隐私政策
| Key question | Short answer |
|---|---|
| What is Velarum? | A non-custodial payment protocol layer and developer infrastructure for the AI-agent economy. Velarum does not hold your funds, keys, or signing material (see ToS §3.2). |
| What do you collect by default? | Only six minimal PII items: email, username, API-key metadata, public wallet address, API call logs, IP address. Other sensitive data (IDs, passports) is collected at zero by default. |
| When is more data collected? | Only under the ADR-NC-008 4-tier triggers (L1 legal compulsion / L2 customer contract / L3 product gating / L4 never); IDs are handed by you directly to a trusted third-party Issuer — Velarum stores no raw data. |
| Do you sell my data? | No (see §2.5 and the CCPA/CPRA “Do Not Sell” section). |
| How do I exercise my rights? | Contact [VELARUM_PRIVACY_EMAIL] or submit via the DSAR SOP; reply within 30 days. |
| Where is data stored? | Primarily in the EU ([CLOUD_REGION_EU]); cross-border transfers use SCCs. See §4. |
| How long is it retained? | See §5 and the Data Retention Spec. |
As Velarum is not established in the EU, we have appointed [VELARUM_REPRESENTATIVE_EU] as our EU representative to handle inquiries from EU data subjects and regulators. Representative: [VELARUM_REPRESENTATIVE_EU]; Address: [VELARUM_REPRESENTATIVE_ADDR]; Email: [VELARUM_REPRESENTATIVE_EMAIL].
Velarum does not sell your personal information. Under CCPA / CPRA, “sale” means disclosure for monetary or other valuable consideration; Velarum does not do this. Velarum also does not “share” your personal information for cross-context behavioral advertising.
Whether you are a developer, enterprise admin, or individual user, Velarum holds only the following six items by default:
| Data | When collected | Purpose | Legal basis (GDPR Art.6) |
|---|---|---|---|
| Required at registration | Verification, password reset, notifications, security alerts | (b) contract | |
| Username | Required at registration | Login & UI display | (b) contract |
| API-key metadata (hash + label + scope) | Required at API-key creation | SDK authentication | (b) contract |
| Public wallet address | When you connect a wallet | On-chain event subscription matching | (b) contract; public on-chain anyway |
| API call logs | Auto-generated | SLA reports, webhook delivery tracking, risk baseline | (f) legitimate interest |
| IP address | Auto-generated | Geo-blocking (SG/OFAC/US/JP), security audit | (c) legal obligation; (f) legitimate interest |
| Trigger | May collect | Collected by | Legal basis |
|---|---|---|---|
| L1 Legal compulsion | VC signature digest (raw ID handed by you directly to a trusted Issuer, never via Velarum) | You / Issuer | (c) legal obligation |
| L2 Customer contract | VC digest; metadata within the contract scope | You / Issuer | (b) contract (Enterprise) |
| L3 Product gating | KYB-VC digest | You / VC Issuer | (a) consent |
| L4 Never triggered | None | — | — |
All transactions you initiate on-chain (sender, recipient, amount, contract call) are permanently public and immutable. Velarum indexes them to update your payment-intent status, provide webhook notifications, and generate observable audit logs. This passive observation does not constitute additional PII collection — on-chain data is already public.
See §10.
The public docs site requires no login and processes only limited request metadata and search behavior. In-site search is processed by Algolia DocSearch (index region us-east / eu-west, not Singapore — HC-NC-2); without Algolia, Nextra’s built-in local search keeps queries in your browser. Hosting via Hetzner Online (Falkenstein, Germany — not Singapore, HC-NC-2) and reverse-proxy + WAF via Cloudflare (for SG geo-block) process access logs (IP/UA). All three are listed in the Sub-processor List and never touch your wallet / private keys / signing material (HC-NC-1).
Velarum’s primary data is stored in [CLOUD_REGION_EU] (default AWS / GCP EU region).
| Safeguard | Applies to | Instrument |
|---|---|---|
| EU SCCs (Standard Contractual Clauses) | EU → third countries (no adequacy decision) | EU Commission SCC 2021 |
| UK IDTA / Addendum to SCCs | UK → third countries | UK ICO IDTA |
| Adequacy decision | EU → Switzerland / UK / Japan (since 2019), etc. | EU Commission adequacy decision |
| Customer consent (GDPR Art.49(1)(a)) | Fallback only, with explicit risk notice | Not relied on as a primary path |
Velarum does not proactively collect Mainland-China residents’ personal information (Mainland China is Tier C pending-exclusion in ToS §13). If a user bypasses the IP / nationality / KYC barriers in violation: Velarum stores no long-term record; short-term logs follow the PIPL breach procedure (72-hour disclosure); Velarum does not apply to the CAC for a cross-border data security assessment (no business connection in that jurisdiction).
Velarum’s entity, operating entities, Anchor integrations, and banking counterparties are screened in real time against OFAC / EU CFSP / UK OFSI lists; Velarum does not contract with any entity registered or primarily operating in Russia.
Summary (see the Data Retention & Deletion Spec §2):
| Data | Retention | Deletion trigger |
|---|---|---|
| Email / username | 30 days after a deletion request | Self-closure + 30-day cooling-off |
| API-key metadata | Same as the account | Account closure + 30 days |
| Public wallet address | Public on-chain; index retained in the Velarum DB | — |
| API call logs | 7-year aggregate; identifiable fields anonymized after 30 days | Automatic |
| IP address | 30-day rolling; aggregated data retained de-identified | Automatic |
| KYC trigger records (if L1) | Retained permanently for audit | — |
| Audit logs (financial, compliance) | 5–7 years | Legal obligation |
| Breach investigation records | 5 years | Legal obligation |
Under GDPR Art.15–22 you have the following rights (we respond within 30 days unless noted):
Note: the USA (including California) is currently on the ToS §13 Tier C pending-exclusion list, and Velarum does not yet serve California residents. If service is opened after a Phase-1 trigger and an ADR-NC-010 re-review, this section takes effect and grants the rights to know, delete, correct, opt-out of sale/sharing, limit use of sensitive PI, and non-discrimination.
| Jurisdiction | Key rights | Timeline |
|---|---|---|
| Switzerland nFADP | GDPR-like; access / rectify / delete / object | 30 days |
| Brazil LGPD | GDPR-like | 15 days |
| Canada PIPEDA | Access / correct | 30 days |
| Australia Privacy Act | Access / correct | 30 days |
Velarum’s stance per Asia-Pacific jurisdiction:
| Jurisdiction | Governing law | Velarum stance |
|---|---|---|
| Vietnam (PDPL 2023) | Decree 13/2023/ND-CP (eff. 2023-07-01) | Served — opened per ADR-NC-050 (2026-06-07), superseding the Tier C pending-exclusion of ADR-NC-019. PDPL Decree 13/2023 obligations apply; final pre-public-launch legal review pending. |
| Indonesia (UU PDP 2022) | UU PDP No.27/2022 (full impl. 2024) | Tier W legal-watch; full service; tracked via the Risk Register; may escalate to Tier C if legislation turns adverse. |
| Thailand (PDPA 2019) | PDPA B.E.2562 (full 2022-06-01) | Default zero-KYC does not trigger a mandatory DPO. |
| Malaysia (PDPA 2010/2024) | PDPA 2010 (2024 amendments) | Velarum’s place of registration is on the allowed list. |
| Philippines (DPA 2012) | RA 10173 | Default zero-KYC does not trigger. |
| Japan (APPI) | APPI (2003/2017/2022) | Tier C pending-exclusion (ADR-NC-011); not actively served; APPI fully applies if reopened. |
| South Korea (PIPA) | PIPA (2011/2020) | Tier W legal-watch; full service; Virtual Asset User Protection Act (2024-07) non-custodial grey area tracked; transfers under PIPA Art.17 consent. |
| Taiwan (PDPA) | PDPA (2010/2015) | Served; explicitly separated from the Mainland-China exclusion (ADR-NC-012); cross-border via SCC-equivalent. |
| Hong Kong (PDPO) | PDPO (1995/2021) | Served; Velarum will not transfer HK user data directly to Mainland China. |
| UAE (PDPL 2022) | Federal Decree-Law No.45/2021 | Default zero-KYC. |
Under GDPR Art.22 you have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal or similarly significant effects, and to obtain human intervention, express your view, and contest the decision. If you believe an automated decision (especially geo-blocking) is unjust, request human review at [VELARUM_PRIVACY_EMAIL].
Velarum implements the following technical and organizational measures to protect your data:
| Type | Purpose | Consent |
|---|---|---|
| Essential (login session / CSRF / basic function) | Required to run the service | No consent needed (permitted by law) |
| Functional (language / theme) | Improve experience | Off by default; you may enable |
| Analytics (de-identified aggregates, e.g., Plausible) | Improve the service | Off by default; opt-in |
| Marketing / third-party tracking | Not used | — |
| Social embeds | Only on docs article pages (optional Twitter/GitHub embeds) | Opt-in |
Velarum’s website respects the browser DNT signal: when DNT=1, non-essential cookies are disabled even if you previously opted in.