This privacy policy explains which personal data we process when you visit our website, create an account or use Velorith on behalf of your company, for which purposes and on which legal bases, who receives the data and which rights you have. Velorith is offered exclusively to businesses. The terms "we" and "us" refer to the provider named below.
Controller
[COMPANY_LEGAL_NAME], [COMPANY_LEGAL_FORM]
[COMPANY_ADDRESS]
[COMPANY_COUNTRY]
Email for data protection requests [PRIVACY_EMAIL]
Further provider details are available in the imprint.
Representative in the European Union
We have no establishment in the European Union. Pursuant to Art. 27 GDPR we have appointed the following representative, whom you can also contact on all data protection matters.
[EU_REP_NAME]
[EU_REP_ADDRESS]
Email [EU_REP_EMAIL]
Data protection officer
[DPO_STATEMENT]
Our role
We act in two roles, depending on the data.
- As controller we process personal data that we need to offer and secure Velorith ourselves. This covers website visits, user accounts and sign-in, company and member administration, billing, service emails, security logs, error monitoring and analytics. This policy applies to this processing in full.
- As processor we process the content that your company and its members put into Velorith, such as conversations, agent runs, approvals, the audit log, the company brain, agent browsing, web searches and workspace files. Your company is the controller for this content and decides why and how it is processed. We process it only on your company's documented instructions under our data processing agreement. For questions about this content, including requests to exercise your rights, please contact your company first. We support your company in answering such requests.
The sections below describe both kinds of processing so that you can see the complete picture.
Processing in detail
Visiting our website
When you open our website, the web host [WEB_HOST_PROVIDER] processes the data that your browser transmits automatically, namely IP address, date and time, requested page, referrer, browser type and operating system. We need this data to deliver the website, to keep it stable and to detect and repel attacks. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and reliable operation of the website. At launch, Cloudflare will be placed in front of the website, the app and our interfaces as a content delivery network and web application firewall and will process the same connection data for these purposes.
Our fonts are hosted on our own servers. Loading the website does not transmit any data to font providers.
Account and sign-in
To create an account we process your email address and, if you provide them, your name and a profile image. You sign in with a one-time code sent by email or with a passkey. We further process a password hash if you set a password, the public key of your passkeys, the secret and backup codes of your two-factor authentication and your session data. For each session we store a session token, the IP address, the user agent and an approximate location (city and country) derived from the IP address. You can view and end your active sessions in your account settings.
We process this data to provide your account and to protect it against misuse. The legal basis is Art. 6(1)(b) GDPR where you are our contractual partner yourself, and otherwise Art. 6(1)(f) GDPR. Our legitimate interest lies in providing the service that your company has ordered for its members and in securing access to it.
Security events and new sign-in alerts
We log security-relevant events relating to your account, such as sign-ins, failed attempts, changes to sign-in methods and session revocations, together with IP address, user agent and approximate location. When you sign in from a new browser or device, we send you an email stating the browser, operating system, approximate location and time, so that you can detect unauthorised access. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting your account, your company's data and our systems.
Company and member administration
When a company is set up, we process the company name, the details of the person setting it up, the confirmation that Velorith is used for business purposes, the acceptance of our terms with version and time and, if provided, the VAT identification number. For members we process role, team membership, invitations and join requests (each with email address), language, time zone, quiet hours, notification preferences, presence status and the time of last activity. The legal basis is Art. 6(1)(b) GDPR for the contractual relationship with the company and Art. 6(1)(f) GDPR for its members. Our legitimate interest lies in letting the company manage its members and their access. Recording the acceptance of our terms also serves our legitimate interest in being able to prove the conclusion of the contract.
Billing
For billing we use Stripe. When a company is set up, we create a customer record at Stripe containing the company name, the owner's email address and an internal company reference. We also record usage and costs of each member, for example model calls and credits used, to bill the company, to enforce spending limits and to send spending alerts. Payment details are processed by Stripe. The legal basis is Art. 6(1)(b) GDPR and, for retaining billing records, Art. 6(1)(c) GDPR in conjunction with the applicable commercial and tax retention obligations.
Service emails
We send service emails through Resend. These include one-time sign-in and verification codes, confirmations of an email change, password resets, invitations (stating the company and the name of the person inviting), new sign-in alerts and spending alerts. Resend processes the recipient address, the content of the email and delivery metadata. The legal basis is Art. 6(1)(b) GDPR and, for security emails and messages to invited persons, Art. 6(1)(f) GDPR. Our legitimate interest lies in operating and securing the service. We do not send newsletters.
Conversations, agent runs, approvals and audit log
When members work with their agents, we process on behalf of the company the content of conversations including attachments and images, the complete input of each agent run, interim states, the instructions and persona of the agents, notifications, approval requests with the command, working directory, target and the person deciding, as well as the company's audit log. To generate replies, the content of a request is transmitted to OpenRouter and from there to the respective model provider. Details on the models and providers are available in our AI transparency information. If the company connects its own accounts with third-party services such as Slack, Telegram or Notion, agents transmit content to these services on the company's instruction. These services are chosen by the company and are not our subprocessors.
We process this content as a processor. The legal basis for the processing lies with the company as controller.
Company brain
The company brain is a knowledge base per company. We process on behalf of the company uploaded files, links that members submit together with the content retrieved from them, extracted text including text recognised in images, learnings that agents record about facts and preferences of members, and logs of which knowledge an agent has recalled in response to which query. Our servers retrieve submitted links directly, so the operator of the linked website receives the request from our infrastructure. To extract, classify and index content we use AI models via OpenRouter. The brain runs on a dedicated server per company at Hetzner in Germany or Finland and is reachable only through an encrypted network connection from our runtime.
Agent browsing
At launch, agents browse websites in hosted browsers from Browser Use, which we use in its EU deployment in Frankfurt. Each member has their own persistent browser profile there, in which logins, cookies and other browsing state are stored so that logins remain valid between sessions and the agent can act on these websites on the member's behalf. Browser Use processes the pages that the agent visits and their content, the entries made and the data stored in the profile, and routes outgoing connections through residential proxies. Billing metadata is processed by Browser Use in the USA.
Members can watch the browser live in the web app and take over, for example to sign in, confirm a second factor or solve a CAPTCHA. Browsers stop when they are idle. Members can remove all stored logins themselves, and a member's profile is deleted when the member leaves the company. An administrator can switch the hosted browser off for the whole company, and usage is limited by a monthly web budget per company. Browser Use is our subprocessor for this processing. We process this data on behalf of the company.
Web search and page extraction
At launch, agents search the web and retrieve the content of web pages without a browser through Parallel in the USA. Parallel receives the search queries, URLs and objectives that the agent sends and returns results and page content. Site watch triggers, with which an agent checks a page for changes on a schedule, use Parallel for public pages and the member's hosted browser at Browser Use for pages that require a login. Parallel is our subprocessor for this processing. We process this data on behalf of the company.
Workspaces
Each member can be given a personal workspace with files and a terminal in which agents run commands. We process the files stored there, the commands executed and their output, as well as technical data of the workspace such as IP addresses and encrypted access credentials. Workspaces run at Fly.io or Hetzner. We process this data on behalf of the company.
Devices, companion apps and push notifications
When you pair a desktop or mobile app with your account, we store the device name, platform, a device fingerprint, a public key and the app version. For push notifications we store a push token and send notifications through the Expo push service to Apple Push Notification service or Firebase Cloud Messaging. Notifications may contain the agent name, conversation titles, the first line of a command awaiting approval and the cost or failure of a run. You can switch off push notifications at any time in your device settings or in the app. The legal basis is Art. 6(1)(b) GDPR or, for members who are not our contractual partners, Art. 6(1)(f) GDPR. Our legitimate interest lies in enabling secure access from your devices and informing you promptly about pending approvals.
Voice input in the mobile app
If you use voice input in the mobile app, speech recognition is performed by your device's operating system. Depending on device settings, Apple or Google may process the audio on their servers. We receive only the recognised text. The processing by Apple or Google is governed by their privacy policies and the settings of your device.
Messaging channels (planned)
At launch, members will be able to talk to their agents via iMessage and WhatsApp. For iMessage we will use Photon (Spectrum Cloud) and for WhatsApp the WhatsApp Business Platform of Meta Platforms Ireland. In this case the provider processes phone number, message content and metadata of the respective conversation. We will process this data on behalf of the company.
Classification of agent actions (planned)
At launch, we plan to have certain planned agent actions on a member's computer assessed by Jev from TypeSafe before they are executed. Only text is transmitted, namely the planned steps, the accessibility tree of the active window, the name of the app and the approved task. We will process this data on behalf of the company.
Error monitoring (planned)
At launch, we will use Sentry with data storage in the European Union to detect and fix technical errors. In the event of an error, technical information about the error, the affected device and browser and, where applicable, a pseudonymous user reference are transmitted. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in a functioning and secure service.
Product analytics (planned)
At launch, we will use PostHog with data storage in the European Union to understand how Velorith is used and to improve it. PostHog will be operated without cookies and without storing identifiers on your device. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in improving our service on the basis of usage data. You can object to this processing at any time.
Requests by email
If you contact us by email, we process your email address, your name and the content of your message to handle your request. The legal basis is Art. 6(1)(b) GDPR where the request relates to a contract, and otherwise Art. 6(1)(f) GDPR. Our legitimate interest lies in answering your request.
AI processing
Velorith agents are based on large language models. Content that members send to agents or that agents process is transmitted to the model providers via OpenRouter. We configure agent requests so that OpenRouter forwards them only to the providers we have chosen and only to providers that, according to OpenRouter's classification, do not use request data for training, and we disable automatic fallback to other providers. Requests for processing company brain content also exclude providers that use request data for training, but OpenRouter may route them to other providers that meet this condition. Embeddings for the company brain are created by OpenAI through OpenRouter without this setting. Which models we use, who provides them and what to bear in mind when using AI output is described in our AI transparency information.
Connecting a ChatGPT subscription
The software contains a function for connecting a member's own ChatGPT subscription. This function is not available at launch. No data is transmitted to OpenAI via this route.
Recipients
Within our organisation, only persons who need personal data to perform their tasks have access to it. We also use service providers who process personal data on our behalf, in particular for hosting and infrastructure, AI model access, email delivery, payment processing, push notifications and, at launch, hosted browsers, web search, messaging channels, error monitoring, analytics and content delivery. We list these providers with their purpose, location and transfer mechanism in our list of subprocessors.
We otherwise disclose personal data only where we are legally obliged to do so, for example to authorities, where this is necessary to establish, exercise or defend legal claims, or to our legal and tax advisers, who are bound to professional secrecy.
Transfers to third countries
Some of our service providers are based in the United States or process data there, including OpenRouter, the model providers it routes to, Stripe, Resend, the Expo push service, the US parent companies of our EU-hosted providers and, at launch, Browser Use for billing metadata, Parallel, Photon and TypeSafe. Where a recipient is certified under the EU-U.S. Data Privacy Framework, the transfer is based on the adequacy decision of the European Commission (Art. 45 GDPR). Otherwise we agree the standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR) and, where necessary, additional safeguards. The mechanism applying to each provider is stated in our list of subprocessors. You can request a copy of the safeguards from us.
Storage periods
We store personal data only for as long as necessary for the respective purpose or as required by law. The following periods apply.
| Data | Storage period |
|---|---|
| One-time sign-in and verification codes | 5 minutes |
| Invitations not accepted | 7 days |
| Approval requests not decided | Expire after 15 minutes, the decision record remains in the audit log |
| Logs of knowledge recalled by agents | 30 days |
| Backups of the company brain | 7 days, rolling |
| Account, sign-in methods, sessions, security events, memberships, devices and profile | Until your account is deleted |
| Your private sources in the company brain after account deletion | Locked immediately and deleted after 30 days |
| Other personal data linked to your account, such as push tokens and usage records | Deleted or anonymised within [RETENTION_ACCOUNT_DELETION] after account deletion |
| Company content (conversations, runs, approvals, brain, workspaces, storage files) | For the term of the contract as instructed by the company, deleted within [RETENTION_CONTRACT_END] after the end of the contract. If an owner deletes the company, deletion starts 14 days after the request |
| Logins, cookies and browsing state in a member's browser profile at Browser Use (planned) | Until the member removes them or leaves the company |
| Other data from browser sessions at Browser Use (planned) | [RETENTION_BROWSER_USE] |
| Search queries, URLs and results at Parallel (planned) | [RETENTION_PARALLEL] |
| Company audit log | [RETENTION_AUDIT_LOG] |
| Billing records | [RETENTION_BILLING_RECORDS] |
| Web server logs | [RETENTION_SERVER_LOGS] |
| Error reports (planned) | [RETENTION_MONITORING] |
| Analytics data (planned) | [RETENTION_ANALYTICS] |
| Requests by email | Until the request has been fully handled, longer only where statutory retention obligations apply |
When you delete your account, we delete your conversations, runs, approvals, schedules, uploaded files and devices as well as your agent runtime, your workspace and your browser profile. Knowledge that you contributed to the shared company brain and the entries in the company audit log remain with your company, because they belong to the company. Owners must transfer ownership of the company before deleting their account. You can download a copy of your data in your account settings at any time. The archive does not contain the content of your private brain sources or the files in your workspace.
Cookies and local storage
We use only cookies and local storage entries that are strictly necessary to provide the service you have requested (§ 25(2) no. 2 TDDDG). We do not use cookies for analytics or advertising. Therefore we do not ask for consent.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| better-auth.session_token | Cookie | Keeps you signed in | Until sign-out or end of the session |
| better-auth.session_data | Cookie | Caches session data to speed up the app | Until sign-out or end of the session |
| better-auth.convex_jwt | Cookie | Authenticates requests to our backend | Until sign-out or end of the session |
| better-auth.dont_remember | Cookie | Ends the session when the browser is closed if you have chosen not to stay signed in | End of the browser session |
| better-auth.two_factor | Cookie | Links the second sign-in step to your first step | Until the sign-in is completed |
| better-auth.trust_device | Cookie | Remembers a trusted device for two-factor authentication | Until the trust period expires |
| velorith.locale | Cookie | Stores your language | 1 year |
| theme | Local storage | Stores the colour scheme | Until deleted in the browser |
| velorith.passkey | Local storage | Remembers that a passkey was set up on this device | Until deleted in the browser |
| velorith.runPanel | Local storage | Stores the layout of the run panel | Until deleted in the browser |
| velorith.brainView.* | Local storage | Stores the view settings of the company brain | Until deleted in the browser |
| velorith.brain.key | Local storage | Stores display settings of the company brain | Until deleted in the browser |
Obligation to provide data
You are neither legally nor contractually obliged to provide personal data. Without an email address and the data needed for sign-in, however, we cannot create an account for you, and without the content that you enter, agents cannot carry out tasks.
Automated decision-making
We do not make decisions that produce legal effects concerning you or similarly significantly affect you based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR. Agents act on instructions and within the approval rules set by your company. Actions requiring approval are executed only after a person has approved them.
Your rights
You have the right to access your personal data (Art. 15 GDPR), to rectification (Art. 16 GDPR), to erasure (Art. 17 GDPR), to restriction of processing (Art. 18 GDPR) and to data portability (Art. 20 GDPR). Where processing is based on consent, you can withdraw it at any time with effect for the future (Art. 7(3) GDPR). To exercise your rights, contact us at [PRIVACY_EMAIL] or our representative in the European Union. Where we process data on behalf of your company, we forward your request to the company or ask you to contact it directly.
Right to object
Where we process your personal data on the basis of Art. 6(1)(f) GDPR, you have the right to object to the processing at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You can object to product analytics at any time without giving reasons. Send your objection to [PRIVACY_EMAIL].
Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR). The authority competent for us is [SUPERVISORY_AUTHORITY].
Changes to this policy
We will update this privacy policy when our processing changes, for example when a planned service provider goes live or a new function is added. The current version is always available on this page with its effective date. We will inform companies of material changes in advance by email.