Privacy Policy

BOUNCY ALGORITHM - UNIPESSOAL LIMITADA, Portuguese tax number (NIF) 519421574, which uses the Velqory brand ("Velqory," "we," "us"), is the entity responsible for personal data collected through our products, services, websites, and contracted project work. This Privacy Policy explains what we collect, the lawful basis on which we process it, where it is processed, who it is shared with, and the rights available to you.

By using our websites or Services you acknowledge you have read this policy. If you disagree with any part, do not use the Services.

We collect the following categories of personal data:

• Account data - for Client Access, name, work email, company, and role; for a separate Blog account, email, identity-provider subject, public name, handle, optional profile note, language, policy versions and timestamps, and security-session metadata. We record the required 16+ attestation but do not collect a date of birth.
• Diagnostic enquiry data - name, work email, company, role, phone number, company size, selected need, and the context you provide. Optional marketing consent is stored separately and is never preselected. We do not request a VAT number at this stage.
• Public community data - the profile name and the comments you choose to publish on Blog articles. Your email address and internal account details are not displayed with a comment.
• Usage data - pages visited, session duration and interaction events, measured with Google Analytics only if you accept analytics cookies, without advertising features or Google Signals. If you arrive from a link with campaign parameters, only those parameters (utm_source, utm_medium, utm_campaign, utm_content and utm_term) are sent, once, after you accept; the other parameters in the address are not sent to Google Analytics, and the referring page is sent without parameters.
• Device data - browser type, operating system, and IP address. No cross-device fingerprinting.
• Customer content - documents, prompts, agent configurations, and integration data you provide or create during a contracted engagement. Storage location is defined by the applicable proposal, statement of work, DPA, or service agreement.
• Payment data - name, billing address, and VAT number for invoicing. If card or direct-debit payment is agreed, payment details are processed by the named payment provider; we do not store card numbers or CVVs.

Under Article 6 of the GDPR, we process personal data on the following lawful bases:

• Contract (Art. 6(1)(b)) - to provision your account, provide community features you request, deliver contracted Services, process invoices, and respond to support requests.
• Legitimate interest (Art. 6(1)(f)) - for security monitoring, fraud and community-abuse prevention, content moderation, aggregate service improvement, and communication of essential service updates.
• Consent (Art. 6(1)(a)) - for optional analytics cookies, marketing communications, and any processing not necessary for the contract or covered by legitimate interest.
• Legal obligation (Art. 6(1)(c)) - for tax records, audit retention, and compliance with applicable law.

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

We process personal data for the following purposes:

• Service delivery - to provision your account, execute workflows, run agents, deliver contracted work, and support agreed operations.
• Security - to detect and prevent unauthorized access, fraud, and abuse.
• Service improvement - to analyze aggregated, anonymized usage patterns.
• Communication - to send transactional messages (invoices, security alerts) and, with your consent, product updates, including any notice you have requested about the software Velqory is developing.
• Blog conversation - to publish comments you submit, attribute them to your public profile, prevent abuse, and moderate content that is unlawful, unsafe, or unrelated to the article.

We do not sell personal data. We do not share personal data with advertisers.

The Blog community is not directed to children under 16. Velqory has chosen a 16+ product rule and asks for a separate attestation before creating a Blog account. We deliberately do not collect a date of birth or use profiling to infer age.

If we learn that an account belongs to someone under 16, we will disable access and remove or anonymise the related personal data, subject to a limited lawful security or moderation record. A parent or guardian can contact suporte@velqory.com. This product rule is more restrictive than the current Portuguese threshold for a child's own consent to information-society services.

The model providers used depend on the contracted service. They are identified in the proposal and in the Sub-Processor List. Velqory also uses Claude Code (Anthropic) and Codex (OpenAI) in its development and operations work; these tools may process customer content and are listed in the Sub-Processor List.

AI traces are kept only as long as needed for operation and audit, under the applicable agreement and the Data Retention & Deletion Policy.

We share personal data only with the service providers needed to deliver the service, listed below and in the Sub-Processor List. Some of them process data outside the EEA; information on the transfer safeguards for each of them is available on request:

• Hosting - Velqory-operated infrastructure.
• Code and project repository- GitHub (Microsoft) hosts Velqory's repository, which may contain customer content.
• AI tools - Anthropic (Claude Code) and OpenAI (Codex), used by Velqory in development and operations work, may process customer content.
• Payments - payment providers named in the applicable invoice, proposal, or agreement. Card data never reaches Velqory systems.
• Email delivery- Velqory's email hosting provider, for transactional and contact-form messages.
• Edge security- Cloudflare provides DNS, TLS, tunnel transport, abuse controls, and, only when configured, Turnstile. It may receive IP address, request metadata, and the abuse-verification response; it does not receive Blog passwords or customer content from these flows. International processing is governed by Cloudflare's DPA and transfer safeguards.
• Audience measurement - Google Ireland Limited (Google Analytics), only if you accept analytics cookies. Data may be transferred to Google LLC in the United States, under the EU-US Data Privacy Framework and standard contractual clauses.
• Optional Google sign-in - currently disabled. If later enabled after notice, it is voluntary and limited to OpenID Connect identity scopes (openid, email, and profile). Google may process that identity data internationally under its published transfer frameworks; email sign-in remains available.

We may disclose data when required by applicable law, regulation, or court order issued by an EU member state authority.

Account and contact data is kept for as long as the relationship with the customer or the contracted engagement lasts; afterwards, only where a legal obligation requires it (e.g. tax records: 10 years under Portuguese law).

Usage and device data is kept only as long as needed for security and operation of the website. Google Analytics keeps event data for 2 months and user-level data for 14 months, a period that restarts with new activity.

Blog comments remain public while they are active. You may request correction or use the account controls to export and delete the Blog account. Deletion removes the external identity and active sessions and anonymises the public profile and contributions. A limited moderation or security record may be retained for as long as necessary to prevent repeated abuse, resolve a dispute, or comply with law.

Customer content export, return, deletion, and backup timelines are governed by the applicable agreement, DPA, and legal retention requirements. Where no specific period is written, Velqory uses a reasonable transition window and confirms the handover in writing.

As a data subject in the EU, you have the following rights under the GDPR:

• Access (Art. 15) - request a copy of the personal data we hold about you.
• Rectification (Art. 16) - correct inaccurate or incomplete data.
• Erasure (Art. 17)- request deletion (the "right to be forgotten").
• Restriction (Art. 18) - limit how we process your data.
• Portability (Art. 20) - receive your data in a structured, commonly-used, machine-readable format.
• Objection (Art. 21) - object to processing based on legitimate interest.
• Withdraw consent (Art. 7) - at any time, where consent is the lawful basis.
• Lodge a complaint - with the Portuguese supervisory authority (CNPD) or your local supervisory authority.

To exercise any right, contact suporte@velqory.com. We respond within 30 days.

In the event of a personal data breach likely to result in risk to the rights and freedoms of natural persons, we will notify the competent supervisory authority (Portugal: CNPD) within 72 hours of becoming aware, in accordance with Article 33 of the GDPR.

Where the breach is likely to result in high risk to data subjects, we will notify affected users without undue delay, with a description of the breach, the data categories involved, the likely consequences, and the measures taken or proposed to address it (Article 34).

We use strictly necessary cookies for authentication, session management, and locale preference. These do not require consent under the ePrivacy Directive.

Optional analytics (Google Analytics) is loaded only with your consent via the cookie notice; before that, no request is sent to Google. You can change your choice at any time in "Cookie preferences", in the footer of every page.

We do not use advertising cookies. Google Analytics runs without advertising features or Google Signals.

Data location, storage, transfers, and subprocessors depend on the service, customer environment, DPA, and project scope. Where a cross-border transfer is required, it must rely on an appropriate legal basis and contractual safeguards.

Concrete subprocessors are identified in the applicable agreement, subprocessor list, or project documentation when they are relevant to the contracted service.

Velqory aligns its security and privacy program with the following frameworks:

• GDPR (Regulation EU 2016/679)- primary legal framework for processing of EU residents' personal data.
• NIS2 Directive (EU 2022/2555) - for cybersecurity risk management and incident reporting.
• ISO/IEC 27001 - information security management preparation and control mapping where applicable.
• SOC 2 - operational control preparation and evidence where applicable.

Relevant security or privacy documentation may be requested from suporte@velqory.com, subject to customer status, scope, and confidentiality requirements.

We may update this policy periodically. Material changes will be announced via email or agreed project communication channel at least 30 days before they take effect.

For questions, requests, or concerns regarding this Privacy Policy:

• Email: suporte@velqory.com
• Administrative details are provided in formal documents where required.

You may also lodge a complaint with the Portuguese data protection authority: Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt.