Privacy policy.

Who is responsible for your information

Prumo Works Ltd is the controller of personal information handled through Velloo and Velloo Cloud. It is registered in England and Wales under company number 17384166, with its registered office at 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ.

For privacy questions or requests, use the Prumo Works contact form.

What we collect

• Account and authentication information, such as your name, email address, account identifiers, sign-in provider, session information, and security settings. Passwords are handled by our authentication service and are not stored in readable form.
• Workspace content, including published boards, screens, assets, versions, comments, review threads, organization and team details, invitations, access controls, and link passwords you choose to create.
• Billing and usage information, including plan status, purchased and used credits, transaction references, and billing account identifiers. Payment card details are collected by the payment provider rather than Velloo.
• Technical and security information, such as IP address, browser and device details, request logs, error reports, audit events, and abuse-prevention signals.
• Messages and feedback you send to us, including support requests and product feedback.

How and why we use it

We use personal information to:

• create and secure accounts, authenticate users, and provide the services you request;
• store and publish boards, run review and collaboration features, and send service notifications;
• administer organizations, subscriptions, credits, invoices, and account deletion;
• generate requested assets and send the necessary prompt or input to the selected generation provider;
• detect abuse, investigate incidents, maintain reliability, and improve the service; and
• meet legal, accounting, tax, and regulatory obligations.

Our lawful bases are performance of our contract with you, our legitimate interests in operating and protecting Velloo, compliance with legal obligations, and consent where we specifically ask for it. Where we rely on legitimate interests, those interests include securing the service, preventing misuse, understanding reliability, and improving the product in ways users reasonably expect.

Website analytics

We use Cloudflare Web Analytics on velloo.design to understand aggregate traffic and page performance so we can improve the website. The beacon processes information such as the page and referrer, browser and device type, and page-load performance. It does not use cookies or persistent visitor identifiers and does not read or write local storage, session storage, or IndexedDB. Cloudflare receives the source IP address as part of the network request and states that it discards it at the nearest data centre rather than storing it in its analytics databases.

We use the resulting aggregate statistics only to understand and improve our website—not for advertising, cross-site tracking, or profiling. To the extent this processing involves personal information, we rely on our legitimate interest in measuring and improving the website. You may object by contacting us.

When other people can see your content

Publishing and review are sharing features. A public link can be viewed by anyone who has it. A password-protected or restricted link can be viewed by people who satisfy the access settings you choose. Organization owners and members may also have access according to their role. Check a link’s audience before publishing confidential material.

Who receives information

We use service providers for hosting, databases, object storage, authentication, email, monitoring, payments, and—only when requested—asset generation. This currently includes infrastructure operated by Fly.io, Neon, and Cloudflare; Stripe for payments; Resend for email; Sentry for error monitoring when enabled; Google and GitHub for optional social sign-in; and selected model providers such as Anthropic, OpenAI, or Runware for hosted generation. Providers process information under their own terms and our arrangements with them.

We may also disclose information when required by law, to protect users or the service, or as part of a corporate transaction. We do not sell personal information.

International transfers

Some providers may process information outside the United Kingdom. Where required, we use an adequacy regulation or contractual safeguards designed to protect the transferred information. Contact us if you would like more information about the safeguard used for a particular transfer.

How long we keep information

We keep account and workspace information while the account or organization is active and for as long as needed to provide the service. Published versions follow the retention rules attached to the relevant plan; a link is revoked after its final retained version expires. Pending invitations expire after 14 days. If you delete an account, we remove its profile and product content subject to organization ownership, security, backup, dispute, accounting, tax, and legal-retention requirements. Logs and operational records are kept only for as long as reasonably needed for security, reliability, and compliance.

Your choices and rights

You can update some account details and notification choices in Velloo Cloud, revoke or remove published links, and request account deletion. Depending on the circumstances, you may also have rights to access, correct, erase, restrict, object to, or obtain a copy of your personal information. You may withdraw consent where processing relies on consent. Contact us to make a request.

You may complain to the Information Commissioner’s Office if you are unhappy with how we handle your information.

Cookies and local storage

Velloo does not use advertising cookies. velloo.design uses local storage to remember the light or dark theme you select; Cloudflare Web Analytics does not use browser storage. velloo.ai uses secure, essential session cookies for authentication and local storage for interface preferences and your selected workspace.

Published content on velloo.dev does not receive your velloo.ai account cookie. A password-protected or account-restricted share may set a short-lived cookie scoped to that share after you unlock or authorise it, and the review interface may use session storage for short-lived commenting state. Authentication, payment, and abuse-prevention providers may use storage needed to complete an action you request, such as signing in, checking out, or submitting a protected form. We do not use these technologies for third-party behavioural advertising or cross-site profiling.

Changes to this policy

We may update this policy as Velloo changes. We will post the new version here, update the date above, and give additional notice when a change materially affects how we use personal information.