Privacy Policy

Volero ("we", "us", or "our") operates the Volero platform at https://volero.ai. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our AI business knowledge platform.

By using Volero, you agree to the practices described in this policy. If you do not agree, please do not use our services.

This policy applies to users in all jurisdictions, with additional rights for residents of the European Economic Area (EEA) under the General Data Protection Regulation (GDPR) and for residents of the United Arab Emirates (UAE) under Federal Decree-Law No. 45 of 2021 (PDPL).

1. Information We Collect

We collect information to provide, maintain, and improve the Volero platform:

• Account information — name, email address, and organization details provided during sign-up or managed through our authentication provider.
• Conversation data — messages you send and responses generated by AI models through the platform.
• Uploaded content — files, documents, and other materials you upload to your knowledge base.
• Usage data — information about how you interact with the platform, including feature usage, model selections, and token consumption.
• Billing information — payment details processed securely through our payment provider. We do not store full credit card numbers on our servers.
• Device and log data — IP address, browser type, operating system, and access timestamps collected automatically.

2. How We Use Your Information

We process your data only for specified purposes and on a valid lawful basis:

• Provide, operate, and maintain the Volero platform — contractual necessity.
• Process AI requests by sending your messages to AI model providers — contractual necessity.
• Track usage for billing purposes and enforce spending caps — contractual necessity.
• Improve our services, including performance, reliability, and feature development — legitimate interest.
• Communicate with you about your account, billing, and platform updates — legitimate interest / contractual necessity.
• Detect and prevent fraud, abuse, and security incidents — legitimate interest / legal obligation.

Where we rely on legitimate interest as our lawful basis, you have the right to object to that processing. See Section 9 for how to exercise your rights.

3. Third-Party Services

Volero integrates with the following third-party services to deliver our platform. Each has its own privacy policy governing its handling of your data:

• Clerk — authentication and user management.
• Stripe — payment processing and subscription billing.
• OpenRouter — AI model routing. Your conversation messages are sent to AI providers (including Anthropic, OpenAI, Google, and others) through OpenRouter to generate responses. Consult OpenRouter's sub-processor list for the full list of underlying model providers.
• Upstash — vector storage for knowledge base search and retrieval-augmented generation (RAG).
• Neon — PostgreSQL database hosting for application data.
• Cloudflare R2 — file and document storage.
• Railway — application hosting and deployment.

We only share the minimum data necessary for each service to function. We do not sell your personal information to any third party. Enterprise customers will be notified at least 30 days in advance of any changes to our sub-processor list.

4. AI-Specific Data Handling

When you use Volero to interact with AI models, your messages are sent to third-party AI providers via OpenRouter. These providers may process your data according to their own terms. We recommend not sharing sensitive personal information, trade secrets, or confidential data in conversations unless you understand and accept the associated risks.

We do not use your conversation data to train our own AI models. If you wish to opt out of any AI-inference-based profiling or personalization, contact us at [email protected].

Controller / Processor roles: When Volero is used by an organization, the organization is the data controller for its employees' and customers' data uploaded to or processed through the platform. Volero acts as a data processor in that context and processes such data only on the organization's documented instructions. See Section 10 for enterprise-specific terms.

5. International Data Transfers

Your data may be stored and processed in the United States or other countries where our sub-processors operate. Where personal data is transferred from the European Economic Area (EEA) to a country without an EU adequacy decision, we rely on the EU Standard Contractual Clauses (SCCs) or the EU–US Data Privacy Framework as the transfer mechanism.

For users in the UAE, cross-border transfers are conducted only to countries that provide an adequate level of data protection, or with your explicit consent, or under binding contractual safeguards.

6. Cookies and Tracking

Volero uses cookies and similar technologies for:

• Essential cookies — required for authentication and session management.
• Analytics cookies — help us understand how the platform is used so we can improve it.

You can control cookies through your browser settings, but disabling essential cookies may affect platform functionality. You may withdraw consent to non-essential cookies at any time by adjusting your browser settings.

7. Data Retention

We retain your data for as long as your account is active or as needed to provide services. Conversation history and uploaded documents are retained according to your organization's plan and configured retention policies. When you delete your account, we will remove your personal data within 30 days, except where retention is required by law or for legitimate business purposes such as billing records.

8. Data Security

We implement industry-standard security measures to protect your data, including encryption in transit (TLS 1.2+) and at rest, access controls, and regular security reviews. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

In the event of a personal data breach, we will notify affected users without undue delay and, where required by applicable law (including GDPR and UAE PDPL), notify the relevant supervisory authority within 72 hours of becoming aware of the breach.

9. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction — request correction of inaccurate or incomplete data.
• Deletion — request deletion of your personal data.
• Portability — request your data in a portable, machine-readable format (GDPR Art. 20).
• Objection — object to processing based on legitimate interest, including any profiling based on legitimate interest.
• Restriction — request that we limit processing of your data in certain circumstances.
• Withdraw consent — where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Automated decision-making — you have the right not to be subject to decisions made solely by automated processing that produce significant effects on you (GDPR Art. 22). Contact us to request human review of any AI-generated output that affects you.

To exercise any of these rights, contact us at [email protected]. We will respond within one month of receiving your request.

You also have the right to lodge a complaint with your local data protection authority:

• EEA residents — contact your national supervisory authority. A list is available at edpb.europa.eu.
• UAE residents — contact the UAE Data Office at dataoffice.ae.

10. Business Customers

When Volero is deployed by an organization, the organization acts as the data controller for all personal data its users process through the platform. Volero acts as a data processor and will only process that data in accordance with the organization's instructions and applicable law.

Enterprise customers may request a Data Processing Agreement (DPA) by contacting [email protected]. The DPA sets out the subject matter, duration, nature, and purpose of processing, and our respective obligations under GDPR Art. 28 and equivalent UAE PDPL provisions.

11. Children's Privacy

Volero is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal information, please contact us and we will promptly delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of Volero after changes are posted constitutes acceptance of the revised policy.