Legal
Last updated: August 2026
The legal text below is authoritative in English and is not translated yet. The rest of this page is translated for convenience.
Veln.ai is operated by Veln.ai, powered by Amplitude Ventures, based in Stavanger, Norway. When we say “we”, “us”, or “our”, we mean Veln.ai. When we say “you” or “your”, we mean you as a user of Veln.ai.
We collect the minimum data needed to provide the service: email address (for authentication), company information you enter (your answers, documents, pitch deck content), basic usage data (page views, feature usage), and — only when an organizer has enabled recording and every attendee agreed — the audio and transcript of a booked meeting. We do not sell your data to third parties. We also compute advisory language signals (clarity, specificity, hedging) from your written answers; these are shown to you and the evaluator, and never change a score. Diversity or other special-category information is collected only with your separate, explicit consent and never affects your assessment.
Your company data is used solely to generate your investor materials (pitch decks, documents, data room). We send your answers to AI providers to generate content: OpenAI, and — for organisations on the free tier — DeepSeek, which is operated from China, so that processing involves a transfer outside the EEA. Email privacy@veln.ai to have your organisation routed to OpenAI only. We do not use your data to train AI models. Usage data helps us improve the product.
Your data is stored in Supabase (hosted in EU) with row-level security. Documents and exports are stored in Supabase Storage. Embeddings are stored in Pinecone. Meeting audio and transcripts are deleted automatically 90 days after they are recorded. All data is encrypted in transit (TLS) and at rest.
If an organizer turns on recording for a session you book, we ask you to agree before you book, and we say so again in your confirmation email. Nothing is recorded unless the organizer enabled it and every confirmed attendee agreed — if any attendee has not agreed, no recorder is sent.
When a session is recorded we store the audio and produce a written transcript. The transcript is sent to OpenAI to generate a short summary and action items for the organizer; it is not used to train AI models. We keep the audio and the transcript for 90 days, after which both are deleted automatically. The summary is kept.
You can withdraw your agreement at any time, including after the meeting, using the link in your booking email — withdrawing does not cancel your booking. Withdrawing stops a recorder that is still running and deletes that session's transcript, including one already taken.
We use: Supabase (database and auth), OpenAI and DeepSeek (AI content generation), Pinecone (vector search), Google (web-grounded market research, when an evaluator enables it), Resend (transactional email), Stripe (payments), Google Tag Manager (consent-gated marketing analytics), and PostHog (product analytics, EU region). Each service processes only the minimum data needed for its function. The full subprocessor list, including where each one processes your data, is in our Data Processing Agreement.
We track a deliberately small set of explicit product events so we can see where founders get stuck. The events we capture: session start, sign-up start, sign-up completion, truth drafted, truth approved, composer generated, document downloaded, document shared, upgrade clicked, upgrade completed, message sent, nudge sent, deadline created, admin invite sent, and org tier provisioned.
We do not use session replay, DOM recording, heatmaps, or autocapture (which would record every click). We do not send IP addresses — they are anonymised before events leave your browser. Event data is stored on PostHog’s EU infrastructure. If you reject cookies on the banner, PostHog is never initialised and no product-analytics events are captured. You can export or delete all PostHog data associated with your account by emailing us.
You can export all your data at any time from within the app. You can delete your account and all associated data by contacting us. Under GDPR, you have the right to access, correct, delete, and port your data.
We use essential cookies for authentication and, when you accept the cookie banner, minimal cookies from Google Tag Manager (marketing measurement) and PostHog (product analytics). Rejecting the banner keeps every non-essential cookie disabled.
For privacy questions, contact hello@veln.ai.