Privacy Policy

Last Updated: May 7, 2026 · Effective Date: May 7, 2026

1. Introduction & Who We Are

This Privacy Policy describes how Velyra LLC ("Velyra," "we," "us," or "our") collects, uses, stores, and shares personal information when you visit our website (velyra.us), use our live demonstration feature, or subscribe to our AI inbound call automation software service (collectively, the "Service"). We are committed to protecting your privacy and handling your data in a transparent, lawful, and responsible manner.

Data Controller: Velyra LLC · Email: hello@velyra.us

2. Information We Collect

We collect the following categories of personal information:

Account Information: Name, business name, email address, and billing information provided when creating a subscriber account.
Demo Interaction Data: Voice audio, speech-to-text transcriptions, and any information you voluntarily provide during use of the live AI demo (e.g., a test name or phone number). Please do not submit real personal data in the demo.
Caller Data (Subscribers): When businesses deploy the Service, their callers' voice audio, transcriptions, and any information provided during an inbound call (e.g., name, phone number, appointment details) may be processed.
Usage & Technical Data: IP addresses, browser type, device identifiers, pages visited, and interaction logs collected automatically via cookies and analytics tools.
Communications: Any emails, support requests, or messages you send us.

3. Lawful Basis for Processing (GDPR)

For individuals in the European Economic Area (EEA), United Kingdom, or Switzerland, we process personal data under the following lawful bases as defined by the EU General Data Protection Regulation (GDPR):

Consent (Art. 6(1)(a)): Where you have provided explicit consent, such as when participating in the live demo or opting in to communications.
Contract (Art. 6(1)(b)): Where processing is necessary to fulfil a subscription contract or respond to a pre-contractual request.
Legitimate Interests (Art. 6(1)(f)): Where we have a legitimate business interest, such as preventing fraud, improving service reliability, and conducting analytics — balanced against your privacy rights.
Legal Obligation (Art. 6(1)(c)): Where processing is required to comply with applicable law.

You have the right to withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of prior processing.

4. How We Use Your Information

To provide, operate, and maintain the Service and your subscriber account;
To process payments and manage billing;
To generate AI voice responses and call transcripts for the inbound call automation software;
To improve the accuracy, performance, and reliability of our AI models and platform;
To send transactional emails, service notifications, and (with your consent) marketing communications;
To comply with legal obligations and enforce our Terms of Service;
To prevent fraud, abuse, and unauthorized access to the Service.

5. Call Recording & AI Interaction Consent

Our Service enables subscriber businesses to record and transcribe inbound telephone calls handled by the AI agent. Subscriber businesses are solely responsible for:

Disclosing to their callers that calls are being answered by an AI system and may be recorded;
Obtaining any call recording consents required by applicable federal and state law (including two-party consent states);
Ensuring their use of the Service complies with the TCPA, applicable state wiretapping statutes, and GDPR where applicable.

Velyra AI's platform can be configured to include a compliant consent disclosure at the start of every call (e.g., "This call may be recorded and handled by an automated AI system."). We strongly recommend enabling this feature.

6. Third-Party Data Processors

To deliver the Service, we share limited data with the following categories of trusted third-party processors under strict data processing agreements:

AI Voice Infrastructure (Vapi.ai, OpenAI, Deepgram): Voice audio and transcripts are processed in real time to generate AI responses. These providers do not use your data to train public AI models.
Payment Processing (Paddle): Billing and subscription management. Paddle acts as Merchant of Record and processes payment card data in accordance with PCI-DSS standards.
Analytics (e.g., Vercel Analytics): Aggregate, anonymized usage statistics to improve performance.
Cloud Infrastructure (Vercel, Google Cloud): Hosting and data storage within secure, SOC 2-compliant environments.

We do not sell your personal data to any third parties for advertising or marketing purposes.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy:

Account data: Retained for the duration of the subscription and for up to 3 years after account closure for legal and audit purposes.
Call recordings & transcripts: Retained for up to 12 months by default, after which they are permanently deleted unless the subscriber requests extended retention.
Demo interaction data: Deleted within 30 days of collection.
Billing records: Retained for 7 years to comply with financial regulations.

8. Your Rights Under GDPR

If you are located in the EEA, UK, or Switzerland, you have the following rights regarding your personal data:

Right to Access: Request a copy of the personal data we hold about you.
Right to Rectification: Request correction of inaccurate or incomplete data.
Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data, subject to legal retention obligations.
Right to Restrict Processing: Request that we limit how we process your data in certain circumstances.
Right to Data Portability: Receive your personal data in a structured, machine-readable format.
Right to Object: Object to processing based on legitimate interests or for direct marketing purposes.
Right to Withdraw Consent: Withdraw any previously given consent at any time.

To exercise any of these rights, please contact us at hello@velyra.us. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority.

9. Your Rights Under CCPA (California Residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights:

Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you.
Right to Delete: Request deletion of your personal information, subject to certain exceptions.
Right to Opt-Out of Sale: We do not sell personal information. However, you may contact us to confirm this at any time.
Right to Non-Discrimination: We will not discriminate against you for exercising any CCPA rights.

To submit a CCPA request, contact us at hello@velyra.us with the subject line "CCPA Privacy Request."

10. Cookies & Tracking Technologies

We use essential cookies to operate the Service (e.g., session management) and optional analytics cookies to understand how visitors use our website. You can disable non-essential cookies through your browser settings. We do not use cookies for targeted advertising.

11. International Data Transfers

Our Service is operated primarily from the United States. If you are located outside the US, your data may be transferred to and processed in the US. For transfers from the EEA to the US, we rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses (SCCs) as approved by the European Commission.

12. Security

We implement commercially reasonable technical and organizational security measures to protect your personal data against unauthorized access, loss, or disclosure. All data in transit is encrypted using TLS 1.2+. Sensitive data at rest is encrypted using AES-256. However, no system is completely secure and we cannot guarantee absolute security.

13. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by posting the updated policy on this page with a revised "Last Updated" date. For material changes affecting active subscribers, we will also provide notice via email. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

14. Contact & Privacy Requests

For any questions, concerns, or to exercise your privacy rights, please contact our Privacy Team:
Velyra LLC — Privacy Team
Email: hello@velyra.us
Subject line: "Privacy Request"
We aim to respond to all privacy requests within 30 days.