Privacy Policy
Last updated: 5 November 2026
This policy explains how Velorafy Ltd ("we", "us") uses personal data when you use Velorafy. We are the controller of your personal data. We follow the UK GDPR and the Data Protection Act 2018.
1. What we collect, why, and for how long
| Data | Why we use it | Legal basis | How long |
|---|---|---|---|
| Website usage and ad-measurement data, only if you accept optional cookies: pages visited, device and browser type, approximate location, how you reached the site, and whether you completed a purchase | Understand how the site is used and measure whether our ads work | Consent (you can withdraw it at any time in the cookie settings) | Up to 14 months |
| Account data: name, username, email, hashed password, sign-in method; name, email and picture from Google if you use Google sign-in | Create and run your account, sign you in | Contract | Until you delete your account |
| Your content: conversations, prompts, AI replies, uploaded files, agents and settings | Provide the Service and show your history | Contract | Until you delete it or your account |
| Usage and credit records: which model, tokens, cost, time | Apply your credit, limits and prevent abuse | Contract; legitimate interests (preventing abuse and fraud) | While your account exists; records supporting payments up to 6 years |
| Payment records: payment reference, amount, currency, email, status, credit granted (we do not receive card numbers) | Take payment, refunds, accounting | Contract; legal obligation (tax and accounting) | 6 years |
| Technical data: IP address, browser, request and security logs | Security, fixing faults, preventing abuse | Legitimate interests | Limited period, generally not more than 90 days |
| Web search queries, when you switch web search on | Provide search results | Contract | Part of your conversation; the search provider applies its own policy |
| Emails you send us | Reply and keep a record | Legitimate interests; contract | Up to 3 years after the matter closes |
We do not sell personal data. We do not send marketing emails at the moment. If we start, we will follow the Privacy and Electronic Communications Regulations (PECR) and let you opt out.
2. Who receives your data
| Recipient | What for | Where |
|---|---|---|
| DigitalOcean | Hosting our servers and databases (our processor) | USA (New York) |
| Cloudflare | DNS, network security and performance (our processor) | Global network |
| Stripe | Payments and fraud prevention (acts as an independent controller for payment data) | UK, EEA, USA |
| AI model routing service | Routes your prompts, files and replies to the AI model you choose | USA |
| AI model providers (for example OpenAI, Google, Meta, DeepSeek, Moonshot AI, Mistral, Alibaba, xAI) | Generate replies to your prompts. Which provider is used depends on the model you pick | Varies, including outside the UK and EEA |
| Keenable | Web search and page retrieval, when you use web search | Varies |
| Sign-in with Google, if you choose it | Global | |
| Google (Analytics and Ads) | Website analytics and ad measurement, only if you accept optional cookies | Global |
| Meta Platforms | Ad measurement (Meta Pixel), only if you accept optional cookies | Global |
| MCP servers or tools you connect | Whatever you ask them to do. You choose these | Varies |
| Professional advisers, regulators, law enforcement | Where the law requires or to protect legal rights | UK |
Important: what you type, and files you upload, are sent to the model provider you select. Those providers have their own data policies. Some providers, especially for free or experimental models, may keep prompts or use them under their own terms. Please do not enter sensitive or confidential information (such as health data, passwords or other people's private data) unless you are comfortable with that. We do not use your conversations to train AI models.
3. Transfers outside the UK
Some of the recipients above are outside the UK. Where that happens we rely on a lawful transfer mechanism, such as the UK-US data bridge for certified US companies, the UK International Data Transfer Agreement or the UK Addendum to standard contractual clauses, or another safeguard allowed by UK GDPR. Ask us at info@velorafy.com if you want more detail.
4. Security
We use technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS), hashed passwords and restricted access to our systems. No system is completely secure. If a breach affects your rights, we will tell you and the ICO as the law requires.
5. Deleting your data
Email us from your account email and we will delete your account and associated content, normally within one month. We keep payment and accounting records for the legal period above. Backups may hold copies for a limited period (up to 35 days) before they are overwritten.
6. Your rights
You have the right to: be informed; access your data; have it corrected; have it erased; restrict or object to its use; receive it in a portable format; and withdraw consent where we rely on it. We reply to requests within one month. There is no charge unless a request is clearly unfounded or excessive.
To use any right, email info@velorafy.com.
7. Complaints
You can complain to us first at info@velorafy.com. We will acknowledge your complaint within 30 days, look into it without undue delay, keep you updated and tell you the outcome. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.
8. Children
The Service is for people aged 18 and over. We do not knowingly collect data from children. If you think a child has given us data, tell us and we will delete it.
9. Automated decisions
We do not make decisions about you that have legal or similarly significant effects by automated means. Our systems automatically pause requests when credit has run out.
10. Cookies
See our Cookie Policy.
11. Changes to this policy
We will update this page when our practices change and change the date at the top. For significant changes we will notify you by email or in the Service.