1. Who is responsible for the data
Velaris is operated by Velaris Technologies Ltd, trading as Velaris, registered in England and Wales under company number 17527140 at Seneca House, Amy Johnson Way, Blackpool, England, FY4 2FF.
The subscribing contractor is normally the controller of project, client and workforce information entered into its workspace. Velaris acts as its processor when hosting and using that information to provide the service. Velaris acts as a controller for its own account, security, billing, support, legal and public-website records.
2. Information we collect and where it comes from
- Account and business data: name, business email, telephone number, role, employer, company details, invitations, permissions and authentication identifiers.
- Project and user-provided content: project addresses, contacts, programmes, allocations, site diaries, meeting notes, RFIs, actions, variations, valuations, events, snags, photographs, floor plans, files, correspondence, reports and evidence records.
- Subscription data: plan, term, pricing, acceptance record, billing contact, Stripe customer and transaction references, payment state and invoice information. Velaris does not receive full payment-card details from Stripe.
- Technical and security data: sign-in events, timestamps, browser or device type, operating system, IP-derived security information, app errors and activity needed to operate, diagnose and protect the service.
- Support data: messages, feedback and information supplied when requesting help, account deletion or contract support.
Information comes from the person concerned, their subscribing company or administrator, authorised users contributing to the same project, the device or browser used to access Velaris, Stripe and other contracted service providers, and limited public business records where needed to verify a company.
Velaris does not intentionally collect precise device GPS location. A user may enter a site address or mark a location on an uploaded project plan. File and photograph access occurs only when the user chooses material to upload or export.
3. Why information is used
- To create, authenticate and secure accounts and company workspaces.
- To provide desktop, mobile, programme, commercial, reporting, sharing and evidence workflows.
- To route invitations, client or trade links and user-selected reports.
- To administer trials, subscriptions, instalments, invoices, renewals and support.
- To prevent misuse, investigate incidents, maintain service reliability and improve features.
- To comply with tax, accounting, legal and regulatory duties and establish or defend claims.
Velaris does not sell personal information or use project records for third-party advertising.
4. Lawful bases and information required to provide the service
Where Velaris is a controller, it relies on performance of a contract, legitimate interests in operating and securing a B2B software service, legal obligations, and consent where consent is required, including optional public-website analytics. Its legitimate interests include preventing misuse, maintaining service reliability, diagnosing faults, supporting business users and improving the service in ways users would reasonably expect. Velaris considers the necessity and effect on individuals before relying on those interests.
Core identity, business contact, authentication and subscription information is contractually required to create and administer an account. If it is not provided, Velaris may be unable to create the account, secure access, process a subscription or provide support. Fields described as optional can be left blank unless the subscribing contractor requires them for its own project workflow.
Where Velaris is a processor, it acts on the subscribing contractor's documented instructions under the data-processing terms in the Velaris Terms and Conditions.
5. Who receives information
Information may be available to authorised users and invited recipients selected by the subscribing contractor. Velaris also uses vetted providers for cloud hosting, database, authentication, file storage, email, payments, analytics, error diagnosis and support. They may use information only for the contracted service and are bound by appropriate confidentiality and data-protection terms. The current provider list and purposes are published on the Velaris Subprocessors page.
Information may also be disclosed where required by law, to protect users or the service, in connection with a genuine business sale or reorganisation subject to safeguards, or with the relevant person's instruction or consent.
6. International processing
Some providers may process information outside the United Kingdom. Where UK data-protection law requires it, Velaris uses a UK adequacy regulation, the UK International Data Transfer Agreement or Addendum, or another lawful transfer safeguard. Further information about applicable safeguards can be requested from support@velarishq.com.
7. Retention and deletion
Account and project information is kept for the subscription term and then only as long as needed for export, account recovery, secure backup cycles, legal claims or an agreed retention requirement. Billing and contract records may be retained for up to seven years where needed for tax, accounting and legal obligations. Security records are kept only for a proportionate period.
A user may initiate account deletion in the app or at velarishq.com/account-deletion. Velaris normally completes a verified valid request within 30 days. Shared project records belong to and remain controlled by the subscribing contractor, so deletion of one user's login may not delete the company's project evidence. Data that no longer needs to be retained is deleted or anonymised; secure backups expire through their normal cycle.
8. Security
Velaris uses managed authentication, encrypted network connections, workspace separation, role-based access, restricted administrative access, logging and managed cloud infrastructure. Security is reviewed in proportion to the nature of the service. No online system can be guaranteed completely secure, so subscribers must also protect credentials, devices, shared links and exported files and report suspected incidents promptly.
9. Public website analytics and storage
With the visitor's choice, Velaris uses privacy-limited analytics to understand page visits, general device type, referring website and campaign information. Random visitor and session identifiers are stored in the browser. Analytics does not record form contents, passwords, project records or precise location. Analytics does not run until the visitor accepts it and can be declined.
A visitor can withdraw or change that choice at any time using the persistent Cookie settings control displayed on the website. Withdrawing consent stops future analytics and removes the stored website visitor identifier from that browser.
10. Children and automated decisions
Velaris is a business service for contractors and is not directed to children. Users must be authorised by a subscribing business and old enough to enter a binding employment or business-use arrangement under applicable law.
Velaris does not currently make solely automated decisions about individuals that produce legal or similarly significant effects. If that changes, this notice and the relevant in-product information will be updated before such processing begins.
11. Your rights
Depending on the circumstances, a person may have rights to access, correct, erase, restrict, transfer or object to processing and to withdraw consent. Where information is held in a contractor's workspace, the request should normally go first to that contractor as controller. Velaris will assist the contractor where required.
Privacy requests may be sent to support@velarishq.com. A person may also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint.
12. App-store information and changes
This notice applies to the Velaris website, desktop platform and mobile site companion. The Apple App Store and Google Play process their own store-account, download, payment and diagnostic information under their privacy notices. The store listing's privacy disclosures and Google Play Data Safety answers must be kept consistent with this notice and the released app.
Material changes will be highlighted through the website, app or account contact. Privacy Notice version: 2026-10-19. Last updated: 19 October 2026.
