Data Processing Agreement

You are the data controller for the personal data you put into your Velora workspace. Velora AI is the data processor and acts only on your documented instructions, which include your use of the platform’s features.

• Subject matter: providing the Velora AI platform.
• Duration: for as long as your account is active, plus the retention period in our Privacy Policy.
• Categories of data subject: your customers, leads, contacts and staff.
• Types of data: names, contact details, enquiry and booking details, invoice and transaction details, and any content you choose to store.

We use a managed cloud database and hosting provider, AI model providers for generation features, and Stripe for payments. We remain responsible for their performance and will tell you before adding a sub-processor that materially changes how your data is handled.

Data is encrypted in transit, access is controlled by authenticated sessions, and every workspace record is protected by row-level database rules that scope it to its owning account. Files you upload are stored in private buckets. Staff access to production data is limited to what is needed to operate and support the service.

Anyone with access to your data is bound by confidentiality. We will assist you with data subject requests, data protection impact assessments and regulator queries so far as is reasonable given the nature of the processing.

If we become aware of a personal data breach affecting your data, we will notify you without undue delay and provide the information you need to meet your own reporting duties.

You can export your data at any time while the account exists. On termination we delete your workspace data within 90 days, except where we must retain records by law.

We will provide reasonable information to demonstrate compliance with these terms. If your organisation needs a countersigned copy, email hello@veloriaai.co.uk.