Privacy Policy

1. Who We Are

VeloXP, Inc. ("VeloXP," "we," "us," "our") is a California corporation based in San Francisco, California. We provide AI automation services and an AI workforce platform: AI agents, automation workflows, and a dashboard that operate on behalf of our business clients.

This policy covers our website at veloxp.com (the "Site") and the VeloXP platform, including the dashboard at dashboard.veloxp.com and the agents that run on it (the "Platform").

When we process information about our clients' own customers or contacts on a client's behalf (for example, records in a CRM the client has connected), we act as that client's service provider, and the client's privacy policy governs that information. Questions about it should go to the client first; we will help them respond.

2. Information We Collect

Information you give us

• Inquiries and assessments — when you request a scan, audit, or assessment, book a call, or complete an intake form, we collect details such as your name, email address, job title, company name, website, industry, location, and your answers to the form's questions.
• Purchases — when you buy a service, our payment processor, Stripe, collects your payment details. We receive your name, email, and billing and transaction details, but never your full card number.
• Account information — your name, email address, and sign-in credentials for the Platform (such as a passkey), or the basic profile an identity provider such as Google shares when you sign in with it.
• Business content — documents, messages, instructions, and records that you or your team provide to the Platform, and the work product our agents create for your organization.
• Communications — emails, chat messages, and voice messages or calls with us or with our agents, including recordings and transcripts where a voice feature is used.

Information collected automatically

• Proposal and report links — when you open a proposal or report we sent you, we record that it was viewed, along with your IP address, browser type, referring page, and campaign tags in the link.
• Platform activity — logs of actions in the Platform, including an audit trail of which agent actions ran and when integrations were connected or disconnected.
• Technical data — standard server logs kept by our hosting providers, such as IP address, browser type, and pages requested.

Information from connected services

Data from third-party services that you choose to connect to the Platform. See Section 3.

3. Connected Services

You may connect third-party services to your VeloXP organization, such as Google Workspace, Google Analytics, Google Search Console, YouTube, Microsoft Teams, QuickBooks Online, HubSpot, Salesforce, LinkedIn, Meta, or Calendly. Most connections use the provider's official authorization (OAuth) flow: you sign in with the provider and grant VeloXP the specific permissions shown on its consent screen. We never see or store your password for a service connected this way.

We access connected-service data only to do the work your organization directs, such as answering questions, preparing reports, drafting or sending messages, or creating records you ask for. Connected-service data is used only to provide the service to the organization that connected it. We do not sell it, use it for advertising, or share it with other customers.

Authorization tokens are stored on our servers, encrypted, and scoped to your organization. They are never sent to your browser or given to our agents directly. Our agents retrieve data from connected services when a task needs it. Results that become part of your organization's work, such as a conversation, report, or saved note, are kept with your other business content.

4. Google User Data

VeloXP's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide and improve the user-facing features you request, such as reading your analytics or Search Console data to build a report, or reading and sending email and calendar items when you ask an agent to.
• We transfer Google user data to others only as needed to provide those features (for example, to the AI model provider that generates an agent's response), for security, to comply with the law, or as part of a merger or acquisition with notice to you.
• We do not use Google user data for advertising, and we do not sell it.
• We do not use Google user data to develop, improve, or train generalized AI or machine learning models.
• Our staff do not read Google user data unless you give permission, it is needed for security or to investigate abuse, or it is required by law.

5. How We Use Information

• Respond to inquiries and prepare scans, audits, proposals, and reports you request
• Provide, operate, secure, and support the Platform and its AI agents
• Perform the tasks and workflows your organization configures or requests
• Process payments and manage subscriptions
• Communicate with you about your account, our services, and updates you have asked for
• Maintain audit trails, diagnose problems, and prevent fraud and abuse
• Produce aggregated, de-identified insights, such as benchmarks by industry or company size, that do not identify you, your organization, or your customers
• Comply with legal obligations and enforce our agreements

6. AI Processing

Our agents are powered by large language models from third-party AI providers, which may include Anthropic, OpenAI, and Amazon Bedrock, reached directly or through the routing service OpenRouter. To produce a response, the relevant content (your instructions, business content, and any connected-service data the task needs) is sent to the model provider. Voice features use speech providers to transcribe audio and generate speech.

We do not use your business content or connected-service data to train or fine-tune AI models. We access AI providers through their business APIs. Each provider's handling of the content it receives, including how long it retains it, is governed by that provider's API terms.

7. How We Share Information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share information only as follows:

• Service providers that process information on our behalf, including:
  • Hosting and infrastructure: Amazon Web Services (Platform) and Vercel (Site)
  • Databases: a hosted database provider (inquiry and lead records from the Site)
  • AI models: the providers named in Section 6, plus Perplexity for web research
  • Voice and speech: Retell, Twilio, ElevenLabs, and OpenAI (transcription)
  • CRM and scheduling: GoHighLevel and Calendly
  • Workflow automation and internal notifications: n8n and Telegram
  • Payments: Stripe
  • Email delivery: Amazon Simple Email Service
• Connected services — when you direct an agent to act in a connected service (for example, to send an email or create an invoice), we send that service the information needed to complete the action.
• Legal and safety — when required by law or legal process, or to protect the rights, safety, and security of VeloXP, our clients, or others.
• Business transfers — as part of a merger, acquisition, financing, or sale of assets, subject to this policy.
• With your consent or at your direction.

We never share one client's data with another client.

8. Cookies and Similar Technologies

On the Site, we do not set analytics or advertising cookies. Some pages load content from third parties (booking calendars from GoHighLevel and Calendly, and fonts from Google Fonts). Those providers receive your IP address and may set their own cookies under their own privacy policies.

On the Platform, we use only the cookies the service needs to work: a session cookie that keeps you signed in, a cookie used when our support staff view an account at a client's request, and a referral cookie that records a partner referral code for up to 30 days.

Because we do not sell or share personal information, we have nothing to switch off when your browser sends a Global Privacy Control or "Do Not Track" signal.

9. Data Storage and Security

The Platform runs on Amazon Web Services in the United States. Data is encrypted in transit (TLS) and at rest, and integration tokens are encrypted using keys managed by AWS Key Management Service. Access is limited to the systems and personnel that need it to run the service, each organization's data is kept separate from every other organization's, and connect and disconnect events are recorded in an audit log. No method of storage or transmission is completely secure, but we work to protect your information and will notify you of a breach as the law requires.

10. Data Retention and Disconnecting

We keep account and business data for as long as your organization's subscription is active, and after that until you ask us to delete it or we no longer need it for the purposes in this policy. We keep inquiry and lead information for as long as it is useful to our relationship with you. Operational logs are deleted automatically on schedules ranging from one day to one year. We may keep audit and billing records longer where security, legal, or accounting obligations require.

You can disconnect a connected service at any time from the dashboard. Disconnecting deletes the stored tokens for that connection right away. Where the provider supports it (for example, QuickBooks Online, Google Analytics, Google Search Console, and YouTube), we also revoke VeloXP's access at the provider. For other services, you can also remove VeloXP's access from that service's own account settings, such as your Google Account permissions. Disconnecting stops new access. Information already retrieved into your organization's work stays until it is deleted under this section.

11. Your Rights and Choices

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, and to object to or restrict certain processing. You can update account information in the dashboard, disconnect connected services at any time, and unsubscribe from marketing emails using the link in any such email.

To make any other request, email privacy@veloxp.com. We will verify your identity before acting on a request, respond within the time the law requires, and not discriminate against you for exercising your rights. If you are in the European Economic Area or the United Kingdom, we rely on these legal bases: performing our contract with you, our legitimate interests in running and improving our services, and your consent where we ask for it. You also have the right to complain to your local data protection authority.

12. California Residents

Under the California Consumer Privacy Act, as amended, California residents have the right to know what personal information we collect, use, and disclose; to delete it; to correct it; and not to be discriminated against for exercising these rights. You may use an authorized agent to make a request on your behalf.

In the past 12 months we have collected these categories of personal information: identifiers (such as name, email, and IP address), commercial information (such as purchases), internet activity (such as proposal views and Platform activity), professional information (such as job title and company), and account login credentials. We collect them from the sources and for the purposes described in Sections 2 and 5, and disclose them for business purposes only to the categories of recipients in Section 7. We do not sell or share personal information, and we use login credentials only to provide the service.

13. International Users

We are based in the United States, and we and our service providers process information there. If you use our services from outside the United States, your information will be transferred to and processed in the United States.

14. Children

Our services are designed for businesses and are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

15. Changes to This Policy

We may update this policy from time to time. We will give at least 30 days' notice of material changes by email to account holders, and the "Last updated" date above always shows the current version.