Legal
Security
Last updated: August 8, 2026
Contents
This page describes what happens to your data on Velrim: what is kept, for how long, and who processes it. Questions: hello@velrim.com.
Your documents
- Deleted at the end of every job. Staged document bytes live in object storage only while your job runs. The pipeline deletes them in its final step, on success and on failure.
- 24-hour backstop. Storage is independently configured to expire anything after 24 hours, so even if a deletion step could not run (a crash mid-job), nothing survives past 24 hours. Incomplete uploads are aborted and deleted the same way.
- Async results: 24 hours. For asynchronous jobs the result JSON is kept up to 24 hours so you can fetch it (or receive it by webhook), then it is deleted the same way. Synchronous results are returned in the HTTP response and never stored.
- The database never holds document content. Job records store identifiers, status, page counts, and timings: references, not content. The system is built so that document content has no path into the database.
- No training on customer data. We do not use your documents, or values extracted from them, to train models.
What we keep
| Data | What it contains | How long |
|---|---|---|
| Document bytes | Your document | Until end of job; 24 hours at most |
| Async results | Your extracted data | Up to 24 hours |
| Job metadata | ids, status, page counts, timings; no content | While your account exists |
| Wallet ledger | Amounts, timestamps, job ids; money records | Statutory tax/accounting period |
| Confidence-estimation statistics | Hashed field names, scores, outcome flags; never document values | Aggregate, indefinitely |
| Operational logs | Structured fields only: ids, timings, page counts, status; never request or document bodies | Short-lived operational window |
Field names in those statistics are hashed per customer, so even the shape of your schema is not readable there.
What we can and cannot see
We cannot go back and look at your documents. After a job completes (or fails) plus at most 24 hours, the bytes do not exist on our infrastructure. There is no admin view of document content, no content in the database to query, and no content in logs: logging is restricted to structured, content-free fields.
We can see: who ran jobs, when, how many pages, whether they succeeded, what they cost, and content-free reliability statistics. That is what operating the service and metering the prepaid wallet requires.
What leaves our infrastructure during a job: extraction requires sending document content to our model-inference providers for the duration of the request. Retention on the providers' side is governed by their own published terms. We do not claim zero retention on provider infrastructure; when written retention terms are signed with a provider we will state that here. Every provider in the path is named in the subprocessors section below.
Account deletion
Email hello@velrim.com from your account address. We verify it is you, delete your account data and content-free job history, and confirm, normally within 30 days. Billing records that tax law obliges us to keep are retained for the statutory period only, then deleted.
Subprocessors
These are the service providers that may process personal data on our behalf when you use Velrim. We will update this page before adding a new subprocessor and notify account holders by email (see the Data Processing Addendum, available on request, for the notice mechanics).
| Provider | Role | Data touched | Region |
|---|---|---|---|
| Cloudflare, Inc. | All infrastructure: compute, storage, database, and bot protection at signup (Turnstile) | Account data; transient document bytes (deleted at end of job, 24-hour backstop); content-free job metadata | US company; global edge network |
| OpenRouter, Inc. | Model API routing | Document content, transiently, for the duration of the model call | US |
| Model inference | Document content, transiently, for the duration of the model call | US / global | |
| Mistral AI | OCR of scanned documents | Scanned document pages, transiently, for the duration of the OCR call | France (EU) |
| Dodo Payments | Merchant of Record: checkout, card processing, tax collection and remittance, refunds, disputes | Billing identity (name, email, billing country), payment and tax data. Card details live with Dodo and its processors; we never see them | US |
| Resend | Transactional email (magic links, receipts, password resets, service notices) | Email address and the contents of those emails | US |
On model-provider retention: document content is deleted from Velrim infrastructure as described above. Retention on the model providers' side is governed by their own published terms per model; we do not currently claim zero retention on their infrastructure. When written retention terms are in place with a provider, we will say so here explicitly.