Legal
Privacy policy
Last updated: August 8, 2026
Contents
1. Who is responsible
This policy covers what Velrim processes as a controller (your account) and what happens to document data. For the contents of documents you submit to the API, you (or your organization) are the controller and we act as your processor under the Data Processing Addendum (available on request).
The data controller for your account data is Maksym Bogachov, sole proprietor, established in Spain, who provides Velrim. Contact: hello@velrim.com.
2. What we collect and why
Account data (we are the controller)
| Data | Where it comes from | Why | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| Email address, display name | You, at signup or via OAuth | Sign-in, magic links, receipts, service and security notices | Contract (6(1)(b)) |
| OAuth provider account identifier (Google or GitHub), if you sign in that way | The identity provider you chose | Linking your sign-in method to your account | Contract (6(1)(b)) |
| Password hash (if you use password sign-in) / passkey public key (if you register a passkey) | You | Authentication. We store a hash or public key, never a plaintext password | Contract (6(1)(b)) |
| Session records | Your browser | Keeping you signed in; detecting session misuse | Contract (6(1)(b)); legitimate interest in security (6(1)(f)) |
| API keys, stored as SHA-256 hashes only | Generated for you | Authenticating API requests. We cannot recover a lost key | Contract (6(1)(b)) |
| Billing events from our Merchant of Record (Dodo Payments): order ids, amounts, tax, refund/dispute status | Dodo Payments webhooks and API | Crediting your wallet, receipts, refunds, nightly reconciliation, bookkeeping | Contract (6(1)(b)); legal obligation for tax/accounting records (6(1)(c)) |
| Usage metadata: job ids, status, page counts, timings, never document content | Your API usage | Metering the prepaid wallet, showing your job history, abuse prevention | Contract (6(1)(b)); legitimate interest (6(1)(f)) |
We never see your full card details. Payment is taken by Dodo Payments, the Merchant of Record; card data lives with them and their payment processors.
Document data (you are the controller)
Documents you send to the API are processed transiently to produce your extraction result:
- Staged document bytes are deleted at the end of each job, on success and on failure, with a 24-hour storage backstop.
- Asynchronous job results are retained for at most 24 hours so you can fetch them; synchronous results are returned in the response and not stored.
- Our database stores job records by reference only (ids, status, counts), with no document content.
- Extraction requires sending document content to model providers (see Recipients below) for the duration of the request.
- We do not use your documents to train models. The only statistics we keep for improving confidence estimation are hashed field names, scores, and outcome flags, never document values.
Full detail: the security page.
3. Cookies and local storage
- A session cookie (set by our self-hosted auth system) keeps you signed in. It is strictly necessary; there is no separate consent banner for it.
- Two localStorage keys store preferences on your device:
theme(light/dark) andsdk-lang(your preferred code-example language). They never leave your browser. - Cloudflare Turnstile runs on signup to block bots.
- We use no advertising or cross-site tracking cookies.
4. Recipients
We share data only with the service providers needed to run Velrim: infrastructure, model inference, OCR, payment processing (our Merchant of Record), and transactional email. Each provider is named, with what it touches, in the subprocessors section of the security page.
If you sign in with Google or GitHub, that provider processes your login as its own controller under its own privacy policy: you chose it as your identity provider; it is not our subprocessor.
We do not sell personal data, and we do not share it with advertisers. We may disclose data if legally compelled, and will tell you when the law allows.
5. International transfers
We are based in Spain. Some providers process data outside the EU/EEA (mainly in the United States). Where that happens, transfers rely on the European Commission's Standard Contractual Clauses (SCCs) or another valid transfer mechanism in the provider's data processing agreement. Each provider's region is listed in the subprocessor table.
6. How long we keep things
| Data | Retention |
|---|---|
| Document bytes | Deleted at end of job; 24-hour lifecycle backstop |
| Async extraction results | Up to 24 hours |
| Job metadata (content-free) | While your account exists; deleted on account erasure |
| Account data (email, sign-in, keys) | While your account exists; deleted on account erasure |
| Wallet ledger and billing records | Kept as long as tax and accounting law requires, then deleted |
| Confidence-estimation statistics (hashed field names, scores, flags; no values) | Kept in aggregate; contains no document content |
| Operational logs (ids, timings, counts; never document content) | Short-lived; see the security page |
7. Your rights
Under the GDPR you can ask for access, rectification, erasure, restriction, portability, and you can object to processing based on legitimate interests. Where processing is based on consent, you can withdraw it at any time.
How: email hello@velrim.com from your account address. Erasure is currently a manual path: we verify it is you, then delete your account data and confirm, normally within 30 days. Billing records that tax law obliges us to keep are retained for the statutory period only.
You also have the right to complain to a supervisory authority, the Spanish one (the AEPD, aepd.es) or the one where you live or work.
8. Changes
We will update this policy as the service changes and note the date at the top. For material changes we will notify account holders by email.