Privacy Policy

Effective date: July 21, 2026 · Last updated: July 21, 2026

This Privacy Policy explains how Velo ("Velo", "we", "us") collects, uses, and shares information when you use the Velo platform — our websites, APIs, agent runtime, and connectors (the "Service"). It applies to personal information we process as a controller. Where we process data on behalf of an organization to operate its agents, we act as a processor under that organization's instructions, and the organization's own privacy notice governs that data.

1. Information we collect

Information you provide

Account & organization data — name, email, organization details, and role, provided directly or via our authentication provider (WorkOS).
Agent configuration — instructions, prompts, schedules, triggers, and settings you create.
Credentials you authorize — OAuth tokens and API keys for services you connect. These are stored encrypted in a secrets vault, scoped per organization.
Support communications — messages you send us.

Information collected automatically

Usage & log data — actions in the Service, agent run activity and traces, timestamps, and error data.
Device & connection data — IP address, browser type, and similar technical metadata.
Cookies — strictly necessary cookies for authentication and session management. We do not use advertising cookies.

2. Data from connected services

When you connect a third-party service (such as GitHub, Slack, Jira, or Linear), we access and process data from it within the scopes you grant, so that agents can perform the tasks you request. Depending on the service and scope, this may include source code and repository contents, issues and tickets, messages and channels, and associated user identifiers. We access this data to operate the Service on your organization's behalf and do not use it for unrelated purposes. Working copies of repositories and agent session data are stored per organization and per agent instance to isolate tenants.

3. How we use information

Provide, operate, and secure the Service and run your agents.
Authenticate users and enforce organization access controls.
Execute agent tasks against the services you connect.
Monitor, debug, and improve reliability and performance.
Communicate about the Service, including security and administrative notices.
Prevent fraud, abuse, and violations of our Terms of Service.
Comply with legal obligations.

We do not sell your personal information, and we do not use your content or your organization's content to train our own foundation models.

4. AI & model providers

Operating agents requires sending prompts and relevant context — which may include Customer Data from connected services — to large language model providers. Depending on your organization's configuration, this is Anthropic (via the Anthropic API) or Anthropic models via Amazon Bedrock. These providers process the data to generate agent responses. We configure these integrations so that your content is not used to train the providers' models, subject to your provider settings and their terms.

5. Legal bases (EEA/UK)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

Performance of a contract — to provide the Service you or your organization requested.
Legitimate interests — to secure, maintain, and improve the Service, balanced against your rights.
Consent — where required, for example when you authorize a connected service.
Legal obligation — to comply with applicable law.

Within your organization — data is visible to authorized members and administrators of your tenant.
Service providers & sub-processors — vendors that host infrastructure, provide authentication, or power AI features, under contractual confidentiality and data-protection obligations.
Connected services — data you direct agents to write back to the third-party services you connect.
Legal & safety — when required by law or to protect rights, safety, and the integrity of the Service.
Business transfers — in connection with a merger, acquisition, or asset sale, subject to this Policy.

7. Sub-processors

We use the following categories of sub-processors to provide the Service:

Provider	Purpose
Amazon Web Services	Cloud infrastructure, compute, database, and storage hosting
Anthropic	Large language model inference for agents
Amazon Bedrock	Managed model inference (where configured by your organization)
WorkOS	Authentication and organization/SSO management
Infisical	Encrypted secrets management for connected-service credentials
Temporal	Durable workflow orchestration for agent runs

We maintain a current list of sub-processors and update it when we make changes. Contact us for the latest list.

8. Data retention

We retain personal information for as long as needed to provide the Service and for legitimate business or legal purposes. Agent activity, run traces, and working copies of connected data are retained according to your plan and configuration and are deleted or anonymized when no longer needed. When you disconnect a service or delete an organization, we delete or de-identify the associated data within a commercially reasonable period, except where retention is required by law.

9. Security

We use technical and organizational measures designed to protect information, including encryption of secrets at rest, scoped and short-lived access tokens, per-organization tenant isolation, network controls, and least-privilege access. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. International transfers

We may process and store information in countries other than yours, including the United States and the European Union. Where required, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses for cross-border transfers.

11. Your rights

Depending on your location, you may have rights to access, correct, delete, port, or restrict the processing of your personal information, and to object to certain processing or withdraw consent. To exercise these rights, contact us at the address below. If our processing is on behalf of an organization (as a processor), we will refer your request to that organization. You may also have the right to lodge a complaint with a supervisory authority.

12. Children

The Service is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.

13. Changes to this Policy

We may update this Policy from time to time. We will revise the "Last updated" date and, for material changes, provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance.

This document is a template provided for general use and does not constitute legal advice. Before relying on it in production, have it reviewed by qualified counsel, confirm the sub-processor list is accurate, and complete the bracketed details (legal entity name, jurisdiction, and contact addresses).

14. Contact

For privacy questions or to exercise your rights, contact us at privacy@velowork.io.