Privacy Policy
Last updated: July 28, 2026
What we collect
- Email address (for account identification and communication)
- Password (stored only as a one-way hash — we never store your password in plain text)
- Prompts you save (title, content, tags, starred status, last-used timestamp, optional folder assignment)
- Prompt folders you create (folder names are private to your account)
- AI conversations — the messages you send and receive in chat, conversation titles, and associated metadata such as the model used, token counts, and timestamps
- Image attachments you include in chat messages
- Document attachments in chat (PDF, Word, Excel) — documents are processed in your browser; extracted text is stored with your conversation; original files never leave your device
- Conversation-scoped chat artifacts (markdown text or spreadsheet JSON, titles, and version history) created or updated by the model in a chat, or promoted from a successful document attach
- Custom personas you create (name, description, system prompt, preferred model, avatar preset) and, if you publish one, the public marketplace listing fields
- Conversations and prompts you import from ChatGPT, Claude, or a CSV/JSON prompt collection (parsed locally in your browser, then stored in your account when you confirm the import)
- AI provider API keys you choose to store (encrypted at rest using AES-256-GCM; decrypted only on our servers when needed to call the provider you selected — never returned to browsers, logs, or data exports in plain text)
- Session cookie issued when you sign in (NextAuth.js)
- Account metadata such as plan tier, email verification status, and timestamps
- Billing metadata from Stripe — subscription status, plan tier, and billing cycle dates (we do not store raw card numbers or full payment details)
- Onboarding progress when you use the post-registration wizard — your selected use-case category (Coding, Writing, Research, Creative, or General) and step completion timestamps
- Model picker preferences on your account — which approved catalog models you choose to show or pin in Live AI (provider + model id + hidden/pinned flags only; no API keys or message content)
How we use your data
We use this information only to operate Vellio: to authenticate you, store and display your prompts and conversations, process subscription billing, send transactional emails, and enforce fair use and security.
When you send a chat message, the content of that message (and any relevant conversation history) is transmitted to the AI provider you have selected — for example OpenAI, Anthropic, Google Gemini, or another provider from your account settings — to generate a response. This is the core function of the chat feature. We do not sell your data, use it for advertising, or share it with third parties for their own marketing purposes.
Browser extension
The Vellio browser extension (Chrome, Firefox, Edge) connects to the same Vellio account as the web app. It stores your session locally in the extension and fetches your prompt library and account settings from our API. The extension does not collect browsing history beyond the page context you explicitly send to Vellio (for example when you use contextual features in later releases). API keys and chat content follow the same encryption and provider-routing rules as the web app. Extension permissions are described in each store listing and must match this policy.
Prompt Library (Starred, Recently used, Folders)
When you star a prompt, assign it to a folder, or use a prompt in chat, we store starred, lastUsedAt, and folderId on your private prompt rows. Folder names are user-private metadata used only to organise your library; they are not included in product analytics events. Recently used sorts by recency via lastUsedAt, not popularity.
Onboarding wizard
After email verification, an optional onboarding wizard may ask which use case best describes you (OnboardingProgress.useCase). This answer seeds suggested prompts and a welcome chat. It is stored in a dedicated onboarding row linked to your account and deleted when you delete your account. The use-case value is emitted once to our analytics funnel as an enum label only — not as free text — and is excluded from error monitoring payloads.
Shared conversations
When you share a conversation, the transcript (messages and model information as shown on the shared page) becomes publicly accessible via a unique link. No personal information (such as your email or API keys) is included in shared conversations. You can revoke a share link at any time from the chat; after revocation, the link stops working.
Published prompts and public profiles
When you publish a prompt to Explore, your prompt's title, description, content, tags, category, and aggregate statistics (uses, saves, forks, average rating) become publicly visible to signed-in Vellio users. Your public profile — username, bio, and optional avatar URL — is visible on your published prompts. You can unpublish any prompt or remove your public profile at any time. Unpublishing hides the prompt from Explore but preserves its statistics so re-publishing restores history.
Ratings and reports
You may rate published prompts 1 to 5 stars; your individual rating is private, but the average rating and total count are shown publicly. Reports you submit are reviewed by Vellio administrators. Your email is visible to administrators only as part of the moderation queue. Escalate severe or illegal marketplace content to abuse@vellio.ai.
Marketplace maturity (Phase 8.5)
Text reviews
If you write a text review, your public profile (username, bio, and optional avatar) is shown alongside it. The prompt author can hide your review on their own listing; you can edit or delete your review at any time. Administrators can remove reviews that violate community guidelines.
Followers
When you follow another user, that relationship is visible to any signed-in user who opens the follower or following list on either profile. Unfollowing removes the record. Your follow list powers the "Following" view on Explore and can trigger in-app notifications when followed authors publish or update a prompt.
In-app notifications
We may create in-app notifications when someone rates or reviews your prompt, when a followed author publishes or versions a prompt, and when a report involving your content is resolved. Notifications are visible only in your account. You can turn off each event type on your account page. Notifications older than 90 days are automatically deleted; there is no long-term archive.
In-app notifications remain available as described above. Optional marketing emails for some of the same marketplace events are covered under Marketing emails.
Marketing emails
When marketing email is enabled for your account, we may send messages from hello@mail.vellio.ai (domain mail.vellio.ai). Categories include: welcome series, re-engagement after inactivity, Prompt of the Week, weekly trending digest (opt-in), new prompts from authors you follow, and ratings received on your prompts.
A master marketing opt-in on your account controls all of these categories. You can turn individual categories on or off under Account → Profile → Email preferences. One-click unsubscribe (RFC 8058) and the unsubscribe page turn the master switch off immediately; the next scheduled send skips you. Transactional mail (verification, password reset, billing, moderation actions) is sent from noreply@vellio.ai and is not governed by the marketing opt-in, though we still skip addresses marked as hard-bounced.
Resend is our email processor (see sub-processors). We keep an internal send log keyed by user and email type so the same marketing message is not sent twice; that log is deleted with your account.
Exported conversations and data export
Exported conversations contain message content and metadata you choose to download (for example Markdown or JSON). Export files are generated on demand when you request them and are not stored on our servers as standalone files beyond a short-lived download link (7 days) for GDPR data exports requested from Account settings.
Web search in chat
When web search is available in chat (and you have not turned it off for that turn), the model may send search queries to our search vendor (Tavily). Those queries are derived from your prompt and conversation context so the model can fetch current information and cite sources. Search calls debit credits on both hosted-credit and BYOK routes because Vellio pays the search vendor. Server logs record search call counts and durations only — never the full query text. See /subprocessors for the Tavily entry.
File and document analysis
When you attach a PDF, Word (.docx), or Excel (.xlsx) file in chat, the document is processed in your browser. Extracted text is stored with your conversation as context for the AI. Original files never leave your device — we do not upload or retain the raw file bytes on our servers.
Chat artifacts
When chat artifacts are available (Pro or Pro+ plans, and the feature is enabled), the model may create and revise conversation-scoped documents beside chat — markdown text or spreadsheet-structured JSON stored in our database with your conversation. Version history keeps the last several snapshots so you can undo a model update. Artifact bodies are treated as untrusted data for the model (not as instructions) and are not written into server logs in full.
If you attach a supported document and promote succeeds, we may auto-create an artifact from the structured extract only — never from the raw upload bytes. Downloads (Markdown, Word, PDF, or Excel) are generated on demand from the validated stored source and returned as ephemeral attachments; we do not keep a separate binary file store for artifacts. Word/PDF/Excel writers run in-process on our servers (docx, pdf-lib, xlsx) — they are not a new sub-processor.
Each successful artifact tool call (create, update, or read) debits a flat credit from your Vellio ledger on both hosted-credit and BYOK chat routes, recorded as an ARTIFACT_DEBIT ledger reason. Free plans cannot create or download artifacts.
Import from other services
The import wizard on Account parses ChatGPT or Claude export files and prompt collections (CSV/JSON) locally in your browser. Only the conversations or prompts you confirm are written to your Vellio account. Import uploads are not stored as raw export files on our servers.
Hosted credits and sub-processors
Vellio supports two chat data flows. When you use BYOK, your prompts and conversation context go to the selected AI provider through your own provider account and API key. When you use hosted credits, your prompts and conversation context are proxied through Vellio-managed provider keys for the selected model, and credits are deducted from your Vellio ledger.
A complete sub-processor list with data categories, residency, and lawful basis is maintained at /subprocessors. Hosted-credit chat may involve the AI providers listed there, plus Cloudflare Turnstile, Stripe, Sentry, PostHog (EU), and Better Stack depending on the product path you use.
Vellio stores credit ledger rows, including credit amounts, transaction reasons, model metadata, and operational key-slot identifiers, while your account exists. We do not store provider raw responses outside the message content saved in your conversation.
Observability and analytics (Phase 11)
We use the following processors for reliability and product analytics. Full details are on /subprocessors:
- Sentry — scrubbed error aggregation. Before capture we remove API keys, Authorization headers, session tokens, message and prompt bodies, and email addresses from free-text fields (H5). Sentry is used for error monitoring under legitimate interest and is not gated by the cookie consent banner.
- PostHog (EU region) — pseudonymous funnel events. Properties never include email, API keys, full chat content, full prompt text, or folder names (H16). Distinct-id is your userId (CUID) only after sign-in. For visitors in the EEA, UK, and Switzerland, PostHog loads only after you accept analytics in the consent banner (see Cookies and consent).
- Better Stack — uptime monitoring of public endpoints; no user content.
Third-party processors
We rely on Vercel, Neon, Resend, Upstash, Stripe, Cloudflare, nine first-class AI providers plus OpenRouter, Tavily (web search), Sentry, PostHog (EU), and Better Stack. See the sub-processors table for the authoritative list.
When you use a custom OpenAI-compatible endpoint, your messages are sent directly to the URL you provide. Vellio does not control, audit, or log requests to third-party servers at your custom endpoint beyond what is needed to stream the assistant reply in the app.
Data retention & deletion
We keep your data for as long as your account is active. You can delete your account and all associated data at any time from Account settings. After deletion, your user record, saved prompts, prompt folders, onboarding progress, model picker preferences, conversation history, messages, conversation artifacts and their version history, and stored API keys are removed from our database. Credit ledger rows are deleted with your account through the same account-deletion cascade. Billing records may be retained by Stripe as required by their policies and applicable law. Sentry deletion requests can be sent to the contact email below.
Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal data, or to object to certain processing. Request a machine-readable export from Account settings or contact us at the email below to exercise these rights.
Contact
For privacy questions: Admin@vellio.ai. Security reports: /security.