Privacy policy

Who is responsible

The data controller is Velito, [to be completed: company name, registered office and VAT number].

For any privacy question: [to be completed: dedicated email address]. If you're in the pilot, you can also write to us from the app: open the assistant and tap “Talk to a person”.

What data we handle

Velito is in preview. With an account you work with your real data, which we keep; in the demo, data stays in your device's browser and never reaches us.

• Account: the phone number or email you sign in with and, if you use Google or Apple, the email and name they share with us. Plus the name you enter in your profile.
• Your business: name, address, contacts, VAT number and document details, services, hours, price list, and your website's texts and design.
• Your clients' data, which you enter or which arrives from your website: names, phone numbers, emails and addresses in quotes, jobs, DiCo forms and bookings, and contact-form messages.
• Photos: those of your website and your jobs, with their GPS position removed before upload.
• Voice: voice notes become text, which stays in the quote or job. The audio isn't saved on our servers.
• The feedback and screenshots you send with “Send feedback”, and the requests you leave on the Advertising page.
• The Velito assistant: the questions you ask and its answers, and the requests you send with “Talk to a person” (with the conversation and some details of your business: name, trade, town, plan, counts of quotes and jobs). Before saving them we remove card numbers, passwords and ID numbers. On Velito's website, without an account, questions are linked only to a non-reversible fingerprint of the IP address.
• Usage data: which screens and features you use, counted per business, with no content and no cookies.
• Crash reports: the error message, the page and the browser, linked to your account if you're signed in.
• Technical data: the provider hosting the website and the app (Vercel) handles the data needed to serve the pages, such as IP address and browser type, in technical logs. For abuse limits we use a one-way hash of the IP address, never the address itself.

We use no third-party analytics, advertising or profiling tools.

Why we handle it

• To let you use Velito: your account, quotes, DiCo, jobs, clients, website and messages (performance of a contract, art. 6(1)(b) GDPR).
• To support you and fix errors: crash reports, your feedback and, when needed, the read-only access described below (legitimate interest, art. 6(1)(f) GDPR).
• To improve Velito, with usage counts only and no content (legitimate interest, art. 6(1)(f) GDPR).
• To answer an advertising request (steps before a contract, art. 6(1)(b) GDPR).
• To keep the service secure: abuse limits and technical logs (legitimate interest, art. 6(1)(f) GDPR).

We don't use your data for advertising, we don't sell it and we don't profile you. [Legal bases to be checked by a lawyer.]

Access for support

Velito's founder can open a business's app read-only, to help the owner when something goes wrong or to understand an error. The founder sees what the owner sees, but can't change or send anything.

Who receives it

We use these providers, which handle data on our behalf and only to run Velito:

• Supabase: database, photos and sign-in. The data is stored in the European Union, in Frankfurt.
• Vercel Inc. (United States): hosts the website and the app, and keeps their technical logs.
• Anthropic (United States): the AI that writes texts, when that feature is on. It only receives the text to work on: a voice note, transcribed or typed, with your price list; a job's notes; the client's name when it writes a reminder or a review request; the business description and up to three small photos when it designs your website; questions to the assistant, with Velito's guides and some details of your business (never your clients' data).
• OpenAI (United States): transcribes voice notes, only when server transcription is on. Otherwise your phone's browser recognises your voice, under the rules of whoever makes it (Google or Apple, for example).
• Resend (United States): sends Velito's emails, when they're on (for example the notice of a message from your website).
• Twilio (United States): sends sign-in codes by text message, through Supabase.

For providers based outside the European Union, data is transferred with [to be completed by a lawyer: transfer safeguards, for example standard contractual clauses or the Data Privacy Framework].

We don't sell data or share it with anyone for advertising.

Your clients' data

For your clients' data (what you enter and what arrives from your website) you are the controller, and Velito handles it on your behalf as a processor. [To be completed by a lawyer: data processing agreement, art. 28 GDPR.]

The website Velito builds for you has its own privacy notice, already filled in with your details, to be checked by an advisor.

How long we keep it

Your account's data stays as long as the account exists. If you delete it in Settings, we delete the business with it and everything in it (quotes, jobs, clients, bookings, messages, photos and PDFs), together with your feedback and its screenshots, your conversations with the assistant and your requests.

Questions asked to the assistant on Velito's website, without an account, are kept for 30 days. Usage counts, crash reports, advertising requests and technical logs: [to be decided with a lawyer: for how long].

In the demo, without an account, data stays only in your device's browser: you delete it with “Reset demo” or from your browser settings.

Your rights

You have the right to access your data, have it corrected or erased, restrict or object to its processing and ask for its portability, by writing to the controller. You can also complain to the Italian data protection authority (Garante per la protezione dei dati personali, garanteprivacy.it).

You can delete your account at any time in Settings. Downloading all your data as a file from the app is coming soon: until then, you can ask us for it.

Cookies

We only use technical cookies, with no analytics or advertising: the list is in the cookie policy.