Privacy Policy & Data Protection
Effective Date: September 17, 2026 • Version 2.1.0 • GDPR & CCPA Compliant
Velora provides native desktop compilation tools for web applications. Our privacy philosophy is founded on strict data minimization: We never sell, monetize, or rent your personal data, we use zero third-party tracking scripts (no Google Analytics, Facebook Pixel, or behavioral tracking), and we only process data required to authenticate your identity, execute your compilation builds, and safeguard platform security.
01. Data Controller & Contact
The data controller responsible for the processing of personal data on the Velora platform is:
02. Categories of Personal Data We Collect
We limit personal data collection strictly to information required to provide our compilation services:
Email address, display name, role, account creation timestamp, and cryptographically hashed passwords (`scrypt` with unique 16-byte random salt). We never store plaintext passwords.
Target web URLs to be packaged, application name, bundle identifier, window dimensions, custom CSS/JS snippets, and uploaded app icons.
Session identifiers (stored as SHA-256 hashes), client IP address, user-agent string, and request correlation IDs (`x-request-id`) to prevent brute-force attacks and session hijacking.
Compilation stdout/stderr logs, compiler exit codes, artifact file sizes, and SHA-256 checksums to verify installer binary authenticity.
03. Lawful Bases for Processing (GDPR Art. 6)
Under European Regulation (EU) 2016/679 (GDPR) and UK GDPR, we process personal data under the following legal bases:
- Performance of a Contract (Art. 6(1)(b)): Processing necessary to deliver the compilation services you requested, manage your account, authenticate builds, and distribute compiled native installers.
- Legitimate Interests (Art. 6(1)(f)): Processing necessary to safeguard platform infrastructure, enforce rate limiting, monitor compiler resource consumption, detect malicious build payloads, and maintain network security.
- Compliance with Legal Obligations (Art. 6(1)(c)): Processing required to maintain billing tax invoices, comply with copyright or DMCA takedown requirements, or respond to lawful court orders.
04. Data Retention & Lifecycle Policies
We maintain strict data retention schedules to ensure information is not held longer than necessary:
| Data Category | Retention Duration | Purge Trigger |
|---|---|---|
| Account Profile | Active lifespan of account | Account deletion by user |
| Session Tokens | 30 days rolling expiration | Logout or expiration |
| Build Artifacts (.exe/.dmg) | Free: 7 days | Pro: 90 days | Automated storage reaper |
| Real-time Build Logs | 7 days | Automated database pruning |
05. Subprocessors & Third Parties
We do not sell personal data. We utilize a minimal set of vetted infrastructure subprocessors under strict Data Processing Addenda (DPAs):
- Edge Hosting & Cookieless Telemetry (Vercel Inc.): Global serverless edge routing and application hosting. Provides privacy-preserving, cookieless web analytics and Core Web Vitals performance metrics based on anonymized daily visitor hashes.
- Dedicated Cloud Build Matrix (GitHub Actions): Dispatches ephemeral cloud runners to compile native binaries for Windows, macOS, and Linux when cloud building is enabled.
- PostgreSQL & Redis Providers (Supabase / Upstash): Ephemeral caching, queue coordination, and persistent encrypted data storage.
- S3-Compatible Object Storage (Backblaze B2 / MinIO): Encrypted storage for generated installer binaries, application icons, and encrypted code signing certificates.
- Transactional Email Infrastructure: Delivers transactional account verification tokens and password reset emails.
06. International Data Transfers & Safeguards
Velora utilizes distributed cloud infrastructure located in the United States and the European Union. When personal data originates in the European Economic Area (EEA), the United Kingdom, or Indonesia and is transferred across international borders, we ensure adequate protection through:
- EU-US Data Privacy Framework (DPF): Reliance on certified cloud infrastructure providers participating in the EU-US and UK-US Data Privacy Frameworks.
- Standard Contractual Clauses (SCCs): Execution of European Commission approved Standard Contractual Clauses (pursuant to GDPR Art. 46) and UK International Data Transfer Addenda.
- Indonesian UU PDP Compliance: Adherence to Article 56 of Law No. 27 of 2022 on Personal Data Protection regarding cross-border transfer safeguards and contractual addenda.
07. Your Rights: Automated Data Subject Rights (DSR)
Under GDPR (Articles 15–22), CCPA/CPRA, and Indonesian UU PDP, you possess comprehensive rights over your personal data. Velora provides autonomous, self-service technical mechanisms to exercise these rights immediately:
Download your entire account history, project definitions, app configurations, active sessions, and build metadata in standard, machine-readable JSON format.
Trigger Data Export (/api/user/export)Permanently delete your account, authentication tokens, active sessions, projects, configurations, and compiled artifacts with immediate database cascade deletion.
Manage in Account SettingsRight to Rectification (Art. 16): You may update your profile name and project settings at any time in Settings.
Right to Restrict or Object (Arts. 18 & 21): If you believe our processing infringes upon your rights, you can terminate active sessions or contact our Data Protection Officer at [email protected].
09. Technical Security & Encryption Standards
We apply defense-in-depth engineering principles to safeguard all information stored on Velora:
- Password Protection: Hashed using Node.js native
crypto.scryptwith 64-byte key lengths and per-user unique random salts. - Transport Security: All API communication and dashboard sessions require TLS 1.3 encryption with strict HSTS headers.
- Pre-DOM Injection Isolation: Client scripts and custom CSS are compiled directly into native binaries via compile-time executable macros, preventing in-transit tampering.
- SSRF Mitigation: All user-supplied web URLs are parsed and checked against private CIDRs, loopbacks, and cloud metadata before network dispatch.
10. Children's Privacy
Velora is a developer software platform and is not designed for or directed to children under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has registered an account without parental consent, contact [email protected] for immediate account termination.
11. Policy Updates & Notifications
We may update this Privacy Policy from time to time to reflect technological or regulatory changes. Significant changes will be announced via dashboard notices or email notifications to registered users at least 14 days prior to taking effect.
Have Questions Regarding Your Privacy?
Our Data Protection Officer is ready to assist you with data requests or inquiries.