1. Data controller
- Controller: VELTARA LABS LTD, a private limited company registered in England and Wales
- Company number (Companies House): 17452212
- Registered office: 128 City Road, London, EC1V 2NX, United Kingdom
- Privacy contact: [TO COMPLETE: email, e.g. privacy@vedira.ai]
In this policy, “Vedira”, “we” or “our” means the controller named above, owner of the vedira.ai website and the app.vedira.ai application.
2. What data we process and why
2.1. Waitlist sign-ups
When you reserve a spot through a form on the website we collect your email, the exam or field you are preparing for, the plan you are interested in, the language and page you signed up from, and, if you arrived through a campaign link, its UTM parameters (for example the source channel).
Purpose: to let you know when your plan opens and
to understand which profiles and plans are most in demand.
Legal basis: your consent (Art. 6(1)(a) GDPR), which
you can withdraw at any time by writing to us or using the
unsubscribe link in our emails.
2.2. Your account and use of the app
If you create an account and use the app we process:
- Account data: the name, email and profile photo Google provides when you sign in.
- Material you upload: notes, documents, links and text, plus the topics and questions we generate from them.
- Voice sessions: audio is streamed and processed in real time to transcribe it and respond to you. We do not store audio recordings; we keep the transcript, evaluations and report of each session.
- Usage and billing data: minutes used, purchases and balance.
Purpose: to provide the service (voice sessions,
evaluation and reports) and maintain your account.
Legal basis: performance of the contract you accept
when you use the service (Art. 6(1)(b) GDPR).
We do not use your material or sessions for advertising and we do not sell them to third parties.
2.3. Payments
Payments are processed by Stripe. We never see or store your full
card details; we only receive payment confirmation and the data
needed for invoicing.
Legal basis: performance of the contract and
compliance with tax and accounting obligations (Art. 6(1)(b) and
6(1)(c) GDPR).
2.4. Security and technical operation
Our servers log technical data (IP address, browser, date and time,
errors) to keep the service secure and fix problems.
Legal basis: our legitimate interest in protecting
and maintaining the service (Art. 6(1)(f) GDPR).
2.5. Web analytics
With your consent we use Google Analytics 4 to measure visits and
which parts of the website work. See the
cookies section.
Legal basis: your consent (Art. 6(1)(a) GDPR).
3. How long we keep data
- Waitlist: until you unsubscribe or, at most, 12 months after the plan you reserved launches.
- Account, material and sessions: while your account is active. If you ask us to delete them, we will, except for anything we are legally required to keep.
- Billing: for the periods required by applicable tax and commercial law.
- Technical logs: only as long as needed for security and diagnostics.
4. Who we share data with
We do not sell your data. We share it only with providers who deliver services to us and act as data processors under contract:
- Hosting, servers and backups: [TO COMPLETE: hosting and backup provider and country].
- Google (sign-in with Firebase, Google Analytics, and AI and voice models).
- OpenAI (AI and voice models).
- Deepgram (speech transcription).
- LiveKit (real-time audio streaming).
- Stripe (payments).
- Sentry (technical error logging).
- Resend (email delivery).
Some of these providers are based in the United States. Those transfers rely on the EU-U.S. Data Privacy Framework where the provider is certified, or on the Standard Contractual Clauses approved by the European Commission.
We may also disclose data to authorities where the law requires it.
5. Your rights
You can exercise at any time your rights to:
- access your data;
- rectify inaccurate data;
- erasure;
- object to or restrict processing;
- data portability;
- withdraw consent, without affecting processing carried out before.
As a controller established in the United Kingdom, we apply the UK GDPR and the Data Protection Act 2018, and the EU GDPR to the data of people in the European Union.
Write to [TO COMPLETE: contact email] stating which right you want to exercise. We will reply within one month. If you believe we have not handled your request properly, you can lodge a complaint with your local data protection authority: in the UK, the Information Commissioner’s Office (ico.org.uk); in Spain, the Agencia Española de Protección de Datos (www.aepd.es).
6. Cookies
We only use analytics cookies if you accept them in the notice shown when you arrive. If you reject them, Google Analytics runs without cookies and without identifying you.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| _ga | Distinguish visitors (analytics) | 2 years | |
| _ga_<ID> | Keep session state (analytics) | 2 years | |
| vedira-consent (local storage) | Vedira | Remember whether you accepted or rejected analytics | Until you clear it |
The app (app.vedira.ai) also uses strictly necessary technical cookies to keep you signed in; these do not require consent.
7. Children
The service is not directed at children under 14 and we do not knowingly process their data.
8. Changes to this policy
If we change this policy we will update the date above and, if the change is significant, notify you by email or in the app.