What we collect
- Account details: your name, email address and password (stored only as a secure hash). If you sign in with Google, we receive your name, email and profile picture from Google.
- What you track: the competitor websites you add, and the changes and briefs Vellox generates for you, plus anything you choose to add: your own company's website and role (used to personalize your brief), notes on changes, and feedback on briefs.
- Referrals: if you sign up through someone's referral link, we record who referred you, so they can earn their reward when you become a customer. They see only how many people they referred, not who.
- Billing status: your plan, subscription status and a customer reference from our payment provider. We never see or store your card details.
- Technical data: sign-in sessions (including IP address and browser type, for security) and standard server logs. When something breaks, we log the error message and the page it happened on.
- Email engagement: our weekly brief emails contain a tiny image and tracked links, so we can tell whether a brief was opened and whether its link was clicked. We use this only to judge whether briefs are useful. Blocking images in your email app stops open tracking.
- Pricing alerts without an account: if you ask to be emailed when a company changes its pricing, we keep your email address and that company until you unsubscribe (every alert has a link to stop). Nothing is sent until you confirm your address.
- Usage analytics: which pages are visited and which features are used, measured without cookies (see Vercel Analytics and PostHog below). We remove query strings from page addresses before analytics see them.
What we don't do
- We don't sell your data or share it with advertisers.
- We don't use advertising or tracking cookies. Our own cookies keep you signed in. If you arrive through one of our short links (/go/...), a first-party cookie remembers which link it was for 30 days, so we can count which of our posts lead to snapshots and sign-ups; it holds only the link's name. If you open the support chat widget, Crisp sets cookies needed to keep your conversation going.
- We don't intentionally collect personal data from the websites we monitor. Vellox reads public business information such as pricing pages, page lists, job titles and blog post titles.
Why we use it
- To provide the service: monitoring your competitors, writing your briefs, and sending alerts and briefs by email.
- To manage your account, trial and subscription, and to answer your support requests.
- To keep Vellox secure and working (for example, detecting abuse and fixing errors).
Services that process data for us
- Vercel (USA): hosts the website and app.
- Neon (USA): stores the database.
- Google (Gmail) and Resend (USA): send our emails.
- Creem: processes payments as merchant of record and handles billing details.
- Google (Gemini API) or Anthropic (Claude API) (USA): AI that summarizes detected competitor changes and writes your brief. We send it public information about competitor websites and, to personalize your brief, your company's name, website and your role. Not your email or password.
- Vercel Analytics (USA): cookieless page-view counts.
- PostHog (USA): cookieless product analytics (pages and features used). Nothing is stored in your browser.
- Crisp (EU): the support chat widget, and the messages you send through it.
- Sentry (USA): error reports (error message and page address) so we can fix bugs.
- Google: only if you choose "Continue with Google" to sign in.
- Internet Archive (Wayback Machine): we read archived copies of competitors' public pages to show their pricing history, and ask it to save pages where we spot a change. No personal data is sent.
- GitHub: runs our scheduled monitoring jobs.
These providers may process data outside your country. They are bound by their own security and privacy commitments.
How long we keep it
We keep your account data while your account exists. If you ask us to delete your account, we delete your personal data and tracked competitors within 30 days, except records we must keep by law (such as billing records held by our payment provider). Error logs are kept for up to 90 days.
Your rights
You can ask to see, correct, export or delete your personal data, or object to how we use it, by emailing muhammad2372002@gmail.com. We'll reply within 30 days. Where data protection laws in your country give you additional rights, we'll honor them.
Security
Passwords are hashed, connections are encrypted (HTTPS), and access to production systems is limited to the operator. No system is perfectly secure; if a breach affecting your data occurs, we'll notify you without undue delay.
Changes
We'll update this page when our practices change, and email you about significant changes.