Privacy Policy

Effective 2026-06-03. Last updated 2026-06-03.

1. Who's the data controller

[Legal entity not configured], based at [Business address not configured], is the data controller for personal information processed through Velcy.

2. What we collect

Account data

• Email address (required for sign-in)
• Display name (optional)
• Workspace name and slug
• Role (admin, manager, dev, viewer)

Product usage data

• Tasks, sprints, pages, comments, notes and attachments you create
• Team-roster entries you add for capacity planning
• Configured AI provider keys (encrypted at rest with a per-server secret) — only you and your workspace admins can read these

Technical data

• IP address (for rate limiting and abuse detection)
• Browser user agent
• Session cookie (HTTP-only, expires after 12 hours)
• Application logs (retained 30 days)

Billing data

We do not collect or store card details. Payments are processed by our merchant of record (Lemon Squeezy). We receive a billing email, subscription status and seat count from them.

3. Why we process it

• Performing the contract — running the Service you signed up for.
• Legitimate interest — keeping the Service secure, debugging, fraud prevention.
• Legal obligation — accounting records, responding to lawful requests.

We don't sell personal data and we don't use your workspace content for advertising. We don't use your content to train AI models.

4. AI features and Bring-Your-Own-Key (BYOK)

Velcy's AI features call AI providers using your API key. When you send a prompt, the request goes from your browser through Velcy's server to the chosen provider (OpenAI, Anthropic, Ollama, etc.) and the response is returned to your workspace. The request, response and a metadata audit row (timestamp, provider, model, token counts) are stored in your workspace for 90 days for debugging and cost visibility. You can delete audit rows at any time.

5. Who we share data with (subprocessors)

We sign data processing terms with subprocessors that handle personal data.

6. How long we keep data

• Workspace content — for the life of your subscription, plus 30 days after account deletion.
• Account profile — same as above; hard-deleted 30 days after you request deletion.
• Billing records — 7 years (tax/accounting law).
• Application logs — 30 days.
• AI audit log — 90 days.

7. Your rights

Subject to applicable law (including India's Digital Personal Data Protection Act 2023 and the EU General Data Protection Regulation), you can:

• access the personal data we hold about you;
• correct inaccurate data;
• export your workspace data (via in-app Export);
• delete your account (in-app, with a 30-day recovery window); after that, your data is permanently erased;
• object to or restrict certain processing;
• complain to your local data protection authority.

To exercise any of these rights, email support@velcy.app. We respond within 30 days.

8. Security

• All traffic is encrypted in transit (HTTPS).
• Database is encrypted at rest by Supabase.
• AI provider keys are encrypted at rest with a per-server secret before being written to the database.
• Sessions are HTTP-only, SameSite cookies signed with a server secret.
• Sign-in is passwordless (magic-link); we never store sign-in passwords.

9. International transfers

Your data may be processed in countries other than your own (see the subprocessor table). Where required, we rely on standard contractual clauses or equivalent safeguards.

10. Children

Velcy is not directed at children under 16. We don't knowingly collect personal data from children. If you believe a child has signed up, email support@velcy.app and we will delete the account.

11. Changes to this policy

We will update this page whenever the policy changes and announce material changes via email or in-app notice at least 30 days in advance.

12. Grievance Officer (India DPDP Act)