Privacy Policy

1. Our Roles

1.1 Information We Process for Our Own Purposes

For website visitors, prospective clients, clients, vendors, and business contacts, Velvy generally determines why and how personal information is processed. In privacy-law terminology, Velvy acts as the controller, business, or equivalent responsible organization.

1.2 Information We Process for Clients

Our clients may use our Services to collect or process information about their callers, customers, leads, employees, contractors, website visitors, and other individuals.

For that “Client Service Data”:

• The client generally determines why the information is collected and how it will be used.
• The client acts as the controller, business, or equivalent responsible organization.
• Velvy generally acts as the processor, service provider, contractor, or equivalent processing organization.
• We process the information according to the client’s lawful instructions, our agreement with the client, and applicable law.

The client’s privacy policy, notices, and instructions govern its use of Client Service Data.

Individuals seeking to exercise rights concerning Client Service Data should normally contact the relevant client directly. We will assist our client as required by our agreement and applicable law.

2. Personal Information We Collect

The information we collect depends on how you interact with us and which Services are used.

2.1 Contact and Identity Information

We may collect:

• Name.
• Business name.
• Job title or role.
• Email address.
• Telephone number.
• Mailing or billing address.
• Country, state, province, or region.
• Account username or profile information.
• Signature and evidence of contract acceptance.
• Communication preferences.

2.2 Business and Project Information

We may collect:

• Information about your business, products, services, prices, customers, goals, workflows, and technology.
• Proposal, project, support, and onboarding information.
• Website content, branding, logos, images, documents, and other materials.
• Technical requirements, system configurations, and integration details.
• Feedback, survey responses, approvals, and project communications.
• Information contained in files or data that you upload or make accessible.

2.3 Payment and Transaction Information

When you make a purchase, we may collect:

• Products or Services purchased.
• Transaction amount, currency, date, and status.
• Billing name and billing address.
• Tax information.
• Subscription and renewal information.
• Payment-method type and limited payment details supplied by our payment processor.
• Refund, dispute, invoice, and payment-history information.

Payment transactions may be processed by Stripe or another payment provider.

We generally do not receive or store complete card numbers, card-security codes, or payment authentication credentials.

Payment providers process payment information under their own privacy notices and legal obligations.

2.4 Voice, Call, Chat, and Communications Information

When you interact with an AI receptionist, voice demonstration, chatbot, support system, telephone system, or communications workflow, we may collect or process:

• Audio recordings, where recording is enabled.
• Voice input and speech.
• Transcripts and summaries.
• Telephone numbers.
• Caller and recipient identity information.
• Call time, date, duration, routing, status, and metadata.
• Messages and chat content.
• Appointment requests and calendar details.
• Questions, responses, preferences, and other information communicated during an interaction.
• AI-generated responses, classifications, and summaries.
• Information concerning whether an interaction was transferred to a human.
• Technical information concerning call quality and system performance.

Where we provide these systems for a client, the client determines whether recordings are enabled, what notices are provided, and how the information is used, subject to our agreement.

Do not provide sensitive information during a demonstration unless it is necessary and you are authorized to do so.

2.5 Customer, Lead, and CRM Information

Depending on a client’s configuration, our Services may process:

• Names and contact information.
• Customer inquiries.
• Lead status.
• Quote or booking requests.
• Service history.
• Communication and follow-up history.
• Customer feedback and review activity.
• Calendar, CRM, accounting, or job-management records.
• Information provided through forms, calls, texts, emails, chats, or integrations.

This information is normally Client Service Data processed on behalf of the client.

2.6 Integration Information

If you connect or authorize a third-party service, we may receive information made available through that integration, such as:

• Account and workspace identifiers.
• Calendar availability and events.
• CRM contacts and records.
• Website, domain, hosting, analytics, and advertising information.
• Payment, invoice, or transaction information.
• Communications and messaging records.
• Job-management or customer-support records.
• Access tokens and authorization information.

We use integration information to provide the requested connection and Services.

You are responsible for ensuring that you are authorized to connect the account and provide access to the associated information.

2.7 Device, Usage, and Website Information

We may automatically collect:

• Internet Protocol address.
• Browser type and version.
• Device type and operating system.
• Language and approximate location.
• Referring and exit pages.
• Pages viewed and actions taken.
• Date, time, and duration of visits.
• Cookie and similar-technology identifiers.
• Error logs, performance data, and security events.
• Interaction with forms, links, demonstrations, and website features.

2.8 Marketing and Communications Information

We may collect:

• Email and message content.
• Meeting recordings or notes where disclosed.
• Marketing preferences.
• Whether communications were opened, delivered, or interacted with.
• Requests to subscribe, unsubscribe, or opt out.
• Records of consent and revocation.
• Information from business networking, referrals, or public professional sources.

2.9 Sensitive Information

Our standard Services are not designed for the intentional collection of:

• Full payment-card information.
• Medical records or protected health information.
• Government identification numbers.
• Biometric templates used for identification.
• Precise financial-account credentials.
• Highly sensitive passwords.
• Children’s information.
• Information subject to specialized professional-secrecy requirements.

Do not provide these categories unless we have expressly agreed in writing to process them and appropriate safeguards and contractual terms are in place.

A caller or user may voluntarily disclose sensitive information during a call or communication. Where we process that interaction for a client, the client is responsible for configuring appropriate notices, minimization, retention, and deletion procedures.

3. Sources of Personal Information

We may obtain personal information:

• Directly from you.
• From the business or organization you represent.
• From our clients.
• From callers, customers, leads, website users, and other persons interacting with Client systems.
• From third-party integrations authorized by a client or user.
• From payment, hosting, telecommunications, analytics, scheduling, CRM, and other providers.
• From referrals and business partners.
• From publicly available business and professional sources.
• Automatically through cookies, logs, and similar technologies.

4. How We Use Personal Information

We may use personal information to:

1. Operate, maintain, and secure our website and Services.
2. Respond to inquiries and schedule meetings.
3. Prepare proposals and enter into contracts.
4. Process transactions, invoices, subscriptions, taxes, and payments.
5. Provide website, hosting, AI, communications, automation, marketing, development, and consulting Services.
6. Configure integrations and client systems.
7. Route calls, messages, inquiries, and appointments.
8. Produce transcripts, summaries, reports, analytics, and AI-generated responses.
9. Provide support, maintenance, training, and documentation.
10. Personalize and improve user experience.
11. Monitor performance, reliability, quality, and security.
12. Detect fraud, abuse, unauthorized access, and violations of our agreements.
13. Debug errors and maintain technical functionality.
14. Communicate operational, billing, security, and service information.
15. Send marketing communications where permitted.
16. Maintain consent, suppression, unsubscribe, and do-not-contact records.
17. Establish, exercise, or defend legal claims.
18. Comply with laws, court orders, regulatory obligations, and lawful requests.
19. Complete a corporate transaction, financing, reorganization, acquisition, or sale.
20. Create aggregated or de-identified information that does not reasonably identify an individual.

We do not use Client Service Data for unrelated independent marketing.

We do not use Client Service Data to train generalized AI models owned by Velvy unless the applicable client expressly agrees in writing.

5. Legal Bases for Processing

Where laws such as the European Economic Area or United Kingdom data-protection laws require a legal basis, we may process personal information based on:

Contract

We process information when necessary to enter into or perform a contract, provide requested Services, process payment, or manage a business relationship.

Legitimate Interests

We may process information for legitimate business interests, including:

• Operating and improving our Services.
• Securing systems.
• Preventing fraud and abuse.
• Communicating with business contacts.
• Managing client relationships.
• Measuring website and service performance.
• Establishing or defending legal claims.

We consider the potential impact on individuals before relying on legitimate interests.

Consent

We may rely on consent for certain marketing, recording, cookie, communications, or optional processing activities.

Consent may be withdrawn where legally applicable, but withdrawal does not affect processing already lawfully completed.

Legal Obligations

We may process information to comply with tax, accounting, regulatory, court, law-enforcement, sanctions, and other legal requirements.

Client Instructions

For Client Service Data, our client determines the applicable legal basis. We process the information under the client’s instructions and our agreement with the client.

6. Artificial Intelligence and Automated Processing

We may use artificial intelligence and machine-learning providers to:

• Convert speech to text.
• Generate or assist with responses.
• Summarize conversations.
• Classify inquiries.
• Route communications.
• Extract appointment or contact details.
• Generate or assist with marketing content.
• Analyze workflows and system performance.
• Operate custom agents and automations.

AI systems can produce inaccurate or unexpected results. We may use automated processing to support the Services, but we do not make solely automated decisions about individuals that produce legal or similarly significant effects on behalf of Velvy.

A client may configure its own use of automation. The client is responsible for determining whether human review, consent, notices, impact assessments, or other safeguards are legally required.

We may send information to third-party AI providers acting as service providers or subprocessors. Their processing is governed by our arrangements with them, the relevant technical configuration, and applicable law.

Where available and appropriate, we use commercial or API configurations designed to restrict providers from using Client Service Data to train generalized public models.

7. How We Disclose Personal Information

We may disclose personal information to the following categories of recipients.

7.1 Clients

Where you interact with a system operated for a client, we disclose the interaction and associated information to that client.

This may include recordings, transcripts, messages, summaries, contact details, appointment information, and communication metadata.

7.2 Service Providers and Subprocessors

We may use providers for:

• Cloud hosting and storage.
• Website hosting and content delivery.
• Artificial intelligence and machine learning.
• Speech recognition, transcription, and voice generation.
• Telecommunications, telephone numbers, call routing, email, and SMS.
• Scheduling and calendar services.
• CRM and customer support.
• Payment processing and invoicing.
• Analytics and error monitoring.
• Security and fraud prevention.
• Document signing and contract management.
• Accounting, legal, and professional services.
• Marketing and communications.

These providers may process information only as necessary to perform services for us, subject to their contractual and legal obligations.

7.3 Client-Selected Integrations

When a client connects a CRM, calendar, telephone, messaging, payment, accounting, advertising, review, social-media, or other platform, we disclose information to that platform as directed by the client.

The third party’s own privacy policy applies to its independent processing.

7.4 Professional Advisers

We may disclose information to lawyers, accountants, insurers, auditors, consultants, and other advisers where reasonably necessary.

7.5 Legal and Safety Disclosures

We may disclose information when we reasonably believe disclosure is necessary to:

• Comply with law, legal process, or a lawful government request.
• Enforce contracts and policies.
• Protect the rights, property, or safety of Velvy, our clients, users, or others.
• Detect, investigate, or prevent fraud, abuse, security incidents, or unlawful activity.
• Respond to an emergency involving risk of serious harm.

7.6 Business Transactions

Information may be disclosed or transferred in connection with a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction.

7.7 With Your Direction or Consent

We may disclose information when you direct us to do so or provide consent.

8. Sale and Targeted Advertising

As of the Last Updated date:

• We do not sell personal information for monetary consideration.
• We do not knowingly sell Client Service Data.
• We do not use Client Service Data for cross-context behavioral advertising.
• We do not knowingly sell or share personal information belonging to children under 16.

Certain analytics or advertising technologies may be treated as a “sale,” “sharing,” or targeted advertising under some privacy laws even when no money is exchanged.

If we begin using technologies that trigger an opt-out obligation, we will provide the required notice and opt-out mechanism and update this Policy.

Where legally required and technically applicable, we will process recognized opt-out preference signals, such as Global Privacy Control.

9. Cookies and Similar Technologies

We may use cookies, pixels, local storage, software development kits, and similar technologies.

These technologies may be used for:

• Essential website functionality.
• Security and fraud prevention.
• Remembering preferences.
• Understanding website use.
• Measuring performance.
• Diagnosing errors.
• Improving content and Services.
• Marketing or advertising where enabled and legally permitted.

You can control cookies through browser settings and any cookie-management tools we make available.

Blocking cookies may affect website functionality.

Browser “Do Not Track” signals are not interpreted consistently across the industry. We respond to legally required preference signals where applicable.

10. Marketing Communications

We may send business and marketing communications where permitted by law.

You may unsubscribe from marketing email by using the unsubscribe link or contacting hello@velvy.ai.

You may opt out of SMS marketing by following the instructions in the message, such as replying STOP, where applicable.

We may continue sending non-marketing communications concerning:

• Active projects.
• Transactions and invoices.
• Security.
• Service changes.
• Legal notices.
• Support requests.
• Other aspects of an existing business relationship.

Where we send communications for a client, the client is responsible for the recipients, content, consent, and legal basis. We process suppression and opt-out instructions according to the client’s configuration and our agreement.

11. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including to:

• Provide the Services.
• Maintain business and transaction records.
• Comply with legal, accounting, and tax requirements.
• Resolve disputes.
• Enforce agreements.
• Maintain security and suppression records.
• Complete backups and disaster recovery.

Retention periods vary according to:

• The type and sensitivity of information.
• Client instructions.
• Service configuration.
• Contract duration.
• Legal limitation periods.
• Regulatory requirements.
• Security and operational needs.

Client Service Data is retained according to the applicable agreement, client settings, and lawful instructions.

After termination, Client Service Data may be deleted or returned subject to the applicable agreement. Residual copies may remain temporarily in secure backups until overwritten according to our backup cycle.

We may retain aggregated or de-identified information that does not reasonably identify an individual.

12. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information.

Depending on the Services, safeguards may include:

• Access controls.
• Authentication.
• Encryption in transit.
• Logging and monitoring.
• Segregated accounts or environments.
• Provider and contractor restrictions.
• Backup and recovery procedures.
• Security updates.
• Incident response procedures.

No internet transmission, telecommunications network, AI system, cloud service, or storage system can be guaranteed completely secure.

You are responsible for:

• Protecting your credentials.
• Restricting user access.
• Using strong authentication.
• Maintaining secure devices.
• Promptly reporting suspected unauthorized access.
• Configuring Client systems appropriately.

13. International Data Transfers

Velvy is based in the United States and may use providers operating in the United States and other countries.

Personal information may therefore be transferred to and processed in countries whose privacy laws differ from those of your location.

Where legally required, we use appropriate safeguards for international transfers, which may include:

• Contractual protections.
• Standard contractual clauses.
• Data processing agreements.
• Provider security and privacy commitments.
• Transfer assessments.
• Other legally recognized mechanisms.

A client is responsible for determining whether its use of the Services requires additional transfer disclosures, contractual terms, or approvals.

14. Your Privacy Rights

Depending on your location and applicable law, you may have rights to:

• Request access to personal information.
• Obtain a copy of personal information.
• Correct inaccurate information.
• Request deletion.
• Request restriction of processing.
• Object to certain processing.
• Withdraw consent.
• Request data portability.
• Opt out of sale, sharing, or targeted advertising.
• Limit certain uses of sensitive personal information.
• Appeal the denial of a privacy request.
• Complain to a privacy or data-protection regulator.
• Receive equal service without unlawful discrimination for exercising a privacy right.

These rights are not absolute. Exceptions may apply, including where information must be retained for security, legal compliance, contract performance, freedom of expression, or legal claims.

14.1 Submitting a Request

Submit a request to:

hello@velvy.ai

Include sufficient information for us to understand the request and identify the relevant relationship or account.

We may request reasonable verification of identity and authority before responding.

Authorized agents may submit requests where permitted by law. We may require evidence of authorization and direct identity verification.

14.2 Client Service Data Requests

If your information was collected through a Velvy system operated for one of our clients, submit your request to that client.

Identify the relevant business when contacting us. We may forward the request to the client or tell you how to contact it.

14.3 Appeals

Where applicable law provides an appeal right, you may appeal a denied request by replying to our decision or contacting hello@velvy.ai with the word “Privacy Appeal” in the subject line.

15. United States State Privacy Disclosures

During the preceding 12 months, we may have collected the categories described in Section 2, including:

• Identifiers and contact information.
• Customer-record information.
• Commercial and transaction information.
• Internet and electronic-network activity.
• Geolocation at an approximate level.
• Audio and communications information.
• Professional and employment-related information.
• Inferences generated from business interactions.
• Sensitive information voluntarily supplied during communications.

We collect these categories from the sources described in Section 3, use them for the purposes described in Sections 4 and 6, and disclose them to the categories of recipients described in Section 7.

We retain each category as described in Section 11.

We do not use sensitive personal information to infer characteristics about individuals for unrelated purposes.

We do not offer financial incentives in exchange for personal information unless we provide a separate legally required notice.

16. Australia and New Zealand

Individuals in Australia or New Zealand may request access to or correction of personal information by contacting hello@velvy.ai.

Personal information may be processed in the United States and other countries where our providers operate.

Where we process personal information for an Australian or New Zealand client, that client remains responsible for determining its obligations concerning:

• Collection notices.
• Consent.
• Direct marketing.
• Call recording.
• Cross-border disclosure.
• Access and correction requests.
• Data retention.
• Notifiable privacy breaches.

We will provide reasonable assistance consistent with our agreement and applicable law.

17. European Economic Area and United Kingdom

Individuals in the European Economic Area or United Kingdom may have the rights described in Section 14.

You may also lodge a complaint with the data-protection authority in the country where you live, work, or believe an infringement occurred.

Where Velvy processes Client Service Data on behalf of a client, the client is responsible for providing the applicable privacy notice and identifying its legal basis.

Where required, Velvy and the client will enter into a Data Processing Agreement addressing processor obligations and international transfers.

18. Children’s Privacy

Our website and Services are intended for businesses and adults and are not directed to children.

We do not knowingly collect personal information directly from children under 13 for our own purposes.

Clients must not configure the Services to intentionally collect information from children without Velvy’s prior written approval and all legally required notices, consents, and safeguards.

Contact hello@velvy.ai if you believe a child has provided personal information to us improperly.

19. Third-Party Websites and Services

Our website and Services may link to or integrate with third-party websites and services.

We do not control their independent privacy or security practices.

Review the privacy policies and terms of those third parties before providing information or enabling an integration.

20. Changes to This Policy

We may update this Privacy Policy to reflect changes in our Services, providers, legal obligations, or practices.

We will publish the updated Policy with a revised Last Updated date.

Where required by law or contract, we will provide additional notice of material changes.

Changes do not retroactively authorize materially different processing where additional consent is legally required.

21. Contact Us

For privacy requests, use the subject line: Privacy Request.