Privacy Policy

This Privacy Policy applies to personal information processed through the Service. It does not apply to third party websites, applications, or services that are not operated by us, even if accessed through the Service, or to information processed by a Customer outside the Service, such as in their own separate systems.

Terms defined in our Terms of Service, such as "Customer", "Account", "AI Agent", "End Customer", "User Content", and "Customer Data", have the same meaning in this Privacy Policy. "Personal information" or "personal data" means information relating to an identified or identifiable individual, as defined more specifically under applicable data protection law.

We collect the categories of information described in this Section 2, either directly from you, automatically through your use of the Service, or from your End Customers as part of delivering the Service to you.

We use the information described in Section 2 to:

• Provide, operate, and maintain the Service, including your AI chat and voice agents, website builder, and CRM;
• Train, configure, and personalize your AI Agents based on your business data and knowledge base;
• Process and respond to conversations and calls on your behalf through your configured AI Agents;
• Calculate usage against your Plan allowances and process billing;
• Send you service notifications, account communications, and, where permitted, product updates;
• Monitor, analyze, and improve the performance, reliability, and security of the Service, using our own first party analytics;
• Detect, investigate, and prevent fraud, abuse, and security incidents;
• Comply with our legal obligations and enforce our Terms of Service.

We do not sell personal information, and we do not use third party advertising or marketing trackers on the Service.

We aim to collect and process only the information reasonably necessary for the purposes described above. Where a feature of the Service is optional, such as connecting a particular Connected Channel or uploading a document to your knowledge base, the associated data is only collected if and when you choose to use that feature.

This Section explains, at a general level, how personal information is processed through the AI functionality of the Service.

Where applicable data protection law, such as the General Data Protection Regulation, requires a legal basis for processing personal data, we rely on one or more of the following, depending on the specific processing activity: performance of a contract with you, such as providing the Service you have subscribed to; our legitimate interests, such as securing, maintaining, and improving the Service, provided those interests are not overridden by your rights and interests; compliance with a legal obligation; and, where applicable, consent, such as for certain optional cookies or marketing communications, which you may withdraw at any time as described in Section 16.

Where we process personal data on behalf of a Customer in connection with that Customer's use of the Service, the legal basis for that processing is generally established between the Customer and their End Customers, and the Customer is responsible for ensuring an appropriate legal basis exists, as described in Section 9.

We share information with the following categories of recipients:

• Subprocessors and service providers who support the Service, as described in Section 8, under contractual confidentiality and data protection obligations;
• Connected Channel providers such as Meta, to the extent necessary to send and receive messages through Instagram or WhatsApp that you have connected, once that integration is active in production as described in Section 8.2;
• Professional advisors, such as legal or accounting advisors, where necessary for a legitimate business purpose;
• Any party in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality protections and, where required by law, notice to affected individuals;
• Law enforcement, regulators, or other third parties where required by law, legal process, or to protect the rights, property, or safety of Vela, our customers, End Customers, or others.

We do not permit our subprocessors to use the personal information they process on our behalf for their own independent marketing purposes.

Depending on applicable law and the specific processing activity, the Customer may act as a controller or business, and Vela may act as a processor or service provider, with respect to personal data relating to the Customer's End Customers that is processed through the Service. Where this is the case, the Customer determines the purposes for which End Customer personal data is collected through their AI Agents and connected channels, and Vela processes that data to provide the Service as instructed by the Customer through their configuration and use of the Service.

This is a general description intended to help Customers understand the typical relationship, and it may not reflect the correct legal classification in every jurisdiction or for every processing activity. Customers who require a specific contractual data processing arrangement, such as a data processing addendum, should contact us at the address in Section 23.

As a Customer, you are responsible for providing your End Customers with any privacy notices required by applicable law regarding your use of Vela and your AI Agents to process their personal information, and for ensuring you have an appropriate legal basis to collect and process that information.

We use the following categories of third party subprocessors and service providers to deliver the Service. This table reflects a direct technical audit of our production configuration, not a general list of integrations that exist somewhere in our codebase. Some functionality is built and code complete but not yet processing real data in production because we have deliberately not activated the underlying credentials; those are listed separately in Section 8.2 rather than presented as active.

We may also engage additional service providers to support functions such as customer support, security monitoring, and infrastructure operations, each bound by contractual confidentiality and data protection obligations. Where the exact geographic processing location of a given provider is not stated above, this is because it depends on that provider's own infrastructure configuration, which may include multiple regions.

Vela is used by businesses worldwide, and our subprocessors may process and store data in countries other than your own, including the United States and countries within the European Union, depending on the provider. Where we or our subprocessors transfer personal data across borders from a jurisdiction that restricts such transfers, such as the European Economic Area, the United Kingdom, or Switzerland, we aim to rely on an appropriate transfer mechanism recognized under applicable data protection law, such as Standard Contractual Clauses, to the extent applicable to the relevant transfer.

We have not exhaustively mapped every subprocessor's specific data center locations in this Privacy Policy, since this can change based on the provider's own infrastructure. Customers who require detailed transfer information for a specific compliance purpose should contact us at the address in Section 23.

We retain personal information for as long as your Account is active and as needed to provide the Service. Following account closure or a verified deletion request, we work to delete or anonymize the relevant data within a reasonable period, except where we are required to retain it for legal, tax, accounting, dispute resolution, fraud prevention, or legitimate business record keeping purposes, in which case we retain only what is necessary for those purposes and for as long as required.

We do not currently publish a single fixed retention period applicable to every category of data, since the appropriate period depends on factors such as the type of data, the purpose for which it was collected, applicable legal record keeping requirements, and whether the data is needed to resolve an open dispute or security matter. As a general matter:

• Account and business information is retained for as long as the Account is active, and for a limited period after closure to allow for reactivation, dispute resolution, and legal compliance;
• Conversation history, call transcripts, and call summaries are retained for the period necessary to provide the relevant feature, such as ongoing conversation context and your ability to review historical records within the dashboard, after which they may be deleted or archived in accordance with our data retention practices;
• Billing records are retained for the period required by applicable tax and accounting law;
• Security and access logs are retained for a limited period sufficient to support security monitoring and incident investigation.

Where you have a specific retention requirement, such as a shorter deletion timeline for regulatory reasons, please contact us at the address in Section 23.

We use administrative, technical, and organizational measures designed to protect personal information processed through the Service, including:

• Encryption of data in transit between your browser or device and our servers;
• Row level security policies on our database that scope each Customer's access, and the access of our own application, to that Customer's own data, so that one Customer's data is not visible to another;
• Authentication safeguards for Account access, including support for third party sign in through Google in addition to email and password;
• Access controls that limit internal access to production data to personnel who require it to operate, secure, or support the Service;
• Fail closed verification on inbound webhooks from Connected Channel and voice providers, so that unverified or unauthenticated requests are rejected rather than processed;
• Ongoing monitoring for security vulnerabilities and dependency risks in the software that powers the Service.

You are responsible for the security of your own Account credentials, any API keys or integration tokens you generate, and the devices you use to access the Service, as described in our Terms of Service. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal data that requires notification under applicable law, we will notify you and any applicable regulator as required by that law, as further described in Section 18.

Depending on your location, you may have some or all of the following rights regarding your personal data. Where these rights apply, you may exercise them by contacting us using the details in Section 23 or, where available, through your account settings.

• Access, the right to request a copy of the personal data we hold about you;
• Correction, the right to request that we correct inaccurate or incomplete data;
• Deletion, the right to request deletion of your personal data, subject to certain legal exceptions described in Section 10;
• Export or portability, the right to receive your data in a portable, commonly used format;
• Objection, the right to object to certain processing of your data based on our legitimate interests;
• Restriction, the right to request that we limit how we use your data in certain circumstances;
• Withdrawal of consent, where processing is based on consent, the right to withdraw that consent at any time, without affecting the lawfulness of processing before withdrawal.

We will respond to verified requests within the timeframe required by applicable law. We may need to verify your identity before fulfilling certain requests, and we will not discriminate against you for exercising any of these rights.

Where you are an End Customer of a Vela Customer rather than a Vela account holder yourself, we recommend directing your request to the relevant business in the first instance, since they generally control the purposes for which your information is collected through their AI Agent, as described in Section 7. You may also contact us directly and we will coordinate with the relevant Customer as appropriate.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the rights described in Section 12 are provided in accordance with the General Data Protection Regulation and equivalent UK and Swiss data protection law. You also have the right to lodge a complaint with your local data protection supervisory authority. We do not represent that Vela holds any specific certification of compliance with these frameworks; our aim is to process personal data in a manner consistent with their requirements to the extent applicable to our processing activities.

If you are a California resident, you may have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, including the right to know what personal information we collect, use, and disclose, the right to request deletion, the right to correct inaccurate information, and the right to opt out of the sale or sharing of personal information and of certain targeted advertising. As noted in Section 3, we do not sell personal information and do not use third party advertising trackers.

If you are a resident of another U.S. state with a comprehensive privacy law, such as Virginia, Colorado, Connecticut, Utah, or others that may come into effect, you may have similar rights of access, correction, deletion, and portability, and a right to opt out of certain processing such as targeted advertising, which, as noted above, we do not conduct. You may exercise applicable rights by contacting us at the address in Section 23.

We use the following categories of cookies and similar technologies, such as browser local storage:

• Essential or strictly necessary technologies, required for core functionality such as keeping you signed in and maintaining session security through our authentication provider;
• Preference technologies, which remember settings such as your light or dark mode selection and language preference, some of which are stored using browser local storage rather than a cookie;
• First party analytics technologies, which help us understand how the Service is used, based on our own internal usage tracking rather than a third party advertising or analytics network.

We do not use third party advertising, marketing, or cross site tracking cookies anywhere in the Service. A complete, itemized list of every cookie and local storage key we use, what each one does, and why no cookie consent banner currently appears on the Service, is available in our Cookie Policy at /cookies. Most browsers allow you to control cookies and local storage through their settings, including blocking or deleting them; disabling the essential authentication cookie will affect your ability to sign in and use core features of the Service.

We may send you account related communications, such as service notifications, security alerts, and billing notices, which are necessary to the Service and cannot be opted out of while you maintain an Account. We may also send product updates or other marketing communications, which you can opt out of using the unsubscribe mechanism in the relevant message or by contacting us at the address in Section 23.

In addition to the rights described in Section 12, the Service itself provides a number of practical, self service controls over your data and how your AI Agents operate:

• You can disconnect Instagram or WhatsApp from your Account at any time from the Channels page, which stops new messages from that channel from being processed once that integration is active in production as described in Section 8.2;
• Where you build a website with the Service, you can choose whether an AI chat widget is added to it during the build process, and you can turn the AI Agent on or off for a published website at any time from the Channels page;
• You can review, edit, or remove your knowledge base content, including business information, services, and frequently asked questions, from the Train Your AI section of your dashboard at any time, and changes take effect for future conversations;
• You can export appointment records as a CSV file from the Appointments page;
• You can review conversation history, call transcripts, and call summaries from the Conversations and Calls sections of your dashboard;
• You can request export or deletion of other categories of User Content or Customer Data, and closure of your Account, by contacting us as described in Section 23.

These controls apply at the Account level. Where an End Customer wants a specific message, call record, or lead entry corrected or removed, the Customer who operates the relevant AI Agent is generally best placed to action that request directly within their dashboard, since they control the underlying record.

If we become aware of a security incident involving unauthorized access to or disclosure of personal data that requires notification under applicable law, we will notify affected Customers and, where required, individuals and regulators, without undue delay and in accordance with the timeframes required by applicable law. Notifications will include information reasonably available to us about the nature of the incident and recommended steps, to the extent known at the time of notification.

The Service may contain links to, or integrations with, third party websites or services that are not operated by us, including the Connected Channels described in Section 8. This Privacy Policy does not apply to those third party websites or services, and we encourage you to review their own privacy policies.

The Service is intended for business use, and, consistent with our Terms of Service, an Account may only be created by an individual who is at least 18 years old. We do not knowingly collect personal data from individuals under the age of 16 in connection with Account registration, and we do not intentionally direct the Service at children.

Where an End Customer interacts with a Customer's AI Agent, for example by messaging a business's website chat widget, we do not knowingly and intentionally collect personal data from a child through that interaction in a manner inconsistent with applicable law, and Customers are responsible for ensuring their own use of AI Agents to interact with the public complies with applicable child privacy laws relevant to their business and audience. If we become aware that we have collected personal data from a child in a manner inconsistent with applicable law, we will take steps to delete that information.

Some browsers offer a "Do Not Track" signal or similar privacy preference signal. Because there is not yet a common industry standard for how to interpret these signals, the Service does not currently respond to them differently than described elsewhere in this Privacy Policy. As noted in Section 15, we do not use third party advertising trackers regardless of this setting.

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, provide additional notice, such as an email or an in product notification. We encourage you to review this Privacy Policy periodically.

For privacy related questions, to exercise any of the rights described in this Privacy Policy, or to request a data processing addendum, contact us at velaOsSupport@gmail.com. This is currently our general customer support contact and handles privacy related questions as well, since a dedicated privacy inbox has not yet been established.

Vela currently operates from Germany. As of the date of this Privacy Policy, Vela is not incorporated as a separate legal entity and does not have a registered business address to publish. We are not going to display a placeholder company name or address here, or invent one, in place of that real information. Once Vela is incorporated, this section will be updated with the operating entity's legal name and registered business address.