Privacy Policy

1. Who operates VELYRN and what this policy covers

VELYRN is operated by Armani Calva. In this policy, “VELYRN,” “we,” and “us” refer to VELYRN, operated by Armani Calva. VELYRN is not represented as a corporation or other separate legal entity. A business that creates a workspace decides what customer and lead information its authorized users enter or use there and controls access through workspace roles. People whose information is handled in a business workspace should ordinarily contact that business first for workspace-specific requests.

2. Information handled by the service

• Account data, including name, email address, password hash, membership, role, and authentication-security metadata.
• Business configuration, locations, hours, offerings, knowledge, rules, team invitations, and integration settings.
• Lead and customer data, including names, email addresses, phone numbers, sources, notes, status, and assigned staff.
• Customer and staff conversation content, AI responses, structured customer memory, follow-ups, and appointments.
• AI reliability and usage records such as provider/model, token counts, latency, cost estimates, request identifiers, and hashed prompt-context fingerprints.
• Subscription, invoice, and usage records. The current paid-provider flow is disabled or test-only and does not collect payment-card numbers.
• Technical records such as request route, response status, duration, tenant/user identifiers, audit events, alerts, and hashed API, widget, or session tokens.

3. Sources and purposes

Information comes from account holders and their teams, their customers and website visitors, configured integrations when separately enabled, and the service's own operation. It is used to authenticate users, separate workspaces, provide CRM and business-operations features, generate and review AI-assisted work, maintain safety and audit boundaries, support billing records, prevent abuse, troubleshoot, and respond to access, export, or deletion requests.

4. AI processing

When an authorized workspace uses an external AI provider, VELYRN may send the current customer message, recent conversation, customer contact fields, structured memory, relevant business configuration, offerings, knowledge, appointments, and follow-ups needed to produce a response. The configured AI integration requests that provider-side response storage be disabled, but this is not a promise of zero provider retention. Provider behavior remains subject to the provider's applicable configuration and terms. AI output may be inaccurate, incomplete, or stale. Authorized staff must review customer-facing and consequential actions before they are taken.

5. Service providers and disclosures

VELYRN uses hosting, database, AI, mobile-build/update, and other technical services as configured by the operator. Email, SMS, calendar, payment, social, and public-research providers are disabled in the current public mobile release. Information is visible to authorized workspace members according to their roles. VELYRN may preserve or disclose information when reasonably necessary to protect the service, respond to valid legal process, or enforce applicable terms, subject to review by the operator.

6. Cookies and local device storage

The web app uses necessary, HttpOnly session and active-workspace cookies. An installed website widget uses browser local storage for a random visitor reference and a revocable chat-session token so a visitor can resume a conversation. The mobile app stores its access token in device-protected storage and keeps only the selected business and biometric-lock preference in ordinary local storage. The current clients do not include an advertising or cross-app tracking SDK. If those practices change, this notice and any required consent experience must change first.

7. Security

The current implementation hashes passwords and long-lived access keys, uses tenant-scoped authorization, keeps configured provider credentials server-side, uses HTTPS for non-local clients, records selected audit evidence, and redacts common email, phone, token, and password patterns from structured application logs. No security control eliminates all risk, and VELYRN does not claim a certification that has not been independently earned.

8. Retention, export, and deletion

Workspace owners can configure conversation, knowledge, and audit retention targets, but those targets do not automatically purge every related record or backup. Signed-in users can request an account export and can permanently delete their account from the product. Account deletion requires authentication, matching email and password confirmation, and a final destructive warning. It revokes sessions, removes memberships, disables authentication, and deletes or irreversibly disassociates the person's account data.

In a shared workspace, legitimate business and customer records remain available to other authorized users without preserving the deleted person's account access. A last owner must transfer ownership before deleting an account if other members remain. A workspace with one owner and no other members is closed and its primary-database workspace records are deleted with the account. VELYRN retains a non-identifying completion receipt and may retain minimized security or legal evidence without the deleted name, email, password, or active user link. Deleted primary data may remain temporarily in restricted backups until those backups age out or are replaced. Separate full-workspace export or deletion requests remain operator-reviewed.

9. Choices and requests

Signed-in users can update their name, change their password, revoke sessions, and request export or complete account deletion in Account & securityor the mobile Settings screen. People whose data was supplied by a VELYRN business should ordinarily contact that business first. Questions or requests for VELYRN can be sent to privacy@velyrn.co. For a request that is not available through self-service, include enough information to identify the relevant account or workspace, but do not send passwords or unnecessary sensitive information by email. General help is available at Support.

10. Children and international processing

VELYRN is designed for adult business users and is not directed to children. Do not enter children's data or regulated or highly sensitive information unless the relevant business has a lawful, reviewed basis and VELYRN has expressly approved that use. VELYRN may process information in the United States and in locations where configured technical providers operate.

11. Changes and contact

Material policy changes will receive a new version and effective date, be linked from the product, and require renewed acknowledgement where appropriate. For privacy questions or privacy requests, email privacy@velyrn.co. For general support, email support@velyrn.co.