Privacy Policy

Last updated: 31 October 2026

1. Who we are

Vellara is an AI-powered contract analysis service operated as a sole trader / small business based in the United Kingdom. References to "we", "us", or "our" mean Vellara. Our contact email is akandebolu97@gmail.com.

This policy explains how we collect, use, and protect your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What data we collect

  • Account data: Your email address and name when you create an account (handled by Clerk, our authentication provider).
  • Contract text: The contract content you submit for analysis. This is transmitted securely to Anthropic's Claude API. By default it is not stored by Vellara after the analysis is returned. It is stored only if you tick Save this scan (see section 4).
  • Saved work: If you choose to save a scan, we keep the contract text and its analysis so you can open them again. In a firm, saved scans belong to the matter they were saved to.
  • Payment data: Billing details for paid subscriptions are handled entirely by Stripe. We never see or store your card number.
  • Usage data: A record of each scan you run (date, contract type, jurisdiction, length and risk score, but never the contract text) so we can enforce plan limits and show your history.
  • Firm data: If you use Vellara for Firms: which firm you belong to and your role; the names of matters, who is on each matter's team and which clients were invited; and the email addresses of people invited (kept so an invitation can only be accepted by that person).
  • Security data: A log of account activity (for example, when a scan starts, finishes or is blocked) for security and abuse prevention. We do not store your IP address itself; we store a scrambled fingerprint of it that cannot be turned back into the address.

3. How we use your data

  • To provide and improve the contract analysis service.
  • To manage your account and subscription.
  • To enforce plan limits and prevent abuse.
  • To respond to support queries.
  • To comply with legal obligations.

Our lawful basis is contract performance (providing the service you signed up for) and legitimate interests (security and fraud prevention).

4. Contract text and AI processing

When you submit a contract for analysis, the text is sent to Anthropic (the maker of the Claude AI). Anthropic processes it solely to return the analysis result and does not use your contract text to train its models under the API terms. Unless you choose to save the scan, we do not retain your contract text after the analysis is complete.

Saved scans. Saving is optional and chosen per scan. A saved scan's contract text and analysis are encrypted (AES-256) before they are written to our database, with a key held separately from the database. Saved scans in your Personal space can be seen only by you. Saved scans in a firm can be seen only by the team of the matter they were saved to, not by the matter's clients or by other people in the firm. You can delete a saved scan at any time, and it is removed permanently.

Do not upload contracts that contain highly sensitive personal data (e.g. medical records, financial details of third parties) unless you are authorised to do so.

5. Third-party processors

  • Clerk (authentication) - servers in the US, covered by Standard Contractual Clauses.
  • Anthropic (AI analysis) - servers in the US, covered by their API Data Processing Agreement.
  • Stripe (payments) - covered by Stripe's Privacy Policy and PCI DSS compliance.
  • Vercel (hosting) - our servers run in London; covered by their Data Processing Addendum.
  • Resend (email) - sends invitation emails on our behalf; it receives the invitee's email address, the inviter's name and the firm or matter name. Covered by their Data Processing Addendum.
  • Neon (database) - stores scan records, encrypted saved scans, firm memberships, invitations and the activity log in London; covered by their Data Processing Agreement.

6. Your rights

Under UK GDPR you have the right to: access your data, correct inaccurate data, request deletion, restrict processing, and data portability. You can download a copy of your data at any time from the Account page. To exercise any other right, email us at akandebolu97@gmail.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

7. Cookies

We use only essential cookies: those required for authentication (set by Clerk), and one that remembers whether you are working in your Personal space or in a firm. We do not use advertising or tracking cookies.

8. Data retention

Account data and scan records are retained for as long as your account is active. Saved scans in your Personal space are kept until you delete them or delete your account. If you delete your account, your account data, scan records and Personal saved scans are removed. Scans saved to a firm's matter belong to that firm and are kept until the firm deletes them or the matter is deleted. Short-lived rate-limit counters are deleted within 2 days. The security activity log is kept as a tamper-evident record and refers to accounts only by an internal ID.

9. Changes to this policy

We may update this policy from time to time. We will notify registered users by email of any material changes. Continued use of the service after changes constitutes acceptance.

10. Contact

For any privacy-related questions, contact us at akandebolu97@gmail.com.