Privacy Policy
Last updated
The short version: this site uses no advertising or analytics cookies, tracking pixels or third-party counters, and receives from you only what you send us yourself through the request form, plus the technical data no website can work without. Below are the details: exactly what we receive, on what legal basis, who we share it with, how long we keep it and how to exercise your rights.
01 Who we are and how to reach us
Veilvex is the team that runs this website and provides the services presented on it: search and AI visibility (SEO and GEO), advertising, social media, website and app development, AI automation and design. “We” in this policy means Veilvex.
The controller of your personal data is the owner of the Veilvex brand. If you sign a contract with us, it names the company or sole trader that is your contracting party and is responsible for processing data within our work together. Full legal details are available on request.
We have not appointed a data protection officer. You can send any request about your data through any current contact listed in this section or on the site: by email, if one is listed, or to the official Veilvex account in Telegram or WhatsApp. If you write in a messenger, we will check that the request comes from the same person who sent the original request (see section 9).
Formal notices, including under a contract, can be sent through any of these contacts or by email to the address published on this website or in your contract.
02 What this policy covers
This policy applies to every language version of the site, to the request form and to any correspondence with us before a contract is signed — whether through the form, a messenger or email.
If we work on your project and get access to your customers’ data, that is governed by our contract with you (see section 14). How we work with clients is described in our Terms of Service.
03 What data we receive
From the request form — only what you type in yourself:
- your name, so we know how to address you;
- a contact for getting back to you — a phone number, WhatsApp or a Telegram username;
- the services you selected and, optionally, a short description of the task;
- the consent checkbox and the language of the page the request was sent from.
Along with the request, your browser sends two technical fields used to stop bots: a hidden field that people leave empty, and the time the form was opened. Neither contains any information about you.
If you write to us directly on WhatsApp, Telegram or by email, we see what the messenger shows us: your profile name and photo, your number or username, and your messages.
Technical data. Like any server on the internet, our hosting receives your IP address, browser details, the requested page and the time with every request. When you submit the form, our handler also (1) computes a cryptographic hash of your IP address and keeps it, with the times of recent submissions, for a short technical window to protect against spam and limit how often requests can be sent, and (2) logs technical events: a shortened fragment of that hash, the language, the number of services selected, the delivery channel and error codes. Your name, contact and message never appear in the logs.
We do not ask for — and ask you not to send through the form — special categories of data (health, beliefs and the like), identity documents or payment details. Nothing can be paid for on this site.
04 Cookies, analytics and third parties
This site uses no advertising or analytics cookies, tracking pixels, third-party visitor counters, advertising identifiers or browser fingerprinting.
Your browser may still use technical local storage — for example, to remember the interface language you chose or other technical settings. Such entries are needed only for the site to work, stay on your device, are not used for tracking, and can be cleared in your browser settings. Strictly necessary storage needs no consent, which is why there is no cookie banner.
Our Content Security Policy (CSP) restricts the loading of third-party scripts that we have not allowed.
The WhatsApp and Telegram links are plain links: those services receive data only when you follow them, and their own terms apply from then on.
05 Purposes and legal bases
We process data only for the purposes listed below. Legal bases are given under the EU General Data Protection Regulation (GDPR); for other countries, see section 10.
| Purpose | Data | Legal basis |
|---|---|---|
| Reply to your request, run the brief, prepare an estimate and a contract | Form data, correspondence | Steps taken at your request before entering into a contract — Art. 6(1)(b) GDPR; the consent given in the form — Art. 6(1)(a), where the law requires consent |
| Perform the contract and run the project | Contact details of client representatives, project correspondence | Contract — Art. 6(1)(b); for employees of a corporate client — legitimate interest, Art. 6(1)(f) |
| Protect the form from spam and abuse, keep the site running and secure | IP hash, submission times, technical logs | Legitimate interest in operating a secure website — Art. 6(1)(f) |
| Keep accounting and tax records | Contract, invoices, acceptance certificates | Legal obligation — Art. 6(1)(c) |
| Defend our rights in a dispute | Contract and project correspondence | Legitimate interest — Art. 6(1)(f) |
Filling in the form is optional — you can simply message us instead. Without a name and a contact, however, we cannot reply.
We send no marketing emails without your separate consent, we do not sell data, and we do not use requests to train AI models.
06 Who receives your data
Requests are seen only by the members of the Veilvex team who need them to reply and to work on the project. Contractors we bring into a project receive only what they need and are bound by confidentiality obligations.
Services the data passes through:
- Cloudflare, Inc. (USA) — website hosting, the form handler, the rate-limit store and technical logs;
- Telegram — a bot delivers the request to the team’s private chat;
- Resend, Inc. (USA) — delivers the request as an email to the team’s mailbox, where it is stored by our email provider;
- WhatsApp (Meta) and Telegram — if you message us there yourself.
A request arrives via Telegram, by email or both — depending on which channels are enabled. It has no other recipients.
We disclose data to public authorities only when the law requires it. We never sell or rent out data.
07 International transfers
Cloudflare and Resend are based in the USA, and Telegram operates servers in several countries. Your data may therefore be processed outside your country, including outside the EU/EEA.
For transfers from the EU/EEA, the UK and Switzerland we rely on adequacy decisions (in particular the EU–U.S. Data Privacy Framework, for recipients certified under it) or on the European Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR) built into the providers’ data processing agreements. Where neither applies — for example, when you choose a messenger to contact us — data is transferred only to the extent needed to answer your request (Art. 49(1)(b) GDPR).
You can ask for a copy of the relevant safeguards using the contacts in section 1.
08 How long we keep data
| Data | Retention |
|---|---|
| Request and correspondence, if no contract follows | For as long as the discussion is relevant and there is a chance we will return to the task. After that we delete it as part of our periodic clean-up of archives — or sooner, at your request. |
| Contract correspondence and documents | For the term of the contract, then as long as accounting and tax law requires and until limitation periods expire — usually 3 to 10 years, depending on the country. |
| IP hash and submission times | Kept only for a short technical window to protect against spam and limit how often requests can be sent. The record holds no request content and is cleared automatically when the technical window expires. |
| Hosting and form-handler logs | A limited period under Cloudflare’s rules. They contain no request content. |
If you ask us to delete your data sooner, we will — except for anything the law requires us to keep.
09 Your rights
At any time you can:
- find out what data we hold about you and get a copy of it;
- have inaccurate or incomplete data corrected;
- have your data erased (the “right to be forgotten”);
- restrict processing — for example, while we look into an objection;
- receive the data you gave us in a machine-readable format, or have it sent to someone else (portability);
- object to processing based on our legitimate interest;
- withdraw your consent — this does not affect processing carried out before the withdrawal;
- lodge a complaint with a data protection authority — in the country where you live or work, or where you believe your rights were infringed.
How to do it: write to us through any current contact listed in section 1 or on the site — by email, if one is listed, or to the official Veilvex account in Telegram or WhatsApp. To avoid handing your data to someone else, we will check that the request comes from the person who sent the original request — for example, by asking you to write from the contact given in that request or to confirm its details. There is no charge.
We reply without undue delay and within one month at the latest. For complex or numerous requests this can be extended by two further months; if so, we will tell you within the first month and explain why.
10 Country-specific information
EU, EEA, UK and Switzerland. This policy follows the GDPR, the UK GDPR and the Swiss Federal Act on Data Protection (revFADP). For Germany: the site may store on your device only what is strictly necessary to provide the page you requested (for example, your chosen language); no consent is needed for this under § 25 TDDDG.
California (CCPA/CPRA), to the extent it applies to us. In the past 12 months we have collected identifiers (name, contact), details of your request and internet activity data (section 3), from the sources and for the purposes described in sections 3 and 5. We do not sell personal information, do not share it for cross-context behavioural advertising and do not use sensitive personal information. You have the right to know what we collect, to have it deleted or corrected, and not to be discriminated against for exercising your rights.
Azerbaijan. Data is processed in accordance with the Law of the Republic of Azerbaijan “On Personal Data”. Ticking the box in the form is your consent to the processing of the data you provide in order to answer your request, including its transfer abroad to the services listed in section 6. You have the right to know what data about you is processed and how, to have it corrected or destroyed, and to withdraw your consent.
Other countries. If you are in a country whose law requires separate consent to the processing of personal data and its cross-border transfer in order to answer your request, ticking the box in the form or sending us a message in a messenger confirms that consent. You can withdraw it through the contacts in section 1 and exercise your rights as described in section 9.
11 Children
Our services are meant for businesses and adults. We do not knowingly collect data from anyone under 16. If you believe a child has sent us their data, let us know and we will delete it.
12 How we protect data
- the site is served over HTTPS only, and the HSTS header stops browsers from opening it over an insecure connection;
- a Content Security Policy (CSP) that restricts the loading of third-party scripts we have not allowed and blocks embedding the site in other pages;
- the form accepts requests only from our own pages; the server checks every field, rejects unknown ones, strips invisible control characters and caps the request size;
- submissions are rate-limited, and bots are filtered out by a hidden field and a timing check;
- requests are delivered as plain text — what you type never becomes HTML markup, either on the site or in the message to the team;
- IP addresses are stored only as hashes, and service credentials only in protected environment variables, never in the code;
- only team members who need it for their work can access the chat and mailbox where requests arrive.
No system on the internet is perfectly secure. If a breach occurs that is likely to put your rights at risk, we will notify the supervisory authority within the statutory deadline and, where required, you as well.
13 Automated decision-making
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you, and we do not profile you. People read and handle every request; the only automation is the spam filter.
14 Data in client projects
When we set up advertising, a CRM, chatbots or analytics, or build a website, we may get access to your customers’ data. In that case you remain the controller and we act as your processor: we handle the data only on your instructions and for the purposes of the project.
On request we sign a data processing agreement (DPA, Art. 28 GDPR) or include those terms in the contract. We use access to your accounts only for the work, never pass it on, and return it or ask you to revoke it when the project ends.
As the owner of the website or business, you are responsible for the legal basis for processing your customers’ data, your own privacy policy and consent banners. We will help you prepare and set all of this up technically, but that is not a substitute for legal advice.
15 Changes to this policy
We update this policy when the site, the services we use or the law change. The current version and its date are always published on this page. This policy is published in several languages; English is the default language of this website, and if the versions differ, the English version prevails. A new version takes effect when it is published on this page, unless the version itself states otherwise.
See also Terms of Service