Privacy Policy

2.1 Data controller

• Company: Velarum Labs LLC (Wyoming, USA).
• Registered address: Wyoming, USA — full address [PENDING-REGISTRATION].
• Registration number: [PENDING-REGISTRATION] (filled after the Wyoming SOS Articles of Organization).
• Website: [PENDING-REGISTRATION] (filled after domain registration).

2.2 Data Protection Officer (DPO)

• Email: [VELARUM_DPO_EMAIL].
• Appointment status: [DPO_APPOINTMENT_STATUS].

2.3 EU representative (GDPR Art.27)

As Velarum is not established in the EU, we have appointed [VELARUM_REPRESENTATIVE_EU] as our EU representative to handle inquiries from EU data subjects and regulators. Representative: [VELARUM_REPRESENTATIVE_EU]; Address: [VELARUM_REPRESENTATIVE_ADDR]; Email: [VELARUM_REPRESENTATIVE_EMAIL].

2.4 General contact

• Privacy matters: [VELARUM_PRIVACY_EMAIL].
• Security incidents: [VELARUM_SECURITY_EMAIL].
• Data-subject requests (DSAR): [VELARUM_PRIVACY_EMAIL] or via the DSAR SOP.

2.5 No sale of data

Velarum does not sell your personal information. Under CCPA / CPRA, “sale” means disclosure for monetary or other valuable consideration; Velarum does not do this. Velarum also does not “share” your personal information for cross-context behavioral advertising.

3.1 Default collection (6 minimal PII items)

Whether you are a developer, enterprise admin, or individual user, Velarum holds only the following six items by default:

3.2 Triggered collection (only under the ADR-NC-008 4-tier triggers)

3.3 On-chain data (public, not Velarum’s private data)

All transactions you initiate on-chain (sender, recipient, amount, contract call) are permanently public and immutable. Velarum indexes them to update your payment-intent status, provide webhook notifications, and generate observable audit logs. This passive observation does not constitute additional PII collection — on-chain data is already public.

3.4 Cookies & similar technologies

See §10.

3.5 Third-party data (data we obtain from elsewhere)

• OFAC / FATF / sanctions-list providers — for address-level deny-list hooks; no PII.
• On-chain analytics providers (if enabled) — for risk scoring, consuming only anonymous on-chain addresses; none of your PII.
• Payment processors (Stripe / Coinbase Commerce) — subscription-payment confirmation; your payment details are held directly by the processor, and Velarum receives only success/fail status and the last 4 card digits.

3.6 Developer docs site (docs.velarumai.com)

The public docs site requires no login and processes only limited request metadata and search behavior. In-site search is processed by Algolia DocSearch (index region us-east / eu-west, not Singapore — HC-NC-2); without Algolia, Nextra’s built-in local search keeps queries in your browser. Hosting via Hetzner Online (Falkenstein, Germany — not Singapore, HC-NC-2) and reverse-proxy + WAF via Cloudflare (for SG geo-block) process access logs (IP/UA). All three are listed in the Sub-processor List and never touch your wallet / private keys / signing material (HC-NC-1).

4.1 Primary storage location

Velarum’s primary data is stored in [CLOUD_REGION_EU] (default AWS / GCP EU region).

4.2 Transfer safeguards

4.3 PIPL note (Mainland China)

Velarum does not proactively collect Mainland-China residents’ personal information (Mainland China is Tier C pending-exclusion in ToS §13). If a user bypasses the IP / nationality / KYC barriers in violation: Velarum stores no long-term record; short-term logs follow the PIPL breach procedure (72-hour disclosure); Velarum does not apply to the CAC for a cross-border data security assessment (no business connection in that jurisdiction).

4.4 OFAC note (Russia)

Velarum’s entity, operating entities, Anchor integrations, and banking counterparties are screened in real time against OFAC / EU CFSP / UK OFSI lists; Velarum does not contract with any entity registered or primarily operating in Russia.

Summary (see the Data Retention & Deletion Spec §2):

6.1 GDPR / UK GDPR rights

Under GDPR Art.15–22 you have the following rights (we respond within 30 days unless noted):

• Right to access — a copy of the personal data we hold about you.
• Right to rectification — correct inaccurate or outdated data.
• Right to erasure / to be forgotten — delete data no longer necessary (with exceptions for legal obligations and disputes).
• Right to restriction of processing — in certain circumstances.
• Right to data portability — receive your data in a structured, common, machine-readable format.
• Right to object — to processing based on legitimate or public interest.
• Right to withdraw consent — effective immediately, without affecting prior lawful processing.
• Rights regarding automated decision-making — not to be subject to solely automated decisions (Art.22, see §8).
• Right to complain — to a supervisory authority (EU users: your country’s DPA).

6.2 CCPA / CPRA (California — currently Tier C pending-exclusion)

Note: the USA (including California) is currently on the ToS §13 Tier C pending-exclusion list, and Velarum does not yet serve California residents. If service is opened after a Phase-1 trigger and an ADR-NC-010 re-review, this section takes effect and grants the rights to know, delete, correct, opt-out of sale/sharing, limit use of sensitive PI, and non-discrimination.

6.3 Other jurisdictions

6.4 How to exercise your rights

1. Submit a request to [VELARUM_PRIVACY_EMAIL] or via the DSAR SOP.
2. Velarum acknowledges receipt within 5 business days.
3. Identity verification is performed (to prevent impersonation).
4. Processing is completed within 30 days (extendable to 90 for complex cases, with prior notice).
5. Free of charge (manifestly unfounded or repetitive requests are handled per GDPR Art.12(5)). If dissatisfied, you may complain to [YOUR_DPA].

Velarum’s stance per Asia-Pacific jurisdiction:

8.1 Automated tools we use

1. Address-level deny-list hook — automatic screening of on-chain addresses against OFAC / FATF lists; shows a warning only, does not force-block (ADR-NC-008 §2.4).
2. API rate limiter — based on your subscription tier and historical call patterns.
3. Risk scoring (enterprise add-on) — risk scores from your agent’s behavior to assist your compliance decisions; Velarum makes no final block decision.
4. Geo-blocking — automatic region detection from IP / nationality declaration / KYC residence; if your region is on the ToS §13 exclusion list, access is automatically refused.

8.2 Your rights

Under GDPR Art.22 you have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal or similarly significant effects, and to obtain human intervention, express your view, and contest the decision. If you believe an automated decision (especially geo-blocking) is unjust, request human review at [VELARUM_PRIVACY_EMAIL].

Velarum implements the following technical and organizational measures to protect your data:

• Encryption in transit — TLS 1.3 for all API, webhook, and web traffic.
• Encryption at rest — field-level database encryption (AES-256) with hardware KMS / HSM key management. Note: the HSM here is used only for Velarum’s own operational data (e.g., server DB encryption keys, API-key signing keys) and never holds user private keys / mnemonics / MPC shares (HC-NC-1).
• Access control — RBAC + MFA + least-privilege; staff and contractors under NDA.
• Audit logs — immutable append-only, retained 5–7 years.
• Threat modeling, disaster recovery / BCP, and incident response per the respective specs.
• Breach notification — within 72 hours per GDPR Art.33.

10.1 Cookies we use

10.2 Your choices

• EU users (GDPR + ePrivacy): all non-essential cookies are off by default; opt-in on first visit; change anytime via the cookie banner.
• California users (CCPA; currently Tier C pending): a “Do Not Sell or Share My Personal Information” link will be provided once service is opened.
• Other jurisdictions: non-essential cookies off by default (the most conservative approach).

10.3 Browser Do Not Track (DNT)

Velarum’s website respects the browser DNT signal: when DNT=1, non-essential cookies are disabled even if you previously opted in.

1. Velarum may update this Policy from time to time. Material changes (affecting your substantive rights and obligations) are notified 30 days in advance via email + dashboard banner.
2. Non-material changes (typos, link updates, formatting) take effect immediately.
3. Prior versions are available at [VELARUM_PRIVACY_HISTORY_URL] (legal obligation).