Privacy Policy

• IP addresses (for abuse prevention and rate limiting)
• Browser and OS type (for service compatibility)
• Video topics and script inputs you provide (to fulfill generation requests)
• Usage patterns (session timestamps, feature usage — no behavioral profiling for ads)
• Payment transaction IDs and amounts (for billing records)

We collect the minimum data necessary to provide the service ("data minimisation" per GDPR Article 5).

• Contract Performance (Art. 6(1)(b)) — Processing your account data, generation requests, and billing to provide the service
• Legitimate Interests (Art. 6(1)(f)) — Security monitoring, fraud prevention, and platform improvement
• Consent (Art. 6(1)(a)) — Marketing communications and newsletter subscriptions (you may withdraw at any time)
• Legal Obligation (Art. 6(1)(c)) — Retaining financial records as required by tax and commercial law

• Provide and operate the Velora video generation service
• Generate AI video content via integrated third-party AI models
• Process secure billing and subscription management through Razorpay
• Send transactional emails (account verification, password reset, billing receipts)
• Send marketing emails only with your explicit opt-in consent
• Detect and prevent abuse, fraud, and policy violations
• Improve platform performance metrics and user experience

We do not sell your personal data to any third-party marketing services. We do not build advertising profiles on you.

• Google (Gemini) — AI script generation. Privacy Policy
• ElevenLabs — Premium voice synthesis. Privacy Policy
• Razorpay — Payment processing. Privacy Policy
• Cloudflare R2 — Video file storage
• Kling / Wan / Veo 3 — AI video generation (paid plans)
• Sentry — Error monitoring (may include stack traces)

Your topic inputs and scripts are sent to these providers solely to fulfill your video generation requests. Each provider operates under their own privacy policy and applicable data protection obligations.

Velora is incorporated in India and our servers are primarily located in the EU (Railway, Cloudflare). When your data is transferred from the EU/EEA to India, we ensure appropriate safeguards under GDPR Chapter V, including:

• Standard Contractual Clauses (SCCs) with all data processors outside the EEA
• Transfers to providers with EU-US Data Privacy Framework certification where applicable

• Account data: Retained until you request deletion
• Generated videos: Subject to automatic deletion when storage quota is reached (oldest first); deleted within 30 days of account closure
• Billing records: Retained for 7 years as required by Indian tax law (GST Act) and applicable financial regulations
• Security/abuse logs: Retained for 12 months for fraud prevention
• Newsletter subscriptions: Retained until you unsubscribe

Depending on your jurisdiction, you have the following rights:

• Right of Access — Request a copy of your personal data (GDPR Art. 15, CCPA, PIPEDA, LGPD)
• Right to Rectification — Correct inaccurate or incomplete data (GDPR Art. 16)
• Right to Erasure — Request deletion of your data (GDPR Art. 17, CCPA, LGPD, DPDPA)
• Right to Portability — Export your data in machine-readable format via account settings (GDPR Art. 20)
• Right to Object — Opt out of certain processing activities (GDPR Art. 21)
• Right to Restrict Processing — Limit how we use your data in certain circumstances (GDPR Art. 18)
• CCPA — Do Not Sell — We do not sell your personal information. California residents may submit CCPA requests to us directly
• LGPD (Brazil) — Brazilian users have additional rights including confirmation of processing and anonymisation
• DPDPA (India 2023) — Indian users have the right to access, correct, erase, and withdraw consent under the Digital Personal Data Protection Act 2023

To exercise any of these rights, email office@velorastudio.in. We will respond within 30 days (as required by GDPR Article 12). EU residents may also lodge a complaint with their local data protection authority (DPA).

We implement industry-standard security measures including HTTPS/TLS encryption for all data in transit, bcrypt password hashing, JWT-based authentication with expiry, server-side access controls, Redis-backed rate limiting, and automated abuse detection.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware (GDPR Article 33)
• Notify affected users without undue delay when the breach is likely to result in a high risk to their rights
• Maintain an internal record of all personal data breaches per GDPR Article 30

For users in Canada, our data practices comply with the Personal Information Protection and Electronic Documents Act (PIPEDA). We collect, use, and disclose personal information only with your knowledge and consent, for the purposes described in this policy.

Marketing emails are sent only with your explicit opt-in consent as required by Canada's Anti-Spam Legislation (CASL). Every marketing email includes a clearly visible, functional unsubscribe mechanism. You may withdraw consent at any time.