1. Introduction
Velogics AI Inc. ("Velogics", "we", "us"), based in Ottawa, Ontario, Canada, provides AI agents and a workspace for service businesses: a website chatbot, smart forms, online booking, missed-call text back, an AI Receptionist that answers inbound calls, text and email follow-up, outbound email campaigns, review management, a CRM, and the Owner Agent. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the rights available to you. It applies to the Velogics marketing site (velogics.ai), the operator portal (app.velogics.ai), the chat, form and booking widgets we provide, and any message Velogics sends on behalf of a business that uses our platform.
2. Definitions
- Operator, a business customer that subscribes to Velogics and uses the platform to engage with its own customers and leads.
- End User, a lead, prospect, customer, or other individual whom an Operator engages through Velogics (for example, a person who fills out an Operator's form, calls the Operator's phone line, books through the Operator's booking page, writes to an email address the Operator forwards to Velogics, or receives an email from an Operator's campaign).
- Visitor, anyone who browses the Velogics marketing site without signing in.
- Personal Information / Personal Data, information that identifies, relates to, describes, or could reasonably be linked to a particular individual or household.
3. Our Roles (Controller vs. Processor)
Velogics acts in two different roles depending on whose data is at issue:
- As a controller, for personal information about Operators and Visitors (account profile, billing data, support conversations, marketing-site analytics). We determine the purposes and means of processing this data.
- As a processor / service provider, for End-User data that an Operator routes through Velogics (chat conversations, form submissions, photos, call transcripts, texts and emails, bookings, CRM records, campaign content, and reviews). The Operator is the controller of that data and determines why and how it is used; Velogics processes it on the Operator's documented instructions through the platform.
Operators that need a formal Data Processing Agreement can review our standard DPA at velogics.ai/legal/dpa or email admin@velogics.ai.
4. Information We Collect
From Operators (account holders)
- Identifiers: name, business name, email, phone, billing address.
- Account credentials (passwords are stored only as salted hashes) and session data.
- Billing data: subscription and invoice history. Card details are collected and held by our payment processor; we do not store full card numbers.
- Business settings and knowledge-base content (services, prices, hours, service areas, FAQs, rules for the AI).
- Credentials for connected services (Google Business Profile, Microsoft Outlook, HubSpot, Follow Up Boss), stored encrypted.
- Messages an Operator exchanges with the Owner Agent, by text or in the operator portal.
- Usage and top-up records: how much of each plan allowance was used, and each top-up request and approval (who approved it, when, how, the pack and its price).
- Invoice and tax settings used in quotes, invoices and accounting exports, such as a business tax number.
- Support communications, feedback, and feature requests.
- Usage and security data: feature use, sign-in times, error logs, IP addresses, user-agent strings.
From End Users (on behalf of Operators)
- Contact details given in a chat, form, booking, call, text or email: name, email, phone, address, and the service requested.
- Chat transcripts and answers to the questions an Operator sets up.
- Transcripts and details of inbound calls answered by the AI Receptionist (see §6).
- Text messages and emails sent and received through the platform, including any photos or files attached to them.
- Photos a person sends through the website chat or form. Photos and files are kept in private file storage and shown only to the Operator's signed-in team (and, in the chat, to the person who sent them).
- If an Operator forwards its business inbox to Velogics: new email sent to that inbox, including from people who aren't customers (for example suppliers or job applicants). Of the email the AI doesn't treat as a customer enquiry, we keep only the 20 most recent, text only and encrypted, so the Operator can check the sorting.
- Email delivery and engagement data for campaign emails (sent, delivered, opened, clicked, replied, bounced, unsubscribed).
- Appointment and booking details.
- CRM records the Operator keeps, such as notes, tasks, quotes, jobs and invoices.
- Messaging consent and opt-out records.
- Signals used to check a conversation for signs of a scam (for example the wording of messages, links in them, and whether a phone number or email address looks unusual), and the resulting warning.
- Public Google reviews of the Operator's business (reviewer name, rating, review text) and the replies to them.
- For outbound email campaigns: prospect-list data provided by or for the Operator (name, role, company, published business email address). Before a campaign emails them, addresses are checked with an email-verification service.
From Visitors (marketing site)
- IP address, device and browser details, referrer URL, pages visited.
- Information you give us through the chat, contact form or demo booking on our site.
- Cookies and similar technologies as described in §12.
5. How We Use Information
We process the data described above to:
- Provide, operate, secure, and improve the platform and each AI agent Operators subscribe to.
- Authenticate Operators and protect against unauthorised access.
- Respond to End Users on Operators' behalf, including chat and text replies, answering calls, booking, reminders, follow-up messages, email campaigns, and review follow-ups.
- Sort new email that arrives at an inbox an Operator forwards to Velogics, so customer enquiries get an answer.
- Keep an Operator's inbox, CRM and calendar up to date, and alert the Operator to new bookings and conversations that need a person.
- Check conversations for signs of a scam and warn the Operator, without blocking the conversation.
- Build reports and accounting exports for the Operator from its own records.
- Bill and collect payment, including measuring use against plan allowances and asking for and recording top-up approvals.
- Provide support and respond to inquiries.
- Detect and prevent fraud, abuse, and violations of our Acceptable Use Policy.
- Comply with legal obligations and respond to lawful requests.
- Aggregate or de-identify data for analytics and product improvement (such data is no longer Personal Information).
Legal bases (GDPR / UK GDPR): where applicable, we rely on performance of contract (operating the platform for paying Operators), our legitimate interests (security, abuse prevention, product improvement), consent (where you have given it, for example, marketing communications), and compliance with legal obligations.
We do not sell Personal Information, and we do not use End-User chat, call, text, or email content to train AI models.
6. Voice Calls, Recording and Transcription
The AI Receptionist answers inbound calls to an Operator's business line. Velogics does not place outbound AI calls. Calls are handled by our voice provider (ElevenLabs, see sub-processors), which processes the call audio in real time and keeps a recording and transcript of each call. The standard greeting tells callers that the call may be recorded. Operators are responsible for making sure their greeting and any disclosures meet the recording-consent and AI-disclosure laws that apply to their callers.
- What we keep: the call transcript, the caller's phone number, call details (time, duration, outcome, transfers), and anything captured during the call (name, service requested, appointment time). Velogics does not keep its own copy of the call audio.
- Why: to show the call to the Operator, update the CRM and calendar, summarise the call, flag conversations that need a person, check calls for compliance and quality problems, and investigate complaints or disputes.
- Who can access: the Operator and their authorised team members in the operator portal; Velogics personnel only when needed to support, secure, or investigate a specific issue.
- Retention: transcripts are kept as described in §14. The voice provider keeps its own copies under its retention terms.
7. AI Processing of Personal Information
Velogics uses third-party AI providers to power its features: Anthropic (Claude) for text, and ElevenLabs for voice. The AI writes replies to chats, texts and emails, answers calls, summarises conversations, drafts suggested replies for escalations, runs the Owner Agent, drafts review replies, writes campaign email templates, sorts new email at a forwarded inbox, and checks lead conversations for signs of a scam so the Operator can be warned. When a customer sends a photo, the AI looks at it to answer and may add a short description of it to the lead. We send only the inputs a feature needs, typically the Operator's settings and knowledge base, the conversation in progress (including photos customers send), and the relevant contact and booking details. We do not send passwords or connected-account credentials.
Under Anthropic's commercial terms, Anthropic does not train its models on the content we send through its API. Velogics does not train AI models on End-User content. To check and improve reply quality, our team may review conversations and keep selected examples as internal test cases.
Operators are responsible for any AI disclosure the law requires in their website chat, calls, texts and emails.
Health Information
Velogics is not HIPAA compliant, does not act as a HIPAA Business Associate, and does not sign Business Associate Agreements today. Operators must not use Velogics to collect or process protected health information, or personal health information under Canadian health-privacy laws such as Ontario's PHIPA, unless Velogics has agreed in writing that their account is set up for it. See velogics.ai/legal/baa or email admin@velogics.ai.
8. SMS / Text Message Policy
By providing your phone number, you agree to receive SMS messages from Velogics or, where applicable, from a Velogics Operator using Velogics to communicate with you. These messages relate to your service inquiry, appointment confirmations and reminders, follow-up communications, and (where you have agreed) offers and check-ins from that business.
- Message frequency varies based on your interaction with the business.
- Message and data rates may apply.
- Reply STOP (or a similar word such as UNSUBSCRIBE or CANCEL) to opt out of texts from that business. Reply START to opt back in.
- Reply HELP for the business's contact details, or reply with a question. You can also email admin@velogics.ai.
- Consent to receive SMS is not a condition of purchase.
- We do not sell or share mobile numbers or texting consent with third parties for their marketing.
Texting through Velogics follows Canada's Anti-Spam Legislation (CASL) and, for U.S. recipients, the TCPA and carrier messaging rules. The first text to a new contact includes opt-out instructions, opt-outs are recorded automatically, and automated follow-up texts respect quiet hours. Operators are responsible for obtaining and documenting consent before texting anyone outside the normal reply to an inquiry, including contacts they import or sync from another system.
9. Data Security
Data is encrypted in transit (TLS), and all stored data is encrypted at rest by our database provider. On top of that, Velogics encrypts connected-account credentials and message content with AES-256-GCM at the application level; messages stored before that layer was introduced are protected by the storage-level encryption. Passwords are stored as salted bcrypt hashes. Access inside an account is limited by role (owner, staff, read-only), and administrative access by Velogics staff is logged. Incoming webhooks are authenticated. Files that people send are kept in private storage, and files other than images are not opened inside the operator portal. We host on providers that hold SOC 2 Type II reports (Vercel, Neon). Velogics itself does not currently hold a SOC 2 report; please contact us if your procurement process needs additional security documentation.
10. Data Sharing and Sub-Processors
We do not sell Personal Information. We share it only with: (i) the Operator whose service generated the data, (ii) sub-processors that help us operate the platform, (iii) services the Operator chooses to connect, (iv) authorities when required by law, and (v) acquirers in the event of a merger, acquisition, or sale of assets.
Our sub-processors include Vercel, Neon, Upstash, Anthropic, ElevenLabs, Twilio, Postmark, MillionVerifier and Stripe. The current list, with what each one does, is maintained at velogics.ai/legal/sub-processors. We update that page before a new sub-processor starts processing Operator or End-User data, as described in our DPA.
11. Google API Integration
Velogics integrates with Google services on behalf of Operators who connect them. This section describes what Google user data we access and how we handle it.
What we access
- Google Business Profile (OAuth scope
business.manage, plusopenid,emailandprofileto identify the connecting account) - find the Operator's Business Profile listing, read the reviews on it and publish the review replies the Operator approves. - Google Calendar- when an Operator shares a calendar with Velogics' service account, we read availability and events on that calendar (to show them in the Velogics calendar), and create, update and cancel the appointment events Velogics books.
How we store this data
OAuth access and refresh tokens are encrypted with AES-256-GCM before being written to our database. Synced reviews and appointment details are stored per Operator and isolated by business; one Operator cannot access another Operator's connected-account data.
How we use this data
Google Business Profile data is used only to show the Operator's reviews inside Velogics, to draft replies, and to publish the replies the Operator approves. Google Calendar data is used only to offer open times, to show the Operator its calendar inside Velogics, and to keep the Operator's bookings on their calendar. We do not use Google user data for advertising, profiling, or analytics outside the Operator's own account, and we never share Google user data with any third party except the sub-processors listed below that we engage to provide the Operator-authorised features.
Use of AI sub-processors
To draft review replies, Velogics sends the review (reviewer name, rating and text) and the Operator's business context to a third-party large language model provider (Anthropic Claude). We never send the Operator's OAuth tokens or Google account profile. Anthropic processes these inputs as a sub-processor bound by its Commercial Terms, and does not train models on Velogics API traffic. This sub-processing falls within the Limited Use exception for transfers necessary to provide the user-facing features the Operator authorised.
Sub-processors that handle Google data
- Vercel (United States), application hosting and serverless function execution. Google user data passes through Vercel only in memory during request handling.
- Neon (United States), managed Postgres database. Stores encrypted OAuth tokens, synced reviews and replies, and appointment details.
- Anthropic (United States), large language model API for drafting review replies, as described above.
Data retention
OAuth tokens are kept while the connection is active. Synced reviews and replies are kept for as long as the Operator's account is active. On account closure or on Operator request, all Google user data scoped to that Operator is permanently deleted within the timelines in §14, subject to any legal retention requirements.
Limited Use disclosure
Velogics' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, Velogics will not:
- use Google user data for serving advertisements, including retargeting, personalized, or interest-based advertising;
- transfer Google user data to any third party except as necessary to provide or improve user-facing features that the Operator has authorized, to comply with applicable law, or as part of a merger, acquisition, or sale of assets in which the receiving party agrees to honor the commitments in this policy;
- allow humans to read Google user data, except (a) with the Operator's affirmative agreement for specific Operator-supplied data, (b) where necessary for security purposes such as investigating abuse, (c) where required to comply with applicable law, or (d) where the data has been aggregated and anonymized and is used for internal operations;
- use data obtained through Google Workspace APIs, such as Google Calendar, to develop, improve, or train generalized or non-personalized AI or machine-learning models.
Revoking access and requesting deletion
- From Google: visit myaccount.google.com/permissions, find "Velogics", and remove access. To stop calendar access, remove Velogics' service account from your calendar's sharing settings. Velogics can no longer reach your Google data once access is removed.
- From Velogics: email admin@velogics.ai from the account email to disconnect a Google service. We stop all API calls, delete the stored tokens, and, if you ask, delete the synced Google data scoped to your account, while keeping the rest of your Velogics account active. We complete verified requests within 30 days.
- On account closure: all Google user data scoped to the closed account is permanently deleted as described in §14, subject to any legal retention requirements.
13. International Data Transfers
Velogics is based in Canada, but our hosting, database and most of our sub-processors are in the United States, so personal information is stored and processed in the United States. While it is there, it may be accessible to U.S. courts, law-enforcement, and government authorities under U.S. law. The exception is AI Prospector's email verification: prospect email addresses are checked by a service based in Hungary. If you are located in the European Economic Area, the United Kingdom, Switzerland, or another jurisdiction with cross-border data-transfer rules, we rely on the safeguards those rules allow, such as the European Commission's Standard Contractual Clauses, together with the technical and organisational measures described in §9.
14. Data Retention
- Operator account data and End-User data (chats, call transcripts, texts, emails, bookings, CRM records) are kept for as long as the Operator's account exists, so the Operator keeps its history and can reactivate a cancelled subscription.
- Operator deletions: Operators can delete contacts from their CRM at any time. Notes and tasks an Operator deletes are removed permanently after 30 days.
- Deleting an account: an Operator can ask us at any time, before or after cancelling, to export its data and to delete its account. Deleting an account permanently removes the account and all of its data, including the photos and files stored for it. We complete verified requests within 30 days.
- Backups: our database provider keeps a short, rolling restore history. Deleted data drops out of it as that history rolls over.
- Provider copies: our voice, telephony and email providers keep their own call, message and delivery records under their retention terms.
- Billing records, including top-up approvals: kept for as long as tax and accounting law requires (six years in Canada), even after an account is deleted.
- On End-User request: Operators are the controllers of End-User data; we will assist Operators in fulfilling End-User deletion requests.
15. Your Rights
Depending on where you are located, you may have the following rights with respect to your Personal Information.
Canada (PIPEDA and provincial laws)
Velogics handles the Personal Information of individuals in Canada in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial private-sector privacy laws, including Quebec's Act respecting the protection of personal information in the private sector. If you are located in Canada, you may:
- Access, request access to the Personal Information we hold about you.
- Correction, request correction of inaccurate or incomplete Personal Information.
- Withdraw consent, withdraw your consent to our processing at any time, subject to legal or contractual restrictions and reasonable notice.
- Complain, lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC), or with your applicable provincial privacy regulator.
EEA / UK / Switzerland (GDPR / UK GDPR / FADP)
- Access, request a copy of the Personal Information we hold about you.
- Rectification, correct inaccurate or incomplete information.
- Erasure, request deletion, subject to applicable legal exceptions.
- Restriction, limit how we process certain data.
- Portability, receive your data in a structured, machine-readable format.
- Object, to processing based on legitimate interests, including profiling and direct marketing.
- Withdraw consent, for any processing based on consent, at any time.
- Lodge a complaint, with your local data-protection supervisory authority.
California (CCPA / CPRA)
- Right to know, categories and specific pieces of Personal Information collected, sources, purposes, and recipients.
- Right to correct, inaccurate Personal Information.
- Right to delete, Personal Information we have collected, subject to legal exceptions.
- Right to limit use of sensitive Personal Information.
- Right to opt out of "sale" or "sharing", Velogics does not sell or share Personal Information for cross-context behavioural advertising; this right is therefore not exercised through us in practice.
- Right to non-discrimination for exercising any of the above.
- Categories of personal information sold or shared in the past 12 months: none.
How to make a request
Email our privacy officer at admin@velogics.ai from the email address associated with your contact, or use the SMS opt-out process described in §8. We respond to verified requests within 30 days. If you are an End User whose data was routed through Velogics by an Operator, please contact the Operator first; we will assist the Operator in responding.
16. Children's Privacy
Velogics is a business-to-business platform not directed at children. We do not knowingly collect Personal Information from anyone under 13 (or under 16 in the EEA / UK). If you believe we have inadvertently received such data, please contact admin@velogics.ai and we will delete it promptly.
17. Marketing Communications
Operators and Visitors who provide an email address may receive product updates, security notices, and occasional marketing from Velogics where the law allows it. Every marketing email includes an unsubscribe link; transactional and security emails (billing receipts, breach notices, account-critical alerts) cannot be opted out of while the account is active.
18. Changes to This Policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top of the page reflects the most recent revision. For material changes that affect how Operator or End-User data is processed, we will give Operators advance notice, at least 30 days where reasonably practicable, by email or in-product notice. Continued use of the service after the effective date constitutes acceptance of the revised policy.
19. Contact Us
For privacy questions, requests, or complaints, contact our privacy officer:
Velogics AI Inc., Ottawa, Ontario, Canada
Email: admin@velogics.ai
Phone: +1 (613) 383-5521