Your data stays yours.

We work with four kinds of data, and we treat them very differently — the distinctions in this notice exist because a customer's connected revenue data deserves far stricter handling than, say, the email you leave on a waitlist form.

• Connected business data. When a customer connects their tools (Shopify, Meta, Stripe, Recharge, Google Ads, Klaviyo), we read their orders, customers, products, ad spend, subscriptions and related records, read-only, to build their revenue intelligence. We process this on the customer's behalf, as their processor — never as if it were our own.
• Account and authentication data. When you have a Velur account, we hold your name, work email, and the credentials needed to sign you in — see Section 3, "Accounts and authentication," for exactly how that works and who handles it.
• Website and prospect data. The email (and any name or message) you enter in a waitlist or contact form, plus basic, privacy-first analytics about how the site is used — pages visited, referring source, device type. No cross-site advertising identifiers.
• Support and communications data. If you email us or we correspond about your account, we keep that thread so we can help you and anyone who picks up the conversation later.

We use data only for clear purposes, each with a lawful basis under the GDPR:

• To provide the service (model your data, write your daily brief, keep you signed in): performance of a contract.
• To secure and improve the product (debugging, abuse prevention, detecting unauthorised access, reliability): legitimate interests, balanced against your right to privacy.
• To contact waitlist signups, respond to enquiries, and send service messages: consent (for marketing) or legitimate interests (for operational messages you'd reasonably expect).
• To meet legal and tax obligations (invoicing records, responding to lawful requests): legal obligation.

We never sell your data, we never use it to train shared or third-party AI models, and we never use your connected business data for anything beyond generating your own brief.

Because Velur is now a live product with real sign-in, this section says plainly how that works. Authentication runs on Supabase Auth (part of our EU-hosted Supabase infrastructure, also named in Section 6). We do not use Auth0 or any other third-party identity provider — Supabase is the only system that ever touches your password.

• Passwords are never stored in plain text. Supabase Auth hashes and salts every password before it reaches storage, and Velur's own systems never see or log the raw value.
• Session cookies. Signing in sets a small number of first-party, essential cookies that keep you logged in as you move between pages. These are strictly necessary for the product to function — they are not used for advertising or cross-site tracking, and (per Section 8) they don't require a separate consent banner under the GDPR's ePrivacy rules.
• How accounts are created. Velur currently onboards customers by hand, in cohorts (see our Terms, Section 1) rather than through fully open self-serve signup. When your cohort opens, we create your account and send you credentials directly; from then on, sign-in goes through the same Supabase Auth flow as everyone else.
• Account access requests (password resets, account deletion, exporting your login history) go to hello@velur.io and are handled by a human, not an automated bot.

Your raw business data stays in your ecosystem. The most sensitive records — individual customer names, emails and transactions — never leave our database, and never reach the AI model at all. To write your brief we send the model only aggregated, derived numbers (revenue by channel, blended ROAS, churn by cohort). The model reasons over the summary, never over your customers.

Concretely: our egress layer strips personally identifiable fields before anything is sent for the AI to read. A human reviewing the exact payload sent to the model would see numbers and channel labels, not names, emails, or line-item order history.

Connected business data is processed and stored on EU infrastructure (our database region is in the EU), under GDPR-compliant data-processing agreements, encrypted in transit (TLS) and at rest. Backups live in the same region and under the same protections as the primary data.

Where any sub-processor operates outside the EU (for example, a US-based service acting under a zero-retention agreement), we rely on appropriate safeguards — Standard Contractual Clauses or an equivalent adequacy mechanism — and we keep any such transfer to the minimum the service actually needs.

Retention depends on the kind of data, not a single blanket rule:

• Connected business data — kept while you actively use Velur, so your history and trend lines stay intact. If you disconnect a tool, we stop syncing new data immediately and delete the existing connected data within 30 days unless you ask us to keep it longer.
• Account data — kept for as long as your account exists, then deleted on closure except where we're legally required to retain billing or tax records (typically several years under EU/Spanish tax law).
• Website and prospect data (waitlist/contact form entries) — kept until you ask us to delete it, or up to 24 months of inactivity, whichever comes first.
• Support correspondence — kept as long as reasonably useful for account history, generally no more than a few years.

You can ask us to delete your data at any time — see Section 11, "Your rights."

We don't sell data, and we don't share it with other brands. We use a small set of trusted sub-processors to run Velur, each under a data-processing agreement:

• Supabase — our database, storage, and authentication provider (EU region). This is also where account sign-in (Section 3) runs; Supabase is the only third party that ever handles a password.
• Anthropic — the AI that drafts the brief (receives aggregates only, per Section 4; does not train on the data; zero-retention used where it qualifies).
• Vercel — website and application hosting.
• Resend — transactional email (delivering your brief and account notifications).

We may also disclose data where the law requires it (for example, a valid legal order), or to protect the rights, safety, or property of Velur or our customers. We do not use Auth0, or any identity provider other than Supabase Auth. We'll keep this list current as the product grows, and any new sub-processor that touches connected business data will be added here before it goes live.

We use two categories of cookie, and treat them differently on purpose:

• Strictly necessary (always on). The session cookie Supabase Auth sets when you sign in, which keeps you logged in as you move between pages. Without it, the product simply can't work — under the GDPR's ePrivacy rules, cookies of this kind don't require consent, though we still disclose them here.
• Analytics (privacy-first). The marketing site uses basic, privacy-first analytics — pages visited, referring source, coarse device type — with no advertising cookies and no cross-site tracking. We don't build a profile of you across the web, and we honour Global Privacy Control / Do-Not-Track signals where sent.

We don't currently run a cookie-consent banner because we don't set any non-essential cookie that would require one. If that changes — for example, if we add marketing pixels — we'll add proper consent controls before we do, not after.

Service messages — security alerts, account notices, your daily brief — are part of using Velur and aren't optional while your account is active; they're how we tell you your data changed or something needs your attention. Anything promotional is genuinely optional, opt-in, and every marketing email carries a one-click unsubscribe that we honour immediately, not on some future batch job.

We design Velur so the most sensitive data is the least exposed, rather than relying on any single control to carry the whole burden:

• Read-only connections. Every integration (Shopify, Stripe, Meta, etc.) is granted read-only scopes. Velur cannot place an order, issue a refund, or change anything in a connected account, even if compromised.
• Encryption in transit (TLS 1.2+) and at rest, across the database, backups, and file storage.
• Tenant isolation. Every table is scoped so one business can never read another's data — enforced at the database level (row-level security), not just in application code, and covered by isolation tests before any feature ships.
• Least-privilege access. Internally, access to production data is limited to what a task actually requires, and administrative actions are logged.
• Password handling is delegated entirely to Supabase Auth's hashing and salting — no Velur system stores or logs a raw password.

No system is perfectly secure, and we won't claim otherwise. If we ever become aware of a breach affecting your data, we'll notify affected customers and, where required, the relevant supervisory authority, within the timeframes the GDPR sets out (without undue delay, and within 72 hours to the authority where feasible).

Under the GDPR (and equivalent laws elsewhere) you have the right to:

• Access — get a copy of the personal data we hold about you.
• Rectify — correct data that's wrong or incomplete.
• Erase — ask us to delete your data ("the right to be forgotten"), subject to any legal retention duty.
• Restrict or object — limit or challenge how we process your data in certain cases.
• Export — receive your data in a portable, machine-readable format.
• Withdraw consent — at any time, for anything we process on the basis of consent, without affecting what happened before.

To exercise any of these, email hello@velur.io. We respond within 30 days, as the GDPR requires, and usually much sooner. If you're unhappy with how we handle a request, you also have the right to lodge a complaint with your local data protection authority.

For connected business data, the customer is the controller and Velur is the processor — we act strictly on their instructions and never repurpose it. For account, authentication, and website data, Velur is the controller and decides how that data is used, within this notice. A data-processing agreement governs the processor relationship with each customer; ask hello@velur.io for a copy.

Velur is a business tool and is not directed at children; we don't knowingly collect data from anyone under 16. If this notice changes in a way that matters, we'll update the "last updated" date below and, for material changes, tell active customers directly rather than leaving it to be noticed. Questions, or to reach whoever handles data protection at Velur, write to hello@velur.io.