Privacy Policy

What Velxa does

Velxa produces AI diligence reports for M&A transactions and regulatory compliance. To produce these reports, Velxa's IRON pipeline analyzes publicly available signals about companies: job postings, public GitHub repositories, privacy policies, terms of service, product pages, and news. Velxa does not access any company's internal systems, proprietary data, or private communications.

Information we collect about you (the buyer)

When you order a report, we collect:

• Order information — name, email, company name, deal parameters you provide. Required to deliver your report.
• Payment information — processed by Stripe. Velxa does not store card numbers. Stripe's privacy policy governs payment data.
• Usage data — pages visited, time on site, referral source. Collected via server logs. Used to improve the product.
• Communications — if you email us, we retain those emails to respond and track follow-up.

We do not sell your data. We do not share your data with third parties except as required to deliver the service (Stripe for payments, Supabase for database hosting, Anthropic API for report generation, Mailgun for transactional email).

Information collected about target companies

IRON collects information about companies being researched (the "target") using only publicly available sources. This includes job postings, public GitHub repositories, publicly accessible privacy policies and terms of service, company websites, product pages, press releases, and SEC EDGAR filings. Velxa does not attempt to access, acquire, or process any non-public information about target companies.

Target company data is retained in Velxa's database to improve signal quality over time. This data consists entirely of information the target company has made publicly available.

Legal basis for processing (GDPR)

For individuals in the European Economic Area, our legal basis for processing personal data is:

• Contract performance — processing your order details to deliver the report you purchased.
• Legitimate interest — retaining order history for legal compliance, fraud prevention, and product improvement. We have balanced this against your interests and concluded our processing is proportionate.
• Legal obligation — retaining financial records as required by applicable tax law.

Data retention

Order records and delivered reports: retained for 12 months from delivery date, then deleted or anonymized. Financial records: retained for 7 years as required by US tax law. Email communications: retained for 12 months unless you request deletion. Usage logs: retained for 90 days.

Your rights

You have the right to access, correct, or delete personal data we hold about you. To exercise these rights, email privacy@velxa.ai. We will respond within 30 days. If you are in the EEA, you have the right to lodge a complaint with your national data protection authority.

Cookies

Velxa uses essential cookies only: session management and theme preference (light/dark mode). We do not use advertising cookies, tracking pixels, or third-party analytics scripts. No consent banner required for essential cookies.

Security

Data is encrypted in transit (TLS 1.3) and at rest (AES-256 via Supabase). Access to production systems is restricted to authorized personnel. Report download links are signed URLs that expire after 72 hours.

Changes to this policy

We will post material changes here with a new effective date. Continued use of the service after the effective date constitutes acceptance of the updated policy.

Contact

Velxa LLC
Email: privacy@velxa.ai