Privacy Policy

Summary

We collect only the minimum data needed to operate your blog: your email address, billing details (processed securely by Stripe), and the content you publish. We do not sell your data, we do not run behavioural advertising, and we keep third-party sub-processors to a minimum. For any questions, email [email protected].

Data we collect

• Account email and hashed password (blog owners)
• Reader email and newsletter preferences (blog readers who subscribe)
• Billing details — stored exclusively by Stripe; we hold a customer reference ID
• Your published content (posts, pages, media, comments)
• Your own Stripe/AI API keys, if you bring them — stored encrypted at rest (AES-256-GCM)
• Basic usage logs for security and abuse prevention (IP hash, user agent, timestamps)

Sub-processors

We rely on the following trusted third parties to operate. Each is bound by a Data Processing Agreement with equivalent safeguards.

AI data processing

When you use the built-in AI features, your prompt is sent to Google Gemini via the platform API key. Google does not train on data sent through this API and does not retain prompts beyond the request lifetime. If you bring your own AI key (BYOK), your prompts are sent to the provider of your choice under their terms.

Analytics

On velocms.org (our marketing, sign-in and sign-up pages, and the admin while you are signed in) we use Google Analytics 4 and Microsoft Clarity to understand how the site is used. We do not use either tool for advertising.

Before you choose: Google Analytics 4 runs in a restricted mode. It sets no cookies and receives only cookieless pings (page address, referrer, language, screen size and browser type). Your IP address reaches Google as part of the network request. Microsoft Clarity does not load.

If you accept: Google Analytics sets the first-party cookies _ga and _ga_ followed by the container ID (up to 2 years). Microsoft Clarity loads and sets the first-party cookies _clck and _clsk, and records clicks, scrolling and how pages are displayed. Advertising storage stays denied.

If you decline: Microsoft Clarity stays off, Google Analytics keeps sending cookieless pings only, and no analytics cookie is set.

Cookie preferences

Essential cookies need no consent and are set only when you make a choice or use a feature: vcms_consent (stores your cookie choice, 1 year), velocms-locale (language), theme (display theme) and sign-in session cookies after you log in. Your analytics choice is stored in vcms_consent.

You can change your mind at any time with the button below, or through your browser settings.

Right to deletion

You can delete your account at any time from /admin/account/delete. On deletion:

• Your Stripe subscription is cancelled immediately
• Your posts, pages, members, and media are soft-deleted and retained for 30 days in case you reconsider
• After 30 days all data is hard-deleted from our databases and R2 storage
• Stripe retains payment records per its own retention policy (7 years, required by UK law)
• Sub-processor logs (Sentry, Google Analytics, Microsoft Clarity) expire per their own default retention periods

Your rights

We process personal data in line with applicable data-protection law, including the EU/UK GDPR where it applies to our users. You have the right to access, rectify, port, or erase your personal data, to restrict or object to processing, and to lodge a complaint with the data protection authority in your jurisdiction. Email [email protected] for any of these — we action requests within 30 days.

Contact

VeloCMS. Questions: [email protected].

VeloCMS's company registration in Sharjah, United Arab Emirates is in progress. The registered company name, licence number and address will be published here once incorporation is complete.

This policy has been founder-reviewed and reflects current processing activities. A solicitor review is scheduled before the general public launch.