Velcio LTD ("Velcio LTD", "Velcio", "we", "us", or "our") processes personal information for the Velcio website, applications and related products (the "Service"), currently Velcio Marketplace, Velcio Cloud and Matz. Read this Privacy Policy (this "Policy") with our Terms of Service.
Creating an account or using the Service means you acknowledge this Policy. We may update it. Changes take effect on the "Last updated" date on this page. For material changes we may also notify you in the Service or by email.
1. The short version
This summary is for convenience only. The full Policy below controls.
- Information we collect
- Account and profile data are shared across Velcio (via Clerk). Product data is separate: Marketplace projects and disputes, Cloud build/hosting/runtime data, and Matz prompts and workspaces. For Cloud workloads we also collect routing, resource, network and security signals needed to operate and protect the hosting service. We collect essential cookies and Stripe payment metadata.
- Legal bases
- Under UK GDPR: contract, consent (marketing email), legitimate interests (including service security, fraud and abuse prevention, provider protection and moderation) and legal obligation.
- How we use it
- To run the Service (auth, Marketplace payments, Cloud hosting, Matz runs), send transactional email, send optional product-updates or marketing email you opt into, and for security and compliance.
- How long we keep it
- Only as needed. Profile fields are usually anonymised within 30 days after verified deletion (after a 30-day grace period). Payment and project records may be kept up to six years. Routine build and ops logs are typically kept up to 90 days. Records under an active security, complaint or legal hold may be kept longer and reviewed when the hold ends.
- Sharing
- Named providers you use directly (Clerk, Stripe and GitHub when connected), plus infrastructure processors for hosting, edge delivery, email and storage. We do not sell personal information. Marketplace counterparties and Velcio staff may see project details needed for delivery, disputes or security. We may share limited case information with an affected infrastructure provider when investigating or responding to a verified abuse report.
- Where we process
- UK, EEA, US and other countries via subprocessors, with UK GDPR transfer tools where required (for example IDTA or SCCs with UK addendum).
- Cookies
- We use essential cookies for authentication, security and core product functionality. See Section 12.
- Your rights
- Access, correct, export or delete much of your data in Account settings, or email support@velcio.dev for other UK GDPR requests. We respond within one month of a verified request (extendable by up to two months for complex cases).
- Children
- The Service is for users 18+. We do not knowingly collect data from children.
- Contact
- support@velcio.dev. Controller details are in Section 15.
2. Information we collect
Categories depend on the products you use. Account identity is shared across the platform. Marketplace, Cloud and Matz product data are separate and are not fused into one "project" record for privacy purposes.
Account and profile data (shared)
- Sign-in and identity data from Clerk (name, email, username and authentication identifiers). One Velcio account may access more than one product.
- Your Velcio username, a public identifier for assignment and marketplace discovery where those features apply.
- Profile and preference data from sign-up and onboarding (for example Marketplace buyer/developer mode, optional profile fields and email preferences).
- Email consent: whether you opted in to product-updates email for Velcio Marketplace, Velcio Cloud and/or Matz, and to marketing email across Velcio, plus consent timestamps. Each opt-in is optional and off by default unless you enable it in onboarding or Account settings.
- If a developer opts into the public Marketplace directory, listed profile fields (headline, skills, ratings, completed-project count, links and avatar) are visible to other users and may be indexed by search engines.
- Terms and eligibility acceptance: the date and Terms of Service version you accepted. We use that acceptance to record that you meet the account eligibility requirements in the Terms; we do not ask new users for a date of birth.
- Content reports you submit, moderation records, and user-block relationships you create.
Velcio Marketplace project data
- Project details, listings, proposals, messages, price offers, delivery metadata, invites, dispute records (remediation terms, accept windows, remove/takeover timestamps and outcomes) and related audit events.
- Collaboration files you upload (reference documents, images or handoff ZIPs), including filename, size and scan status. Contents are stored for collaboration and disputes and deleted under retention and account-deletion rules. After a developer is removed from an open dispute, that developer may only access files created before removal. The buyer and Velcio staff may use later files for resolution and takeover.
- When you connect the Velcio GitHub App for Marketplace delivery import, GitHub may provide installation and repository metadata needed to import the selected content.
- Review preview and optional post-accept hosting run on Velcio Cloud. Build, deploy, runtime and hostname data for those workloads are Cloud data.
Velcio Cloud build, hosting and runtime data
- App inventory and metadata (names, project types, plan or subscription status, hostnames such as
*.velcio.app). - Delivery archives (ZIP uploads and source-control snapshots), build metadata, deployment and runtime logs, web request and routing metadata, hostname state, and worker or replica health signals.
- Runtime resource and network measurements such as CPU, memory, outbound traffic volume, connection and packet rates, and host-observed destination IP addresses and connection counts. These measurements help us detect operational faults and possible abuse. They do not give us a list of processes running inside your app.
- At the edge, bounded response and connection hints such as status, declared content type or length, Range-request presence and WebSocket status. We do not buffer response bodies for this monitoring, and these hints do not establish what content was delivered.
- Security and abuse records, including alerts, risk assessments, provider ticket references, complaint categories and deadlines, relevant deployment or hostname snapshots, containment acknowledgements, staff decisions and appeals. We ask staff not to copy secrets, request bodies or prohibited content into case summaries.
- Production secrets you submit. Secrets are stored encrypted for deployment. Velcio does not show decrypted secret values in the UI.
- Logs and archives may include third-party or end-user data from apps you deploy. Where that is personal data about your app's end users, you are typically the controller and Velcio is a processor (see Section 6).
- This category covers apps created in Cloud, Marketplace review previews and hosting on Cloud, and Matz deploy or promote flows that use Cloud.
Matz prompts, workspaces and agent events
- Prompts, chat messages, clarifying answers and product or stack decisions in Matz threads.
- Agent run records (status, trigger, billing metadata, errors) and events used to show run progress.
- Workspace archives and related grade or preview metadata.
- Pre-run cancel/revert snapshots and restore metadata, retained as needed to complete or abandon a restore.
- Optional GitHub connection metadata for workspace sync where you connect source control.
- Preview deploy and promote create or update Cloud apps. Those records are Cloud data.
Payment data
- Payment and payout records via Stripe (checkout session IDs, payment intent status, connected account IDs, subscription status, Matz charges). Velcio does not store full card numbers. Stripe may collect identity or tax data for Connect under Stripe's own privacy notice.
Technical and operational data
- Logs, security events, queue or job metadata, deployment identifiers and infrastructure signals across products.
- Basic device and usage data (for example IP address, pages visited and authentication cookies).
Communications data
- Transactional emails about your account and product activity (Marketplace invites, funding, delivery and disputes, Cloud hosting status, Matz run or billing notices). Some categories can be limited in Account settings.
- Optional product-updates and marketing email only when you opt in. We store each opt-in and timestamp. You can withdraw consent in Account settings. Marketing email is not required to use the Service.
3. Legal bases for processing
Under UK GDPR we process personal information on these bases:
- Contract: to provide the Service, authenticate you, process Marketplace funding and payouts, Cloud hosting, Matz billing and related features, and to record Terms acceptance.
- Consent: product-updates and marketing email, and other processing where we ask for consent. Withdraw email consent in Account settings.
- Legitimate interests: security, fraud and abuse prevention, audit logs, age eligibility, content moderation, error monitoring, protecting customers and our infrastructure providers from harmful workloads, responding to verified provider complaints, and avoiding service or provider suspension, where those interests are not overridden by your rights.
- Legal obligation: tax, accounting, regulatory duties and lawful requests.
Automated safeguards. Rules and risk signals may automatically flag a workload for review or apply a temporary technical safeguard, such as limiting network access, blocking a hostname or stopping a workload, when thresholds indicate an immediate platform or provider risk. Signals include resource and network rates, security events and verified complaint state. A signal is not treated as proof of a violation. Staff decide provider complaint outcomes, account termination and whether to release complaint-based containment. You may ask us to explain and review a decision, submit your view and contest it by emailing support@velcio.dev or using an in-product appeal where available.
Where we rely on legitimate interests, you may object where law allows. Contact support@velcio.dev.
4. How we use information
We use personal information to:
- Provide, maintain and improve the Service.
- Measure public website traffic and usability (with consent).
- Authenticate users and enforce access controls.
- Operate Velcio Marketplace: funding, captures, payouts, delivery and disputes (including remediation, developer remove, admin takeover, refunds and payout holds).
- Operate Velcio Cloud: build, deploy and host apps, including review previews, takeover builds and optional post-accept hosting.
- Operate Matz: agent workspaces, prompts and events, cancel/revert snapshots and related billing.
- Send transactional email.
- Send product-updates or marketing email when you have consented.
- Detect, investigate and contain fraud, abuse and security incidents; identify the affected account or workload; review content reports and appeals; preserve proportionate evidence; and respond to verified reports from infrastructure providers.
- Comply with legal obligations and respond to lawful requests.
6. Secrets, end-user data and customer responsibilities
You control production secrets for apps you deploy on Velcio Cloud. Secrets are injected at runtime and are not exposed to Marketplace developers by default. You must rotate compromised credentials and have the right to provide secrets to Velcio for hosting.
For personal data about end users of your Cloud-hosted app (for example from third-party platforms a Worker uses, or visitors to a preview or hosting URL) that appears in archives, runtime behaviour or logs, you are typically the data controller. Velcio acts as a processor and processes that data only to operate build, deploy, review and hosting on your instructions in the Service. You need a lawful basis and any required notices for that end-user data. For a data processing agreement, contact support@velcio.dev.
Do not transmit protected health information through Velcio unless we have approved a written arrangement that covers every required provider. Avoid placing sensitive personal information in URLs, logs, filenames or case summaries. You remain responsible for deciding what your app collects and for giving its end users an accurate privacy notice.
Matz prompts and workspace content are processed to provide the builder. Do not submit content you are not entitled to use. Apps promoted from Matz follow the Cloud controller/processor rules above for their end users.
If you leave the Marketplace developer directory, we stop listing your profile for new discovery. Residual copies may remain in caches or backups for a short period (typically up to 30 days).
7. Marketing email
We send product-updates email only with your prior opt-in for that product, and marketing or promotional email only with shared marketing opt-in (onboarding or Account settings). Consent is timestamped per category. Opt-in is optional and does not affect access to the Service.
Withdraw consent any time in Account settings, or via an unsubscribe link where provided. We stop marketing email after withdrawal. Transactional messages needed to run your account may continue. We do not sell your email address.
8. Retention
We keep personal information only as long as needed:
- Account and profile data: while the account is active. After a verified deletion request we aim to delete or anonymise profile fields within 30 days, except where linked payment or dispute records require longer.
- Payment and accounting records: typically up to six years (or longer if a specific legal requirement applies).
- Marketplace project records (messages, offers, disputes, remediation and remove/takeover timestamps): as needed to operate the Service, resolve disputes and meet legal duties, often aligned with payment retention (commonly up to six years for funded projects).
- Cloud build, deploy and operational logs: typically up to 90 days, then deleted or aggregated, unless a security or legal matter needs longer.
- Security and provider complaint records: for the life of the case and as long afterward as reasonably needed to investigate the event, respond to the provider, prevent repeat abuse, meet legal duties or establish and defend claims. An evidence hold may pause deletion of relevant app, account, log and contained workload records, including after hosting stops or an account deletion is requested. We review held information when the case or hold ends and delete or anonymise it when it is no longer needed.
- Matz prompts, events and workspace archives: while the project is active and for a reasonable period afterward for billing, support, cancel/revert and abuse prevention, then deleted or anonymised with account or project deletion unless a longer legal retention applies.
- Matz cancel snapshots: as needed to complete or abandon restore, then removed under cleanup rules.
- Terms and eligibility acceptance: for the life of the account, then deleted or anonymised with the account. Legacy date-of-birth records are retained only for account eligibility and are not used for marketing.
- Email consent records: while the opt-in is active, and typically up to two years afterward to demonstrate lawful consent. Updated when you withdraw consent.
- Content reports: as needed to handle the report and typically up to two years afterward for safety and abuse prevention.
9. Security
We use administrative, technical and organisational measures designed to protect personal information, including encryption for secrets at rest and access controls on project and workspace data. Cloud workloads run with network and runtime controls designed to limit cross-tenant access, source spoofing, unsolicited email delivery and sudden resource abuse. Where a verified report requires containment, we can block affected hostnames, restrict network access and stop the workload while retaining limited case evidence. No method of transmission or storage is completely secure.
Where a personal data breach is likely to result in a risk to individuals' rights and freedoms, we will notify the ICO and affected individuals as required by UK GDPR.
10. Your rights and choices
Under UK GDPR (and similar laws where they apply), you may have the right to:
- access your personal information
- rectify inaccurate personal information
- erase personal information in certain circumstances
- restrict processing in certain circumstances
- data portability where processing is automated and based on contract or consent
- object to processing based on legitimate interests, including profiling where relevant
- withdraw consent where processing is based on consent, without affecting prior lawful processing
Update account information, email preferences and download a copy of your personal data in Account settings (Your data). For other requests, email support@velcio.dev from the address on your account so we can verify identity. Under UK GDPR we respond within one month of a verified request. For complex or multiple requests we may extend by up to two further months and will tell you within the first month if we need to.
Account deletion. Schedule deletion in Account settings (Your data). After you confirm there is a 30-day grace period during which you can cancel. When deletion finalises we anonymise profile fields and remove sign-in access, subject to legal or accounting retention for project and payment records. Email support@velcio.dev if you need help.
In the UK you may complain to the Information Commissioner's Office (ICO). In the EEA you may also complain to your local data protection authority.
11. International transfers
We and our subprocessors may process data in the United Kingdom, European Economic Area, United States and other countries. Where UK GDPR requires a transfer safeguard, we use tools such as the UK International Data Transfer Agreement (IDTA), the EU Standard Contractual Clauses with the UK addendum, or another lawful transfer tool recognised under UK law.
13. Children
The Service is not directed to children under 18, and we do not knowingly collect their personal information. If you believe we have, contact us and we will delete it.
14. Changes
We may update this Policy. Revised text is posted on this page with an updated "Last updated" date. Material changes may also be communicated in the Service or by email.
15. Contact
Privacy questions or requests: support@velcio.dev
Velcio LTD is the data controller for personal information processed through the Service (except where we act as a processor for your Cloud app's end-user data under Section 6).