Privacy policy

1. Who we are

Veleva is provided by DEMEMO LABS, S.L., a Spanish company. Where this policy says we decide how and why personal data is processed, DEMEMO LABS, S.L. is the data controller.

Company

DEMEMO LABS, S.L.

Tax ID (NIF)

B88725221

Registered office

Calle Monasterio de las Batuecas 17, portal A, Ático, 28049 Madrid, Spain

Email

[email protected]

2. Our role and your organization’s

Veleva is a business product. Organizations subscribe to it and invite their people as members. We play two different roles.

• Controller. We are controller for data about website visitors, people who contact us, account holders (to run and secure their accounts), billing contacts, and the security, diagnostics and usage records we keep to operate the service.
• Processor. For the content an organization and its members put into Veleva, such as tasks, workflows, comments, files and library items, we act on the organization’s behalf and follow its instructions. The organization is the controller. Our processing is governed by our agreement with it, including a data processing agreement (DPA).

If you use Veleva through your employer or another organization, its administrators can manage your membership, role and permissions. They can also see usage, cost and audit information about your activity. Contact them first about data they control. We will help them respond.

3. Where data lives

Veleva is designed so that the most sensitive working material stays on your computer.

Stored only on your device

• Chat conversations with agents, including messages, tool output and files you attach to a chat.
• Voice dictation. Audio is transcribed on your device and is not sent to us. The resulting text is then handled like any other message you type.
• Credentials for local connectors you configure on your computer.
• Project memory notes, which are written to a .veleva folder inside the workspace folders you choose.
• Data in the app’s built-in browser, such as cookies from sites the agent visits for you.
• A local copy of your organization’s shared data, kept so the app works quickly and offline.

This data stays on your computer, protected by your operating system’s account and disk security. We cannot access it. Signing out removes the local copy of organization data and saved local connector credentials. Chat history stays on the device until you delete it or remove the app’s data folder.

Stored in Veleva’s cloud

• Your account and organization details (see section 4).
• Shared work: tasks (titles, descriptions, instructions and results), workflows, projects, comments, attachments added to comments, library items and skills.
• When an agent completes a task, its final answer is saved to the task as a comment so your team can review it. The full conversation, the agent’s reasoning and its tool output stay on your device.
• Usage, cost, audit and diagnostic records, which contain no prompt or response text.

Passing through without being stored

• Requests to AI models (see section 5).
• Calls to connected tools such as Gmail, Google Drive, Microsoft 365 or Slack, and web searches. Our gateways forward them and record only technical metadata such as the tool, status and timing.

4. Data we collect

Account and organization

We collect your name, email address, password (stored as a hash by our authentication provider), organization, role (owner, administrator or member), membership status and policy groups. Your organization may also add your job title, department, team and manager.

Invitations

When an administrator invites you, we store your email address, the details they entered, a one-time activation code, and the progress of your invitation. Progress means when the invitation was sent, opened and accepted, and when you finished onboarding and started the download.

Customer content

This is the content described in section 3 that is stored in our cloud. We process it to provide the service to your organization.

Usage and cost records

For each AI request we record the organization, user, task, provider, model, token counts, estimated and final cost, timing, status and identifiers. We record no prompt or response text. We also keep records of library usage, achievements, connector status, administrative actions (the audit log) and governance decisions.

Desktop diagnostics

The desktop app sends technical diagnostics while you are signed in. These include the app version, operating system, processor architecture, error and event codes, timings, and memory and CPU samples. They are designed to exclude free text, file paths, URLs, prompts, tool content and credentials. Crash dumps stay on your device.

Connectors

When your organization connects a service such as Google Workspace, Microsoft 365 or Slack, we store the resulting access tokens encrypted in our cloud vault. The desktop app never holds them. Content from these services is fetched only when you or an agent you direct uses a connected tool, and only within the permissions granted. That content is delivered to your device and not stored by us.

Support and bug reports

We keep the messages, descriptions and any files you send us when you ask for help or report a problem.

Contact requests

When you submit the website contact form, we collect your name, work email, company and role. These details go to our team’s internal messaging workspace so we can reply. We may then email you about Veleva.

Technical and security data

Like any online service, our infrastructure processes IP addresses, request metadata and security signals. We use them to deliver the service, prevent abuse (for example, rate limits and bot checks) and investigate incidents.

5. AI models and providers

Your organization chooses which AI providers and models its members can use, and supplies or selects the credentials for them. When you send a message or an agent works on a task, the request goes from your device through Veleva’s inference gateway to that provider. The gateway checks your permissions, enforces limits and records the usage metadata described in section 4. It does not store prompts, responses, reasoning or tool payloads.

• The provider receives and processes the request content under its own terms and privacy policy, including any retention it applies. Veleva’s preset providers are configured for EU inference and zero data retention where the provider supports it.
• If you sign in to a provider directly from the app, or use a model running on your own computer, requests go straight from your device to that provider or model without passing through Veleva.
• We do not use your content to train AI models, and we do not allow our preset providers to do so.

Some features also send content through the gateway, such as generating a title for a new task from its text. Web searches requested by an agent are sent to our web search provider through our search gateway.

6. Purposes and legal bases

We do not sell personal data, use it for third-party advertising, or make decisions about you that produce legal or similarly significant effects based solely on automated processing.

7. Service providers

We share personal data only with providers who help us run Veleva, under contracts that limit their use of it. We also share it with providers you or your organization choose to connect, or where the law requires.

We may also disclose data to professional advisers, to authorities when legally required, or to a successor in a merger or acquisition, subject to this policy.

8. International transfers

Veleva’s cloud infrastructure is hosted in the European Union. Some of the providers above are based in, or may access data from, countries outside the European Economic Area. When this happens, we rely on an adequacy decision (such as the EU–US Data Privacy Framework, for certified providers) or on the European Commission’s Standard Contractual Clauses, with additional safeguards where needed. Where AI requests are processed depends on the provider and configuration your organization chooses.

9. How long we keep data

• Account, organization and customer content: for as long as your organization’s subscription is active. After the subscription ends, we delete or anonymize it as set out in our agreement with your organization, unless the law requires us to keep it.
• Usage, cost and audit records: for the life of the organization’s account, so it can review its governance history. After that, we keep them only as long as needed for billing, legal or security purposes.
• Desktop diagnostics: 60 days.
• Invitation activation codes: 7 days, or until used.
• Contact requests: for as long as needed to answer and follow up, and no longer than 24 months after our last interaction.
• Billing records: for the periods required by Spanish tax and commercial law (generally six years).
• Data on your device: until you delete it, sign out (for the local copy of organization data) or remove the app and its data folder.

10. Security

We protect data with encryption in transit, encrypted storage for secrets such as provider keys and connector tokens, role-based access controls, organization-level isolation, short-lived access tokens, permission checks at our gateways, audit logging and signed desktop releases. On your computer, Veleva stores your sign-in session using your operating system’s secure storage where it is available.

No system is perfectly secure. If a breach affects your personal data, we will notify you, your organization and the competent authority as the law requires.

11. Your rights

Under the GDPR and Spanish data protection law, you can:

• access your personal data and get a copy of it;
• have inaccurate data corrected;
• have data erased;
• restrict how we process it;
• receive it in a portable format;
• object to processing based on legitimate interests, including direct marketing;
• withdraw consent at any time, without affecting earlier processing.

Write to [email protected]. We will reply within one month. We may need to verify your identity first. For content your organization controls, we will pass your request to it or help it respond.

You can also complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos) or to the supervisory authority where you live or work.

12. Website analytics and storage

On veleva.ai we use PostHog, hosted in the EU, to understand how the website is used. It records page views, time on page and a few specific actions, such as clicking to download or to contact us. It may also record anonymized session replays.

• Session replays mask everything typed into fields and exclude the contact form.
• Analytics data is not linked to a personal profile.
• Our configuration tells PostHog not to store your IP address, and we remove query strings and referrers from recorded URLs.

PostHog keeps an identifier in your browser’s local storage instead of a cookie. If your browser sends a “Do Not Track” signal, analytics does not run.

Our contact form uses Cloudflare Turnstile to block automated abuse. Turnstile processes browser signals for this purpose only. We also remember your language choice so we can send you to the right version of the site.

The Veleva web app uses only the browser storage it needs to keep you signed in and to remember your language and theme. It contains no analytics or advertising trackers.

13. Children

Veleva is a professional tool and is not intended for anyone under 18. We do not knowingly collect personal data from children.

14. Changes to this policy

We may update this policy as Veleva evolves. We will post the new version here and change the date at the top. If a change is significant, we will tell account holders in advance through the product or by email.

15. Contact

Questions about this policy or your data: [email protected], or by post to DEMEMO LABS, S.L., Calle Monasterio de las Batuecas 17, portal A, Ático, 28049 Madrid, Spain.

See also our terms of service.