Vasara

GDPR overview

Compliance is claimed explicitly and repeatedly. The privacy policy, updated 23 January 2026, names Sunny Ventures, entity code 307543731, Pilies g. 16 in Vilnius, as controller, cites Article 15 GDPR for the right of access, and lists the rights to information, access, erasure, rectification, objection, portability, withdrawal of consent and complaint, with a link to the EDPB list of supervisory authorities. Requests are handled within 30 calendar days, extendable by two months for complex cases, and proof of identity may be required. The connector documentation adds that Vasara operates with GDPR and the EU AI Act in mind. No data protection officer is named. No Article 27 representative is designated, and none is needed, the company being established in Lithuania.

Who owns the data?

Under the terms of service, the Vasara platform and its software, design, databases, algorithms and models, together with all related intellectual property, belong exclusively to Sunny Ventures UAB. Users receive a non-exclusive, non-transferable right to use the output they generate, whether answers, documents or summaries, for personal and professional purposes while the terms remain in force. That right does not extend to reselling it, sub-licensing it, or using it to build a competing product or service. Sunny Ventures acts as controller for personal data. Nothing in the published documents transfers ownership of uploaded files to the vendor, although the vendor states that it can access an account as administrator to correct errors.

Reuse rights

Users may reuse what Vasara produces for their own professional work without asking permission: the licence is granted by the terms themselves. Because it is non-exclusive and non-transferable, output cannot be resold, sub-licensed, or used to build a competing product. On the vendor's side, account, usage and device data are processed on the basis of consent and of legal obligations, and may be disclosed to suppliers and service providers such as payment processors, to authorities, to business partners and shareholders bound by equivalent standards, and to the other party in a merger or acquisition. Inputs, queries and uploaded documents are never used to train or fine-tune models, an undertaking the vendor also requires from its model and infrastructure suppliers. No individual sub-processor is named anywhere.

Data retention & training

Hosting summary

The product pages state that all data is processed exclusively within the European Union, in full compliance with the GDPR, and is not transferred to third countries. The connector documentation repeats that user requests are processed within the EU. The privacy policy is more guarded: it says data is stored and processed in the EU and the EEA, but that transfer and storage outside those areas may sometimes be necessary, and that processors operating outside them may be involved, with a commitment to transfer only what is needed and to apply reasonable safeguards. This is a genuine discrepancy between the marketing pages and the binding policy, and it is worth raising before sensitive material is uploaded. No country, data centre or hosting provider is named anywhere. The technical measures disclosed are encryption at rest and in transit, detailed audit logs, and role-based access control. The domain itself resolves to a Cloudflare anycast address in the United States, which reflects the content delivery edge and says nothing about where data is stored.