Veilkin - Privacy Policy

1. Introduction and Who We Are

This Privacy Policy explains how Veilkin Ltd (“we”, “us”, “our”) collects, uses, stores, and shares your personal information when you use the Veilkin desktop application and associated web-based account management pages (together, the “Service”). Please read this policy carefully before using the Service.

Veilkin is a desktop AI application for Windows PC. It sits on your screen while you use your computer, primarily while gaming, and talks with you about what you are doing. The Service uses artificial intelligence to generate responses and can interact with you via text, microphone input, and screen viewing. Because the AI runs on our servers, an internet connection is required.

• Business name: Veilkin Ltd

• Registered address: Suite F2, Church House Business Centre, Church Street, Godalming, Surrey, GU7 1EW

• Company number: 17213812

• Country of incorporation: United Kingdom

• Contact email for privacy matters: info@veilkin.gg

We are registered with the Information Commissioner’s Office (ICO) as a data controller. Our ICO registration reference is ZC145194.

2. Scope of This Policy

This Privacy Policy applies to all users of the Veilkin Service, wherever you are located.

Because we serve users across multiple jurisdictions, different legal rights and obligations may apply depending on where you live. Section 14 sets out jurisdiction-specific information. Where a jurisdiction-specific provision conflicts with the general provisions of this Policy, the jurisdiction-specific provision takes precedence for users in that jurisdiction.

This Policy does not apply to third-party websites, products, or services that we may link to. We encourage you to review the privacy policies of any third parties before sharing your information with them.

3. Age Restrictions and Children’s Privacy

The Service is intended for users aged 16 years and over. We do not knowingly collect personal information from anyone under the age of 16. Before creating an account, you must tick a box confirming that you are aged 16 or over. We do not collect a date of birth.

We are aware that the minimum age of digital consent varies between jurisdictions. We have set 16 as the global minimum age for Veilkin for consistency and to provide a higher level of protection for younger users across all markets.

If we become aware that a user is under the age of 16, we will promptly delete their account and all associated personal data. If you believe a person under 16 has registered for the Service, please contact us immediately at info@veilkin.gg.

4. Personal Data We Collect

We collect personal data in the following categories. Not all categories will apply to every user.

4.1 Account Data

When you create an account, we collect:

• Your name

• Email address

• Password (stored in hashed form only - your actual password is never stored or accessible)

• Age confirmation (a tick-box confirming you are aged 16 or over - we do not collect your date of birth)

This data is stored in a secure database hosted by Neon (neon.tech) on servers located in London, United Kingdom (Amazon Web Services EU West 2 region). Neon is SOC 2 compliant. This data is accessible to the business owner for operational and support purposes.

Signing in with Google. If you choose to sign up or sign in with Google, Google shares your name, email address and profile picture with us once you agree. We use these only to create your Veilkin account and sign you in. We never receive your Google password, and we do not access anything else in your Google account, such as your emails, contacts or files. You can remove Veilkin's access at any time in your Google Account settings at myaccount.google.com/permissions. Our use of information received from Google follows the Google API Services User Data Policy, including the Limited Use requirements.

4.2 Subscription and Billing Data

If you purchase a trial, subscribe to a paid plan, or purchase pay-as-you-go credits, we collect:

• Your plan (Trial, Plus, or Pro) or trial purchase record

• Stripe customer ID and subscription ID

• Subscription start and end dates

• Usage data - the number of calls made during each billing period

• Pay-as-you-go credit balances and expiry dates

• A record of the purchase consent you gave at checkout, including the date and the version of the terms you accepted

Payment card details are never stored by us or in our database. All payment card data is collected and processed exclusively by Stripe, our payment processor, who is PCI DSS compliant. We receive only a token reference from Stripe.

4.3 Memory Data (AI Companion Memory)

The AI can remember things you share with it across sessions, for example, your gaming preferences, personal details you choose to share, and observations about your communication style.

Memory data is stored in our secure database (see 4.1) so that it is available to you across sessions. It is built automatically from your conversations, the AI saves useful facts and details rather than full transcripts, and is limited to a fixed set of categories, so only a small number of items is ever held.

We do not otherwise store the content of your conversations. Your chat history exists only within the app on your own device, is held in memory rather than written to disk, and is cleared when you sign out, after a period of inactivity, or when a new session begins.

You retain full control over your memory data at all times: you can view all stored memories, delete individual memories, or delete all memories at any time in the app’s settings.

4.4 Screen Capture Data

You may allow the AI to see your screen so that it can react to what you are doing. While the app is open and you have chosen to share a window, it takes periodic screenshots so it can respond to what is happening, and you can also prompt it to take a closer look on demand (the “watch this” feature). It only ever sees your screen while the app is open and you have actively chosen to share.

When screen viewing is active, screenshots are captured and sent to Anthropic’s API (our AI provider) so the AI can generate a response. We do not store screenshots. A screenshot is held in memory only for the length of a single request, sent to Anthropic to generate the reply, and then discarded. It is never written to disk, saved to a database, or written to a log. The screenshots taken by the “watch this” feature are handled the same way. You can stop the app seeing your screen at any time.

4.5 Voice and Audio Data

You may speak to the AI using your microphone. When you use this feature, your audio is sent to OpenAI’s API for transcription into text. You can use voice by holding a push-to-talk key, or by turning on the optional Hands-free voice setting (off by default), which keeps your microphone on while it is enabled. In hands-free mode, sound is checked on your device to detect speech, and only stretches that sound like speech are sent for transcription. It may also pick up other people or sounds near your microphone. The resulting text is then processed as a standard text message.

We do not store your audio: it is held in memory only, sent for transcription, and discarded once the text is returned. OpenAI does not retain the audio either: its transcription service keeps no copy of the audio or the resulting text, and OpenAI does not use the data for training.

4.6 Technical and Usage Data

We collect limited technical and usage data to operate and protect the Service, including:

• The number of calls made per billing period, to enforce usage limits

• Subscription status and billing history, for financial record-keeping

Our servers keep standard operational logs recording the time, method, and path of requests and whether they succeeded, which we use to diagnose faults and protect the Service. These logs do not contain the content of your conversations, your screenshots, or your audio.

To monitor the health and running costs of the Service, our servers also keep running totals of activity, such as the number of active sessions, how quickly requests are answered, and how much AI processing is used. When you use the app, we look up the country your internet connection comes from, using your IP address, so that we can count how many users we have in each country. Your IP address is used only for that lookup at the time of the request and is not stored, and the country is not linked to your account. We keep only a daily count of users per country.

Our marketing website at veilkin.gg is built and hosted on Framer, which provides built-in visitor analytics. These analytics are privacy-first and cookieless: Framer counts page views and daily unique visitors by combining your IP address and browser type into a hash using a secret that is rotated and deleted every day. No cookies or persistent identifiers are used, and the result does not identify you. We see only aggregate counts: visitor numbers, popular pages, and where traffic came from.

Beyond this, we do not use advertising trackers or behavioural profiling, and we do not use analytics of any kind on the account pages at app.veilkin.gg. If we introduce further analytics in the future, we will update this Policy and notify you.

5. Lawful Basis for Processing (UK GDPR / EU GDPR)

Under UK GDPR and EU GDPR, we are required to identify a lawful basis for each type of personal data processing we carry out. Our lawful bases are as follows:

• Account data (name, email, age confirmation): Contract - necessary to provide the Service you have signed up for and to verify your age.

• Password: Contract - necessary to authenticate you and protect your account.

• Subscription and billing data: Contract - necessary to process your payments and manage your subscription. Retention of billing records and purchase consents is also carried out to meet our Legal Obligations.

• Usage data: Legitimate Interests - we process usage data to enforce fair usage limits and protect the Service from abuse. This is necessary for us to operate a sustainable service and does not override your interests or rights.

• Memory data: Consent - you voluntarily share personal information with the AI companion. You may withdraw this consent at any time by deleting individual memories or all memories in the app’s settings.

• Screen capture data: Consent - you actively choose to share your screen. You may withdraw consent at any time by stopping the screen share.

• Audio data: Consent - you choose to use voice input. You may stop using this feature at any time.

For users outside the UK and EU, equivalent legal bases apply under the applicable laws of your jurisdiction. Please see Section 14.

6. How We Use Your Personal Data

We use your personal data only for the purposes described in this Policy. Specifically, we use your data to:

• Create and manage your account

• Provide and operate the Veilkin AI companion Service

• Process your payments and manage your billing

• Enforce the usage limits applicable to your plan

• Enable the AI companion to respond to your text and voice inputs

• Process screen capture data in real time when you share your screen

• Communicate with you about your account, subscription, or billing

• Respond to your data subject requests and privacy queries

• Comply with our legal obligations

We do not use your data for advertising, marketing profiling, or sale to third parties. We do not use your data to train AI models. Conversation data sent to Anthropic and OpenAI is processed in accordance with their respective terms and is not used by those providers to train their models.

7. Third-Party Data Processors

We share your personal data with the following third-party processors who process data on our behalf. We have data processing agreements or equivalent safeguards in place with each of them.

Google (sign-in only): if you choose Google sign-in, Google confirms your identity to us. Google is not one of our processors and handles this under its own privacy policy.

Sentry (error reporting): If the app or our servers hit an error, a crash report is sent to Sentry, stored in the EU (Germany). It includes the app version, technical details of the error and your account ID. It never includes your chats. If you choose to send a bug report, it also includes what you write, any screenshot you add and your account email so we can reply.