Privacy Policy

Where applicable, we indicate why you provide personal information and the consequences of not providing it: if you do not provide personal information when requested, you may not be able to use the Services where that information is necessary to provide them or where we are legally required to collect it.

You provide to us:

• Contact and prospect information. When you inquire about the Services, or sign up for, attend, or take part in our demos, events, webinars, or programs, we collect your full name, work email, company name, company size, whether you are an agency, and any information you choose to provide.
• Communications. If you contact us directly, we receive your name, email address, the contents of your message and any attachments, and other information you choose to provide. When you sign up for news and updates, we collect your email address. When you communicate with us online, third-party vendors receive and store these communications on our behalf. When we send you emails, we use embedded pixels or similar technologies to track information about your interaction with them, such as whether and when you open them, whether and which links you click, how long you read them, and whether you forward them, together with your location and device information described below, to improve our communications and the Services.
• Calls and meetings. When you take part in a call or video meeting with us, we may record it and use an AI tool to transcribe it and take notes. The person leading the call tells you at the start that it is recorded. You can object at any time, before or during the call: we stop the recording and delete what we recorded. We keep the recording, the transcript and the notes to prepare the follow-up, the proposal and the record of what we agreed.
• Account information. To create, update, or manage your account, we collect your email address and name, and any details you provide, including an optional profile photo for your individual account and for your organisation’s Veliu account.
• Careers. If you apply for a role with us, we collect the contact details and the information in your application and CV, such as your education and employment experience.
• Payment information. If you make a payment, your payment-related information (such as card or other financial details) is collected by our third-party payment processor on our behalf.

Collected automatically when you use the Services:

When you visit our website or use the Veliu back office as one of our direct users, we and our analytics providers automatically collect:

• Device information: your IP address, device type and identifiers, browser type, and operating system.
• Location information inferred from your IP address (such as country or region).
• Usage information: the pages and content you view, referring pages, the dates and times you access the Services, the features you use, and server log data.
• Product usage information: how you and other users in your organisation interact with the Veliu back office, which we use to operate, secure, and improve the Services. This concerns the activity of our own direct users. Personal data we process on behalf of our brand customers in providing the Services to them is governed solely by our customer agreement and our Data Processing Agreement.
• Cookies and similar technologies: we and our analytics provider use cookies and similar technologies to collect the information above. We use PostHog, a privacy-focused product and website analytics tool, for these purposes. See Section 6 and our Cookie Policy for details and for how to manage your choices.

Information from other sources:

We obtain business contact information about prospects, such as name, role, work email and company details, from public sources (company websites, professional profiles, public registers), from business data providers that supply or enrich business contact details, and from the agencies and partners in our Partner Program. Section 3 gives the legal basis for this prospecting and Section 5 explains how to stop it.

We use the personal information we collect for the following purposes:

• To provide and operate the Services. To create and manage your account, make the Veliu back office available to you, and carry out the features you use.
• To maintain, secure, and improve the Services. To monitor performance, diagnose and fix problems, protect against fraud, abuse, and security threats, and develop new features and improvements.
• To understand how the Services are used. To analyze product usage and website activity so we can operate the Services and make them better.
• To adapt our website and communications to you. To tailor what you see on our website and in our communications to make them more relevant to you.
• To communicate with you. To respond to your inquiries and requests, provide customer support, and send you administrative or service-related messages.
• For marketing, where permitted. To send you marketing communications and to measure your interaction with them, where you have consented or where otherwise permitted, and to manage your preferences.
• To facilitate payments. To process payments through our third-party payment processor.
• With the help of AI tools. We use large language models from providers such as those named in Section 4, under terms that do not allow them to train on your data, to summarise calls and messages, draft our replies and proposals, qualify prospects and answer questions on our website (Section 15). A person sets and reviews the templates and proposals we send you; the answers of Ask Veliu on our website are generated without review (Section 15).
• To produce de-identified or aggregate data. To create information that no longer identifies you, which we may use for any lawful purpose.
• For compliance and protection. To comply with our legal obligations, enforce our terms, and establish, exercise, or defend legal claims.

We do not use your personal information, or the data we process on behalf of our customers, to train AI models for other customers; Section 4.6 of our Master Subscription Agreement and our Data Processing Agreement explain what improves Veliu’s AI.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process your personal information only where we have a valid legal basis, as set out below.

• Consent. We process your personal information where you have consented to it. For example, we rely on your consent to send you marketing communications and to track your interaction with those emails, and to use non-essential cookies. You can withdraw your consent at any time, without affecting processing carried out before withdrawal.
• Contractual necessity. We process your personal information where it is necessary to provide the Services you have requested. For example, to create and manage your account, to make the Veliu back office available to you, and to respond to your inquiries and requests.
• Compliance with a legal obligation. We process your personal information where we are legally required to do so. For example, to comply with tax, accounting, and other regulatory obligations.
• Legitimate interests. We process your personal information where we or a third party have a legitimate interest that is not overridden by your rights and interests. In particular, we have a legitimate interest in using product usage and analytics information for product development and internal analytics, and to maintain and improve the safety, security, and performance of the Services. We rely on this basis only after weighing it against your rights and interests. We also have a legitimate interest in contacting the businesses that match the Services with a proposal, using their business contact information, and in recording our calls and video meetings as Section 1 describes; you can object at any time as Section 5 explains.

• Vendors and service providers engaged to provide the Services: hosting and infrastructure (Amazon Web Services, Google Cloud, Vercel, Supabase), payments (Stripe), analytics (the providers listed below under Analytics providers), consent management (iubenda s.r.l.), support, and email, outreach, meeting-notes and scheduling tools. These processors act on our behalf under appropriate terms. This section covers the processors we use as controller; our Data Processing Agreement lists the subprocessors we use for our customers’ data, with their locations. Our AI tools run on models from providers that include OpenAI, Microsoft (Azure OpenAI Service), Amazon Web Services (Amazon Bedrock) and Google Cloud (Vertex AI), in European regions where the provider offers them.
• Affiliates. We may disclose the information we collect to our current and future affiliates for any of the purposes described in this Privacy Policy. Our only affiliate at this time is Veliu S.r.l. (Italy).
• Authorised partners. We share business contact information about prospects with the agencies, consultancies, freelancers and technology companies in our Partner Program, so they can propose the Services; they use it as independent controllers under their own privacy notices.
• Analytics providers. These processors act on our behalf to measure how our website and Services are used: Google Ireland Limited (Google Tag Manager and Google Analytics 4) and PostHog Inc., in its EU cloud (product analytics and session replay, with every input field masked). In the European Economic Area, the United Kingdom and Switzerland these tools run only once you accept them in our cookie banner.
• Company recognition. Clay Labs Inc. acts on our behalf through a pixel that recognises the company a visit comes from; it runs as a marketing tag, as Section 6 explains.
• Advertising partners. For the advertising tags described in Section 6, Google Ireland Limited acts as an independent controller for Google Ads conversion tracking. Meta Platforms Ireland Limited acts as joint controller with us for collecting and transmitting data through the Meta Pixel and the Conversions API, under the terms at https://www.facebook.com/legal/controller_addendum; our server uses the Conversions API to tell Meta when someone requests a free report. Each processes that data under its own privacy policy, at https://policies.google.com/privacy for Google and https://www.facebook.com/privacy/policy for Meta. In the European Economic Area, the United Kingdom and Switzerland these tags run only once you accept marketing cookies in our cookie banner.
• As required by law and similar disclosures. We may access, preserve, and disclose your information where we believe it is required or appropriate to: (a) comply with legal process or requests from law enforcement, such as a court order or subpoena; (b) respond to your requests; (c) protect the rights, property, and safety of you, us, or others; (d) protect against legal liability; or (e) investigate fraud or other unlawful activity, including misuse of the Services.
• Corporate transactions: in connection with a merger, acquisition, financing, or asset transfer.
• Reports of abuse. We forward a report of a breach of our Acceptable Use Policy to the customer concerned, with the reporter’s contact details where they are needed to resolve it, as Section 3 of that Policy explains.
• With your consent in other cases.

Marketing: you can unsubscribe via the link in our emails.

EEA / UK / Switzerland rights. If you are located in these regions, you have the following rights, subject to the limits and exceptions in applicable law:

• Access. You can request a copy of the personal information we hold about you.
• Rectification. You can ask us to correct inaccurate or incomplete information.
• Erasure. You can ask us to delete your personal information.
• Restriction. You can ask us to limit how we process your information in certain cases.
• Objection. You can object to processing we carry out on the basis of legitimate interests, and to processing for direct marketing.
• Portability. You can ask to receive certain information in a portable format, or to have it transmitted to another controller.
• Withdraw consent. Where we rely on your consent, you can withdraw it at any time, without affecting processing carried out beforehand.
• Lodge a complaint. You can complain to a supervisory authority, including our lead authority, the Data Protection Commission of Ireland, or your local authority.

To exercise these rights, write to legal@veliu.com, from the email address we hold for you where possible. We may need to verify your identity before responding. We answer within one month; for complex or numerous requests we may take up to two further months, and we tell you why within the first month. You may act through an authorised agent who shows us your written authorisation. To stop our prospecting, reply to any of our emails or write to legal@veliu.com: we stop within five working days and keep only what we need to honour your request.

United States: California (CCPA/CPRA) and other US state privacy laws.

This section applies to residents of US states with applicable consumer privacy laws. Because Veliu is established in Ireland, our processing is also governed by European law; this section adds the rights and disclosures required for US residents, and where laws overlap we apply them together.

Categories of personal information. In the past 12 months we have collected the categories described in Section 1, which map to the following statutory categories: identifiers (such as name, email, IP address); commercial information (such as account and subscription details); internet or network activity (such as usage and device information); geolocation inferred from IP address; and professional information (such as company and role). We collect this information from you directly, automatically through your use of the Services, and from service providers. We use it for the purposes in Section 2.

Disclosure of personal information. In the past 12 months we may have disclosed identifiers, commercial information, internet or network activity, and professional information to our service providers and, through the cookies and tags described in Section 6, to analytics providers and advertising partners. We disclose for the business and commercial purposes described in this Policy.

“Sale” and “sharing.” For visitors in the United States, the Google Ads and Meta tags described in Section 6 may count as a “sale” or “sharing” for cross-context behavioural advertising under US state privacy laws. You can opt out at any time from the “Cookie settings” link in the footer of our website, and we honour the Global Privacy Control signal as an opt-out.

Sensitive personal information. We do not use or disclose sensitive personal information for purposes that would require us to offer a right to limit its use under applicable law.

Your US state privacy rights. Subject to verification and to the limits and exceptions in applicable law, you may have the right to:

• Know and access the personal information we have collected about you.
• Delete the personal information we have collected from you.
• Correct inaccurate personal information.
• Opt out of any “sale” or “sharing” of your personal information.
• Non-discrimination, meaning we will not treat you differently for exercising these rights.

How to exercise your rights. Submit a request by emailing legal@veliu.com. We answer within forty-five (45) days, which we may extend once by forty-five (45) days where reasonably necessary, telling you why. If we deny your request, you may appeal by replying to our decision; we answer the appeal within forty-five (45) days and, where your state provides it, tell you how to contact your Attorney General. We will verify your identity before responding and will not discriminate against you for exercising your rights. You may use an authorized agent where the law permits. As noted above, you can opt out of any “sale” or “sharing” from “Cookie settings” or with the Global Privacy Control signal.

We use four categories of cookies and similar technologies:

• Strictly necessary: they make the website work and keep it secure, and they record your consent choice. We use them without consent.
• Functional: they remember your language for the website.
• Analytics and measurement: Google Analytics 4 and PostHog measure how the website is used. PostHog also records sessions, with every input field masked.
• Marketing: Google Ads conversion tracking, the Meta Pixel and Meta’s Conversions API, and the Clay pixel that recognises the company a visit comes from.

In the European Economic Area, the United Kingdom and Switzerland no analytics or marketing tool runs until you accept it in our cookie banner, purpose by purpose (measurement and marketing), and rejecting is as easy as accepting. Once Google Tag Manager loads, it passes your choice for each purpose to Google tags through Google Consent Mode. Outside those regions these tools run when you arrive on our website, and a refusal in the banner stops them. If you visit from the United States, we honour the Global Privacy Control signal your browser sends. You can change or withdraw your choice at any time from the “Cookie settings” link in the footer of our website.

Ask Veliu, the reader on our website, sets no cookie of its own: its events go through PostHog, as Section 15 explains.

Our Cookie Policy at https://veliu.com/cookie-policy lists every cookie with its name, purpose, provider and duration. We manage cookie consent and the Cookie Policy with iubenda.

When you ask us to do so, we take steps to delete your personal information, or to keep it in a form that no longer allows you to be identified, once that information is no longer necessary for the purposes for which we process it, unless we are required by law to retain it for longer. When we process personal information for our own purposes, we set the retention period by weighing a number of factors, such as the type of Services provided to you, the nature and length of our relationship with you, the possibility that you re-enroll with the Services, the impact on the Services we provide if we were to delete some of your information, and the retention periods and limitation periods required or permitted by law.

We use appropriate technical and organisational measures to protect personal information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

The Services are not directed to children, and we do not knowingly collect personal information from children under 18. If you believe a child has provided us personal information, contact us at legal@veliu.com.

We are established in Ireland and store our customers’ data in the European Union. Some providers that support our own sales and communications, for example for prospect research, outreach and meeting notes, process personal information outside the European Economic Area. For those transfers, and any other transfer outside the European Economic Area, we rely on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for a certified provider, or on the European Commission’s Standard Contractual Clauses. You can contact us for more information about these safeguards. The provider of the model behind Ask Veliu (Section 15) processes your messages in the United States under the Standard Contractual Clauses.

This section applies to all data we receive from Google services you connect to Veliu, whether we process it for our own purposes or on behalf of your business.

What we access. With your permission, and only to provide the features described in this section, we read: from Google Search Console, the sites you manage and their search performance and indexing status; from Google Analytics, your account and property names and aggregate traffic and sales figures for your site; and the email address of the Google account you connect with, to label the connection. This is data about your website and business. We do not request data about individual visitors. Our access is read-only.

How we use it. In Ask Veliu in the back office, your brand agent reads this data when you connect, then on a regular schedule and whenever you ask it a question. It tells you what changed and suggests actions. Results are shown only to the owners and admins of the store the data is connected to.

Who we share it with. We share it with the service providers that run this feature for us:

• Connection to Google: Composio, which can hold your connection to Google and make requests to Google for us.
• AI model: Microsoft, through Azure OpenAI Service, which hosts the model that writes the answers of Ask Veliu in the back office.
• Database: Supabase.
• Application hosting: Vercel.

We do not sell Google user data or use it for advertising, and we do not transfer it to anyone else, except to comply with the law or, with your explicit prior consent, as part of a merger or acquisition. Veliu staff do not read it unless you ask us to, or where this is needed for security or to comply with the law.

How we protect it. The credentials that give access to your Google account are stored encrypted, and access within Veliu is limited to the people who need it. Section 08 describes our security measures in general.

How long we keep it. We keep data received from Google for up to 12 months, then delete it. If you disconnect a Google service in Account, then Integrations, our access ends and we delete its data at once; where Composio holds your connection, we also instruct Composio to delete it. Composio may keep logs of the requests made through it, which can include the data Google returns, for up to one year, under its own terms. You can also remove access from your Google account at myaccount.google.com/permissions, or ask us to delete your Google user data at any time by writing to legal@veliu.com. We will do so within 30 days.

Google’s requirements. Veliu’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We post changes on this page with the date of the last update. For material changes we notify you by email to the address we hold for you, or by a notice on veliu.com, at least thirty (30) days before they take effect, unless a change required by law must apply sooner. Previous versions are published at veliu.com/legal.

Veliu Limited is the controller for the processing described here. Contact us at legal@veliu.com or 31-36 Ormond Quay Upper, Suite 4.01 Ormond Building, D07 F6DC, Dublin 7, Ireland. You may also lodge a complaint with the Data Protection Commission of Ireland or your local supervisory authority.

If you talked with the AI of a brand that uses Veliu’s Brand Agent, or your visit to that brand’s website was handled by it, the brand is the controller of your personal information and Veliu processes it on the brand’s instructions under our Data Processing Agreement. For the brand we process the conversation, the pages composed for you, a visitor identifier set on the brand’s website, your IP address, your approximate location and technical data about your device, and the events the brand measures, such as an order or a booking. The brand reads the conversations in its back office. We keep this information for the brand for the duration of its contract and delete it within sixty (60) days after the contract ends, and from backups within ninety (90) days, unless the law requires us to keep it, as the Data Processing Agreement sets out. We do not use it to train AI models for anyone else, and we do not combine it across brands, except as anonymised measurements of how AI agents and visitors interact with catalogs in general. The Brand Agent tells you that you are talking with an AI, and the brand gives you the other notices the law requires. To exercise your rights, including access, deletion and objection, contact the brand. If you write to us, we forward your request to the brand within two working days in Ireland and answer only on its instructions.

Ask Veliu, the reader on veliu.com, answers your questions about our manifesto, our founding paper and the legal documents published on veliu.com. OpenAI processes your messages in the United States, under the safeguards in Section 10, to compose the answer, and its moderation service reads them to detect abuse, under terms that do not allow OpenAI to train on them. We send only the recent turns of the conversation, and OpenAI may keep them for up to thirty (30) days to detect abuse and then deletes them. Our analytics record that a conversation was opened and that a question was asked, with the document you were reading and the language, through PostHog in its EU cloud. In the European Economic Area, the United Kingdom and Switzerland these events reach PostHog only after you accept measurement cookies in our cookie banner; without that consent Ask Veliu still works and our analytics record nothing about your use of it. The answers are generated without review and may be inaccurate; the document you are reading, as published on veliu.com, prevails.