Privacy Policy

Veltrix, Inc. ("Veltrix", "we") provides a runtime for AI agents. This policy explains what we collect, why, how long we keep it, and the choices available to you. It applies to our websites, console, APIs and support channels.

1. Data we collect

• Account data: name, work email, company, role, billing contact and authentication metadata.
• Service data: agent definitions, tool calls, prompts, completions, traces and evaluation results that you submit or generate.
• Usage data: request counts, latency, error rates, feature usage and approximate region derived from IP.
• Support data: messages, attachments and call notes when you contact us.
• Website data: pages viewed, referrer and device type, collected with privacy-preserving analytics and no cross-site advertising trackers.

2. How we use data

We use data to provide and secure the Service, bill correctly, investigate incidents, improve reliability, and communicate about changes. We do not use customer prompts or completions to train models, and we do not sell personal information.

Aggregated, de-identified telemetry may be used to improve the product. De-identification removes account identifiers and is irreversible.

3. Legal bases (EEA/UK)

Where the GDPR applies, we rely on: performance of a contract (providing the Service), legitimate interests (security, reliability, product improvement), consent (optional marketing), and legal obligation (tax, accounting, lawful requests).

4. Sharing

We share data with subprocessors listed in our trust center, under written data protection terms. Categories include cloud infrastructure, edge networking, observability, billing and optional model providers. We disclose data to authorities only when legally compelled, and we publish a transparency report annually.

5. International transfers

Customer data is stored in the region selected at workspace creation (United States or European Union). Transfers from the EEA/UK rely on the European Commission's Standard Contractual Clauses and, where applicable, the UK Addendum.

6. Retention

Account data is kept while the account is active and for 12 months after closure for billing and legal records. Traces follow the retention setting of your plan or dataset configuration. Backups expire on a rolling 35-day cycle. Deletion requests are honored within 30 days, subject to legal holds.

7. Security

We use TLS 1.3 in transit, AES-256 at rest, scoped credentials, mandatory MFA for staff, and least-privilege access with quarterly reviews. We are SOC 2 Type II and ISO 27001 certified. No system is perfectly secure; we maintain an incident response plan and will notify affected customers without undue delay where required.

8. Your rights

Depending on your location, you may request access, correction, deletion, portability, or restriction of processing, and you may object to processing based on legitimate interests. California residents may also request disclosure of categories of information collected. Submit requests to [email protected]; we verify identity and respond within 30 days.

9. Cookies

We use strictly necessary cookies for authentication and load balancing. Optional analytics cookies are off until you consent, and you can change your choice at any time in the cookie banner. We do not use advertising cookies or third-party pixels.

10. Children

The Service is not directed to anyone under 18, and we do not knowingly collect data from children. If you believe a child has provided data, contact [email protected] and we will delete it.

11. Changes

We will post changes here and, for material changes, notify workspace administrators by email at least 30 days in advance.

12. Contact

Privacy team: [email protected]. Postal: Veltrix, Inc., Attn: Privacy, 535 Mission Street, 14th Floor, San Francisco, CA 94105. EU representative details are available in the trust center.

This document is a representative template prepared for design review. It is not legal advice and must be reviewed by qualified counsel before publication.