Data protection enquiries go to the address above.
2. What we collect
2.1 Account data
Your email address, your name if you give one, and a hashed password. We never store your password itself.
If you sign in with Google, Apple or Facebook, we receive your email address and name from that provider. We do not receive your password.
2.2 Your projects
The apps you design: screen layouts, data models, settings. We store these so you can come back to them, and so we can generate code from them.
The apps you build are yours. We do not use their contents to train models, and we do not share them.
2.3 AI assistant requests
If you use the AI assistant, we store what you asked and what the model answered, together with the model name, token counts and duration.
Why: so we can find out what went wrong when it goes wrong. A failed request without its content cannot be debugged.
How long: 30 days, then deleted automatically.
Who can see it: our platform administrators, for support and debugging. Not other customers.
2.4 Activity log
Who did what, and when: created an app, delivered code, started a build, signed in. It records the action, not the content.
How long: 365 days.
Why longer: a security question ("who deleted this, and when?") can surface months later. This log contains no project content, so keeping it is low-risk and high-value.
2.5 Usage accounting
Token counts per request, for quota and billing. Numbers only — no content.
How long: kept while your account exists, because it underpins billing.
2.6 Access tokens for your own services
If you connect GitHub, GitLab, Expo or a database provider, we store the token you give us encrypted (AES-256-GCM, with key rotation support). Encrypted tokens are never sent back to your browser, and never shown in full.
You can remove them at any time in the Studio.
2.7 Technical data
IP address and browser details appear in our server logs, which we keep for a short period for security and troubleshooting.
2.8 Payment data
We never see your card details. Payment is handled by Stripe. We store only your subscription status, the plan, and Stripe's identifier for the subscription.
3. Why we are allowed to (legal bases)
| Purpose | Legal basis |
|---|---|
| Providing the service you signed up for | Contract (Art. 6(1)(b)) |
| Billing and collecting payment | Contract |
| Debugging, abuse prevention, service security | Legitimate interests (Art. 6(1)(f)) |
| Keeping the activity log | Legitimate interests |
| Meeting tax and accounting obligations | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, we have weighed them against your rights. The AI request log is the clearest example: it contains your work, so we keep it only 30 days, restrict access to platform administrators, and log that access.
We do not use your data for advertising, and we do not sell it.
4. Who else processes it
These are our processors. Each acts on our instructions under a data processing agreement.
| Processor | What for | Where |
|---|---|---|
| Stripe | payments and subscriptions | EU / US |
| Expo (EAS) | app builds you start | US |
| GitHub / GitLab | delivery of your generated code | depends on your account |
[TÁRHELYSZOLGÁLTATÓ] | hosting the service | [RÉGIÓ] |
Your app's own data is not ours. If your generated app stores data in your Supabase or Firebase account, that data never reaches us — you are the controller of it, and your relationship is with that provider.
International transfers
Where a processor is outside the UK/EEA, transfers rely on the UK International Data Transfer Addendum or EU Standard Contractual Clauses, as applicable.
5. How long we keep things
| Data | Retention |
|---|---|
| Account | while your account exists |
| Projects and revisions | while your account exists |
| AI request content | 30 days |
| Activity log | 365 days |
| Usage accounting | while your account exists |
| Access tokens | until you remove them, or the account is deleted |
| Billing records | as required by tax law (typically 6–7 years) |
When you delete your account, we delete your projects and personal data, except records we must keep for accounting. The code we already delivered to your repository stays there — it is yours, and we could not remove it even if we wanted to.
6. Your rights
Under UK GDPR and EU GDPR you can ask us to:
- access the personal data we hold about you
- correct it if it is wrong
- delete it ("right to erasure")
- restrict or object to processing based on legitimate interests
- port it — receive it in a machine-readable format
Exercising these costs nothing, and we answer within one month. Write to vuniva@xigi.uk.
If you are unhappy with our answer, you can complain to a supervisory authority: in the UK the Information Commissioner's Office (ico.org.uk); in the EU, the authority in your country of residence.
7. Security
- Passwords are hashed; we cannot read them.
- Your access tokens are encrypted at rest and never returned to the browser.
- The database roles are separated: the part of the system that reads your plan cannot change it.
- Backups run daily and are restored as a drill, not only in an emergency.
- Administrator access to AI request content is limited and logged.
No system is perfectly secure. If we discover a breach that is likely to affect your rights, we will tell you and the regulator as required.
8. Children
VUNIVA is not intended for children under 16. We do not knowingly collect their data.
9. Changes
If we change how we handle your data, we update this notice and change the date at the top. For significant changes we tell you by email before they take effect.