Data retention and deletion

1. Service data and export after termination

We retain operational data while needed to provide the Services under the customer's instructions. This includes messages, files, workflow content, Agent data, connected-account data and operational records. A customer may request an export for 30 days after the affected Services end. We delete production operational copies in Velanir's application databases and managed storage within the next 30 days, no later than day 60 after termination, unless the customer requests earlier deletion or a specific legal exception applies. Separate tool-provider copies follow Section 7.

Export is available on request to support@velanir.ai. Ending one workspace does not authorize deletion of another customer's data. Removing a membership or leaving an Organization ends that access; it does not itself delete the person's account or shared Organization data.

2. Personal account deletion

A verified account deletion request locks the account and revokes its active sessions. There is a 14-day period in which the request can be cancelled. After that period, deletion proceeds when applicable blockers have been resolved and reaches a point after which cancellation is no longer possible. We aim to complete the request within one month and respond within the period required by applicable law.

Ownership of a shared Organization, an unfinished closure or unresolved billing may require action before deletion can proceed. If a request is held, we explain the reason and what must happen next. A hold does not create unlimited retention or remove applicable response deadlines. If a lawful extension is needed, we notify the requester within the initial response period with the reason and expected timing. Contact support@velanir.ai if the self-service path cannot complete your request.

At purge, we remove the account's name, email, identity-provider reference, profile image and other erasable personal data. A minimal internal identifier may remain with the restricted records described below. It remains personal data while linkable to a person.

3. Organization closure

An authorized Organization closure suspends the Organization and starts a cancellable period of 30 days, or 14 days if the requester is its only active member. Cancellation is available until the purge commits. Operational copies in Velanir's application databases and managed storage are deleted by day 60 after closure is requested, subject to specific lawful exceptions and notice of any hold. Separate tool-provider copies follow Section 7.

Some Organizations must first resolve ownership, active services, subscriptions, payments or disputes. The product explains the required action; support@velanir.ai handles requests that cannot use the self-service path. Closing an Organization does not by itself delete every member's personal account. Connected services under a customer's own agreements may retain their own copies under those agreements.

4. Restricted records

Financial records: 7 years after closure. We retain invoices, billing and usage ledgers, payment and metering references, and the Organization name and billing contact needed to interpret those records. Access is restricted to authorized billing personnel for accounting, tax, disputes and legal claims. This does not authorize retention of unrelated customer content. When the period ends, the records are deleted unless a specific continuing legal obligation or lawful hold applies.

Audit records: 2 years after account deletion. Security and audit records that reference an erased person may retain the internal actor identifier, without their account name, email or identity-provider subject. Access is restricted. At the end of the period, these records are deleted or the actor reference is replaced with a fixed non-personal placeholder. Keeping only an identifier is restricted retention, not a claim of anonymization.

Deletion and closure request records: 24 months. We retain the limited records needed to demonstrate how the request was handled for 24 months after it is handled, with restricted access. They are not used for unrelated purposes and are deleted when the period ends unless a specific legal exception applies.

These periods support accounting obligations, security, legal claims and proof of privacy-request handling. We apply the legal basis available in the relevant jurisdiction; a foreign tax obligation does not by itself displace an individual's rights under EU data protection law.

5. Backups and recovery

Backups of Velanir's application databases and managed storage may contain data already deleted from production. Those copies are beyond ordinary use and expire within 30 days after production deletion. Current production schedules keep Control Plane daily backups for 7 days and runtime database backups for 14 days, with 7 days of point-in-time recovery history. The 30-day limit remains the maximum commitment for these backups if the schedules change. It does not describe a tool provider's separate retention under Section 7.

Backups are used for recovery, not to restore a deleted account's access or restart processing of erased data. If a backup is restored, we reapply the deletion records before putting restored personal data back into ordinary use. Restricted financial and audit archives follow their own periods in Section 4 rather than the backup period.

6. Profile images and connected accounts

A current Organization or personal profile image is retained while it is in use. After an image is replaced or removed, unused copies are eligible for deletion after a 24-hour safety period and are collected by a daily cleanup. This cleanup is limited to unused profile images and does not delete Agent files, knowledge or other current customer content.

When a connected account is disconnected or retired, we delete stored credentials and imported data as required by the applicable deletion process. Revocation at the third-party provider depends on that integration's capabilities. Deleting a connection in Velanir does not itself erase original messages, files or other records held in the customer's external service.

7. Tool-provider copies and limits

Tool providers engaged by Velanir may retain copies outside Velanir's application databases and managed storage. Those copies are distinct from records in services a customer connects under its own contract. Velanir remains responsible for its subprocessors under the DPA and will communicate applicable deletion instructions, seek confirmation and report remaining retention or limitations. Removing a project, connection or API key does not itself prove that a provider's logs were erased.

Composio. Composio processes connected-tool calls. Its published policy retains execution and trigger logs for up to one year, including request arguments, responses and trigger payloads by default. Velanir has enabled Composio's zero data retention setting for its production projects. Where that setting applies, Composio's execution logs record metadata only and omit request arguments and responses. The setting does not currently apply to connections made through Composio's own OAuth application, which includes Gmail, Google Calendar, Google Drive and most other connected apps, or to a new workspace's project until Velanir enables the setting for it. Separately, Composio stores trigger events in order to deliver them, holds files transferred by a tool for up to 24 hours, and may cache tool-search queries. Customers should therefore continue to expect the published retention rather than a shorter guarantee. Velanir's day-60 application-data deadline does not promise deletion of these logs by that date. Read Composio's retention policy.

Exa. Exa processes search queries. Its published pricing offers zero data retention under Enterprise terms, but Velanir has not established that this guarantee applies to its current configuration. We therefore do not promise zero retention or a fixed deletion period for Exa-held copies. The applicable customer agreement and configuration must be confirmed for processing that requires those guarantees; contact support@velanir.ai before submitting personal data through that processing. Read Exa's published plan terms.

Exa's policy scope. Exa's general privacy policy describes query use, including model improvement, but excludes business processing governed by customer agreements. That policy alone does not establish how Exa uses data under Velanir's applicable agreement. We do not represent either model training or a no-training guarantee as a verified fact for that processing. Read Exa's privacy policy and business-processing distinction.

PostHog. PostHog provides product analytics, session recordings and error reports for people signed in to the Velanir Platform, and website analytics on velanir.ai. On velanir.ai it records page views, clicks, scroll depth and heatmaps (where visitors click and move the pointer, including repeated clicks), the referring site and campaign, and browser, device, IP address and approximate location against an anonymous identifier; that identifier is linked to the account of a visitor who signs up from the site. When a visitor submits an application on the site, PostHog also records the submission with the campaign and the fixed options selected (agency status or expert tracks) and, for an AINS Accelerator application, the program applied to, never names, contact details or written answers. The Platform's sign-up page records, before sign-in, that a visitor started signing up, under that identifier when they came from velanir.ai. No session recordings are made on velanir.ai. When a person finishes creating an account, PostHog forwards a sign-up event to Meta to measure Velanir's ads, as described in the Privacy Policy; the event stays in PostHog with the other analytics events, and Velanir stores no new copy. Session recordings in the Platform can show customer content displayed on screen and typed into ordinary form fields; credentials and billing addresses are excluded. PostHog deletes session recordings after 30 days. Analytics events and the PostHog person record, which holds the account identifier, name and email address, may be kept for up to 7 years under Velanir's current PostHog plan. Account deletion does not yet remove these PostHog records automatically, so Velanir deletes them on request to support@velanir.ai. Read PostHog's privacy policy.

Meta. Meta receives the Platform sign-up event from PostHog to measure Velanir's ads: the event name with the plan (and, for a Business plan trial, the currency), the time, the setup page address without a query string, an event identifier made from a SHA-256 hash of the new workspace's identifier so that Meta can discard duplicate reports, a SHA-256 hash of the email address, the IP address and browser user agent, and Meta's _fbp and _fbc browser identifiers when present. It never includes a name, a readable email address or workspace content. Under Meta's Business Tools Terms, Meta deletes the hashed email address after matching the event to a Meta account. Meta keeps the rest of the event, like the information its pixel and the AI Agency Accelerator and AINS Accelerator application events send it from velanir.ai, under its own terms, not under this schedule, and Velanir's day-60 application-data deadline does not apply to it. Read Meta's Business Tools Terms.

These disclosures do not authorize retention or use prohibited by law, a customer's applicable agreement or the DPA. Customers needing shorter provider retention may request an applicable configuration or contractual arrangement before using the affected processing. A deletion confirmation from Velanir will identify its scope and any provider copies whose erasure remains unconfirmed.

8. Requests, exceptions and updates

We verify a requester's identity and authority before disclosing or deleting data. Customers acting as controllers may send their instructions through their authorized account contact. Individuals may contact support@velanir.ai directly; where a business customer controls the relevant data, we help route the request to that customer.

A legal hold is limited to the records and duration needed for the applicable obligation or claim. We restrict retained records from ordinary product use and delete them when the hold and applicable retention period end. We explain an exception to the requester unless the law prohibits that disclosure.

This schedule's version and effective date appear above. Changes do not override an applicable services agreement, separately agreed DPA or mandatory privacy right. Contact support@velanir.ai to request an export, deletion confirmation, details of an applicable exception or a copy of the schedule.