Privacy Policy

Last updated: [Month DD, YYYY]

Template notice: This is a professional starting template. Have qualified legal counsel review it and replace every [bracketed] placeholder before you launch or take payments.

This Privacy Policy explains how [Company Name] (“Velora,” “we,” “us”) collects, uses, and protects information when you use the Velora platform (the “Service”). By using the Service you agree to this policy.

1. Information we collect

Account data — name, email, password (hashed), and workspace details you provide.
Customer conversation data — messages exchanged between you, your customers, and your AI agents on connected channels (e.g. WhatsApp), plus contact identifiers and metadata.
Configuration — agents, prompts, business hours, and connected credentials (encrypted).
Billing data — plan, subscription status, and payment references. Card details are handled by our payment processor and never stored on our servers.
Technical data — IP address, device/browser info, and usage/audit logs for security and reliability.

2. How we use information

To operate the Service — connecting channels, running AI agents, and delivering replies.
To secure accounts, prevent abuse, and comply with legal obligations.
To process payments and manage subscriptions.
To provide support and send service-related communications.

3. AI processing

To generate replies, message content is sent to the AI provider you configure (e.g. OpenAI, Anthropic, Google, Groq, OpenRouter) under that provider’s terms. You choose the provider and are responsible for the content processed through your agents.

4. Sharing & third parties

We share data only with service providers necessary to run Velora, including:

Payment processing — Stripe.
AI providers — as configured by you.
Messaging — WhatsApp/Meta, for connected numbers.
Infrastructure & email — hosting, database, and transactional email vendors.

We do not sell your personal data.

5. Data retention

We retain data for as long as your account is active or as needed to provide the Service and meet legal requirements. You may request deletion as described below; some records may be retained where required by law.

6. Security

We use encryption in transit and at rest for sensitive data (such as connected credentials and API keys), hashed passwords, access controls, and audit logging. No method of transmission or storage is completely secure.

7. Your rights

Depending on your location (including under the GDPR and similar laws), you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these rights, contact us at [privacy@yourdomain.com].

8. International transfers

Your data may be processed in countries other than your own. Where required, we rely on appropriate safeguards for such transfers.

9. Children

The Service is not directed to individuals under 16, and we do not knowingly collect their data.

10. Changes

We may update this policy. Material changes will be posted here with a new “Last updated” date.

11. Contact

[Company Name], [Address].
Email: [privacy@yourdomain.com]