Privacy Policy

Vedlora (“Vedlora”, “we”) operates vedlora.com and the Vedlora dashboard, API and related services. For account and billing data we are the data controller. Contact us at privacy@vedlora.com or 201, Worldmark, Sector 65, Gurugram, Haryana, India 122101.

• Account data: your name, email address, whether your email is verified, and your password in hashed form (we never store it in plain text). If you sign in with Google, we receive your name, email address, verification status and profile picture URL from Google, and store the tokens Google issues for that sign-in.
• Workspace data: projects, brands, domains, prompts, webhook endpoints, notification preferences and team membership.
• Billing data: Dodo Payments collects your payment details as merchant of record. We receive your Dodo customer ID, plan, subscription status and billing dates, not your card number.
• Usage and technical data: IP address, browser user agent, request logs with request IDs, credit usage, and API key “last used” times. API keys are stored as one-way hashes.
• Website analytics: when you visit our public pages, the page, the site you came from, campaign tags in the link (such as utm_source), your country and device type. We don't use cookies or browser storage for this and don't store your IP address: visits are counted with a one-way code built from your IP address, browser and a random value that is deleted after two days, so a visit can't be linked to you afterwards. We skip this entirely if your browser sends Global Privacy Control or Do Not Track.
• How you found us: when you create an account, we save the site, campaign and first page from that day's visit with your account, to understand which channels bring customers.
• Communications: messages you send to support and email delivery status.

• To provide the Service: authenticate you, run your projects, collect and analyze answers, and send alerts and webhooks you set up (performance of a contract).
• To bill you and enforce plan limits (performance of a contract; legal obligations for financial records).
• To secure the Service: rate limiting, abuse prevention and debugging (legitimate interests).
• To send service emails such as verification, password resets and important changes (performance of a contract).
• To improve the Service using aggregated, de-identified usage information (legitimate interests).

We don't sell personal data, don't share it for cross-context behavioral advertising, and don't use advertising trackers. We don't use your data to train AI models.

Tracking works by sending the prompts you configure to the AI engines you select. Requests are made from Vedlora's own accounts and are not linked to your identity. Identical prompts from different customers may share one request. For sentiment scoring we also send short answer excerpts and brand names to an AI provider.

Don't put personal data or confidential information in prompts or brand names. Each provider processes this data under its own API terms and privacy policy.

We use one strictly necessary session cookie to keep you signed in to the dashboard, and browser local storage to remember which workspace you last selected. We don't use analytics or advertising cookies, so there's no cookie banner. Website analytics work without cookies or browser storage (see “Data we collect”), and our host, Cloudflare, also counts page views without cookies.

We share data only with providers that help us run the Service, under contracts that limit their use of it:

We may also disclose data if required by law, to protect our rights or users' safety, or as part of a merger or acquisition, with notice where permitted.

Our providers may process data in the United States and other countries. Where required, transfers are protected by safeguards such as the European Commission's Standard Contractual Clauses.

• Account and workspace data: while your account is active. You can delete your account yourself under Settings → Account. Deletion takes effect immediately in our systems: your profile, sessions and API keys are removed, workspaces where you're the only member are deleted with their projects, and any subscription on them is cancelled. Copies in database backups expire within 30 days.
• Collected answers and metrics: while the project exists; deleting a project deletes its results.
• Request logs: up to 30 days. Webhook delivery records: up to 90 days.
• Team invitations, including the invited person's email: until 30 days after they're accepted, revoked or expire.
• Website analytics page views: 13 months. The daily random values: two days.
• AI crawler visits and visits arriving from AI answers, reported by your site (crawler or AI source, page path, status and daily counts; no IP addresses, user agents of people, or query strings): 13 months.
• Billing records: as long as tax and accounting laws require.
• Shared answers that aren't linked to any person may be kept in de-identified form to operate the Service.

Data is encrypted in transit with TLS. Passwords and API keys are stored as one-way hashes, webhooks are signed, and access to production systems is restricted. No system is perfectly secure; if a breach affects your personal data, we'll notify you and regulators as the law requires. Report vulnerabilities to support@vedlora.com.

Depending on where you live, you may have the right to:

• access and get a copy of your personal data;
• correct inaccurate data;
• delete your data;
• object to or restrict certain processing;
• receive your data in a portable format;
• withdraw consent where processing is based on consent.

You can delete your account from Settings → Account at any time. For the other rights, email privacy@vedlora.com from your account email; we'll respond within 30 days. You can also complain to your local data protection authority. We won't discriminate against you for exercising your rights.

Vedlora is a business service and isn't intended for anyone under 18. We don't knowingly collect data from children.

We'll post updates here and change the date above. For material changes, we'll notify you by email or in the dashboard before they take effect. See also our Terms of Service.