Privacy Policy

1. Who we are

Veloix Technologies Private Limited ("Veloix Technologies", "we", "us") is a private limited company incorporated in India (CIN U62091PN2026PTC257369) with its registered office at SOHO, Flat No. 108, 1st Floor, Panchshil Towers, Vagholi, Haveli, Pune 412207, Maharashtra, India. We operate VeloOps, an AI-powered DevOps monitoring and incident response platform.

This policy explains what personal data we collect, why we collect it, how we use and share it, and the rights available to you. It applies to our website and to the VeloOps application.

For telemetry and personal data that our customers connect or route through VeloOps in the course of their own engineering operations — including log data that may incidentally contain personal data, such as a user ID in an application log line — our customer is the data controller (or "data fiduciary" under Indian law) and we act as a processor on their instructions. This policy describes our own processing; our customers’ own privacy notices govern their end users.

2. Personal data we collect

Information you give us

• Account details: name, work email address, company name, and password credentials (stored only as a salted hash).
• Billing details: billing name, address, tax identifiers, and the last four digits and expiry of a payment card. Full card numbers are handled by our payment processor and never stored on our systems.
• Communications: the content of messages you send us through our contact form, by email, or through in-product support.
• Telemetry you connect: logs, metrics, traces and infrastructure metadata from the services you connect as a monitored source, which may incidentally contain personal data embedded in your own log lines.

Information collected automatically

• Usage data: pages and features accessed, actions taken in the application, and timestamps.
• Device and connection data: IP address, browser type and version, operating system, and referring URL.
• Cookies and similar technologies, as described in the Cookies section below.

Information from third parties

• Authentication data from single sign-on providers, where you choose to sign in that way.
• Telemetry and event data from monitoring and alerting integrations you explicitly connect, such as Amazon CloudWatch, Datadog, Slack, Microsoft Teams and PagerDuty, limited to the scopes you authorise.
• Billing status and payment confirmations from our payment processor.

3. How we use personal data

We use personal data to provide and operate the service, and specifically to:

• Create and administer your account, and authenticate your access.
• Deliver the core functionality of VeloOps, including ingesting your connected telemetry, building service baselines, and generating anomaly detections and root-cause analyses from it.
• Process payments, issue invoices and manage subscriptions.
• Provide customer support and respond to your enquiries.
• Monitor service health, diagnose faults, and detect abuse, fraud and security incidents.
• Improve the product through aggregated and de-identified usage analysis.
• Send service communications about outages, security matters, billing and material changes to terms. These are operational and cannot be opted out of while you hold an account.
• Send marketing communications, where you have opted in or where permitted by applicable law. You may withdraw consent at any time.
• Comply with legal obligations and enforce our agreements.

Legal bases (where GDPR applies)

• Performance of a contract: operating the service and administering your account.
• Legitimate interests: securing the platform, preventing abuse, and improving the product, balanced against your rights and freedoms.
• Consent: optional marketing communications and non-essential cookies, which you may withdraw at any time.
• Legal obligation: tax, accounting and statutory record-keeping requirements.

4. AI processing and your telemetry

VeloOps generates root-cause explanations by correlating an anomaly against your recent deploys, infrastructure changes and dependency graph, then passing that correlated evidence to a hosted foundation model, provided by our cloud infrastructure provider under a commercial agreement that prohibits training on our data.

The following commitments apply to telemetry and incident data processed through the service:

• We do not use customer telemetry to train foundation models, and we do not permit our model providers to do so.
• Telemetry connected to one workspace is not used to detect anomalies or answer questions in another workspace.
• Incident timelines and root-cause summaries are retained so that you can review detection quality, audit escalations and measure MTTR. You control the retention period on paid plans.
• You may delete a connected service or an entire workspace at any time, which removes the associated indexed telemetry from active systems.

Automated anomaly detections and root-cause summaries are generated by a machine learning system and may contain errors. The service provides confidence scores, correlated evidence and escalation rules so that a human can review or take over. We recommend keeping human oversight for any remediation action, such as a rollback or scaling change.

5. How we share personal data

We do not sell personal data. We share it only in the following circumstances:

• Service providers and sub-processors who host, secure and support the platform, under contracts that limit their use of the data to providing services to us. These include our cloud infrastructure and AI model hosting provider, payment processing, transactional email, and error monitoring.
• Integrations you explicitly connect, such as Amazon CloudWatch, Datadog, Slack, Microsoft Teams and PagerDuty, limited to the data required to operate that integration.
• Professional advisers, such as our lawyers and accountants, where necessary and subject to confidentiality obligations.
• Legal and regulatory disclosure, where we are required by law, court order or a valid request from a competent authority. Where legally permitted, we will notify affected customers.
• Corporate transactions, such as a merger, acquisition or asset sale, in which case the acquiring entity will remain bound by this policy or provide notice of any change.

A current list of sub-processors is available on request at support@veloixtechnologies.com.

6. International data transfers

We host customer data in an Indian data-centre region by default. Certain sub-processors, including our cloud infrastructure provider, may process data in other jurisdictions, including the European Union and the United States.

Where personal data is transferred out of a jurisdiction that restricts such transfers, we rely on an appropriate safeguard, such as the European Commission’s Standard Contractual Clauses, together with supplementary technical measures including encryption in transit and at rest.

Enterprise customers may request data residency in a specific region as part of their agreement.

7. Data retention

We retain personal data only for as long as necessary for the purposes described in this policy:

• Account data is retained for the life of your account and for up to 90 days after closure, to allow for reactivation and dispute resolution.
• Telemetry, incident timelines and postmortem drafts are retained according to your workspace settings and plan: 7 days on the Free plan, 30 days on Team, and 90 days on Business, with a configurable period on Enterprise.
• Billing and tax records are retained for the period required by Indian statutory law, currently eight financial years.
• Security and access logs are retained for up to 12 months.

On deletion, data is removed from active systems immediately and purged from encrypted backups within 35 days as those backups age out of rotation.

8. Security

We maintain technical and organisational measures appropriate to the risk, including:

• Encryption of data in transit using TLS 1.2 or above, and encryption at rest using managed encryption keys.
• Logical isolation of each customer workspace and its ingested telemetry.
• Role-based access control, with internal access to production data restricted to personnel who require it and logged for audit.
• Multi-factor authentication on internal administrative systems.
• Continuous monitoring of infrastructure health, and automated encrypted backups with a documented recovery process.

No system can be guaranteed completely secure. If we become aware of a personal data breach affecting your data, we will notify you and the relevant supervisory authority without undue delay and in accordance with applicable law.

9. Your rights

Under the GDPR (EU and UK residents)

• Access: obtain confirmation of whether we process your data and a copy of it.
• Rectification: have inaccurate or incomplete data corrected.
• Erasure: request deletion, subject to our legal retention obligations.
• Restriction and objection: limit or object to certain processing, including processing based on legitimate interests.
• Portability: receive your data in a structured, machine-readable format.
• Withdraw consent at any time, without affecting processing carried out before withdrawal.
• Lodge a complaint with your local supervisory authority.

Under India’s Digital Personal Data Protection Act, 2023

• Access a summary of the personal data being processed and the processing activities undertaken.
• Correction, completion, updating and erasure of your personal data.
• Nominate another individual to exercise your rights in the event of death or incapacity.
• Grievance redressal through the contact point below, before escalating to the Data Protection Board of India.

To exercise any of these rights, email support@veloixtechnologies.com. We will verify your identity and respond within the period required by applicable law — generally 30 days. Where you are an end user of one of our customers, please contact that customer directly; we will refer your request to them and assist them in responding.

10. Cookies and similar technologies

We use a small number of cookies and similar technologies:

• Strictly necessary cookies: session authentication, security tokens and load balancing. These cannot be disabled without breaking the service.
• Preference cookies: remembering settings such as your billing-period selection.
• Analytics cookies: privacy-respecting, aggregated measurement of how the website is used. These are set only with your consent where consent is required.

You can control cookies through your browser settings. Blocking strictly necessary cookies will prevent you from signing in. We do not use third-party advertising or cross-site tracking cookies.

11. Children’s data

VeloOps is a business product and is not directed at children. We do not knowingly collect personal data from anyone under the age of 18. If you believe a child has provided us with personal data, contact us and we will delete it.

12. Changes to this policy

We may update this policy to reflect changes in our practices, the service, or applicable law. The "last updated" date at the top of this page always reflects the current version.

Where a change is material — for example, a new purpose for processing or a new category of recipient — we will notify account holders by email or through an in-product notice at least 14 days before it takes effect.