Privacy Policy

Last updated: July 2026. This policy applies to all visitors, users, and customers of Vael, Inc. and its services at vaelfinance.com.

1. Who we are

The data controller is Vael, Inc., a Delaware corporation. Our principal offices are at 535 Mission Street, Suite 1400, San Francisco, CA 94105, United States.

For privacy questions, contact our privacy team at privacy@vaelfinance.com.

2. Data we collect

Account information

When you create an account we collect your name, email address, and optionally your company name. If you upgrade to a paid plan, we collect billing address and payment details. Payment card numbers are processed directly by our payment processor (Stripe) and are never stored on our systems.

Financial data

Vael is an AI CFO copilot. To produce your analysis, it reads your financial data. That data reaches us in one of two ways:

• Connected accounts. You authorize a read-only connection to your bank, card, or invoicing provider through a trusted third-party data connection service. Vael receives a read-only feed of transaction and balance data for the accounts you authorize. We never receive write credentials. We cannot move money, initiate payments, or modify any account on your behalf. See "How connections work" below.
• Pasted or uploaded data. You may paste a ledger export or upload a file directly. This data is processed to produce your analysis. If you do not explicitly save the result, it is not retained after your session ends.

Your financial data is used to produce your analysis and for no other purpose. It is not sold. It is not used to train any shared or public AI model.

How connections work

Read-only connections to banks, cards, and invoicing providers are established through your explicit authorization, typically via OAuth or a secure token exchange handled by a regulated data connection service. We receive read-only access to the accounts and date ranges you authorize and nothing beyond that. Specifically:

• Vael cannot initiate payments or transfers of any kind.
• Vael cannot modify your accounts, payees, or any account data.
• Vael can only read the transaction and balance data you have authorized for the period you specify.

You can revoke any connection at any time from your account settings. On revocation, we stop receiving new data for that connection immediately.

Usage data

We collect information about how you use the service: pages visited, features used, analysis counts, error events, and timestamps. We also collect standard server logs including your IP address, browser type, and referring URL. This data is processed in aggregate to operate, secure, and improve the service.

Communications

If you contact us by email or through a contact form, we retain the content of that communication to respond to your query and to maintain a record of our interactions.

Cookies and browser storage

We use essential cookies to keep you authenticated and to protect form submissions. We also store your theme and currency preferences in your browser's local storage. We do not use advertising, tracking, or third-party analytics cookies. See our Cookie Policy for the full detail.

3. How we use your data

• To provide the Vael service: reading your financial data and producing your runway estimates, leak detection, cost-cut suggestions, and anomaly alerts.
• To create and manage your account.
• To process payments and issue receipts.
• To send transactional communications: account notices, receipts, and service updates.
• To monitor and secure the platform, and to investigate suspicious activity.
• To improve the service using aggregated, de-identified usage data.
• To comply with applicable law and to respond to lawful requests from public authorities.

4. Model providers and your financial data

Vael is model-agnostic. It routes each analysis across one or more AI model providers based on the nature and complexity of your data. When you run an analysis, a structured representation of your financial data is sent to a model provider to produce your output.

The following commitments apply without exception:

• Your data is not used to train shared models. Your financial data is never used to train, fine-tune, or improve any publicly shared or general-purpose AI model, whether operated by Vael or by a model provider. We select model providers whose data processing terms are consistent with this commitment.
• Your data is not sold. We do not sell your financial data, personal data, or any analysis output to any third party, for any purpose.
• Your data is used only to produce your analysis. Data sent to model providers is used solely to generate the plain-language output you see in your dashboard. It is not retained by model providers beyond what is necessary to complete the request, per our agreements with them.

5. Sub-processors

We engage a limited number of sub-processors to provide the service. Current categories include:

• Cloud infrastructure and hosting
• Payment processing (Stripe)
• Data connection services for bank and invoicing integrations
• AI model providers (for the analysis engine)
• Transactional email
• Error monitoring

You may request the current sub-processor list by writing to privacy@vaelfinance.com. We will notify you of material changes to our sub-processors before those changes take effect.

6. Data retention and deletion

We retain your account data for as long as your account is active and for a reasonable period after closure in case of disputes or in case you return.

Financial data from connected accounts is retained while the connection is active. When you disconnect an account or delete your Vael account, we delete the associated financial data within 30 days.

Pasted or uploaded financial data that you do not save is not retained beyond your session. Data you explicitly save is retained until you delete it or close your account.

Billing records are kept for seven years to comply with US tax and accounting law. Server logs are kept for 90 days.

You may request early deletion of your data at any time by writing to privacy@vaelfinance.com or by closing your account from settings.

7. Your privacy rights

To exercise any of the rights described below, write to privacy@vaelfinance.com. We will respond within 45 days (or within one month where EU or UK GDPR applies).

California residents (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know. Request disclosure of the categories and specific pieces of personal information we hold, the sources, the purposes, and any third parties we share it with.
• Delete. Request deletion of personal information we hold, subject to exceptions permitted by law.
• Opt out of sale or sharing. We do not sell personal information and do not share it for cross-context behavioural advertising. If this ever changes, we will provide a clear opt-out mechanism before it takes effect.
• Correct. Request correction of inaccurate personal information we hold about you.
• Limit use of sensitive personal information. We process your financial data only to provide the service you requested and do not use it for secondary purposes without your consent.
• Non-discrimination. We will not discriminate against you for exercising any CCPA/CPRA right.

EU and UK residents (GDPR)

If you are located in the EU or UK, you have the right to:

• Access. Request a copy of the personal data we hold about you.
• Rectification. Ask us to correct inaccurate or incomplete personal data.
• Erasure. Ask us to delete your personal data where there is no legitimate reason for continued processing.
• Portability. Where processing is based on contract or consent and is automated, ask for your data in a structured, machine-readable format.
• Objection. Object to processing based on our legitimate interests. We will stop unless we can demonstrate compelling grounds that override your interests.
• Restriction. Ask us to restrict processing in certain circumstances.
• Withdrawal of consent. Where processing is based on consent, withdraw it at any time. Withdrawal does not affect the lawfulness of earlier processing.

8. International transfers

Vael is based in the United States. If you use the service from the EU or UK, your personal data may be transferred to and processed in the US. Where personal data is transferred internationally, we rely on Standard Contractual Clauses, the EU-US Data Privacy Framework, or other appropriate safeguards to maintain an equivalent level of protection. Write to privacy@vaelfinance.com to request details of the safeguards we apply.

9. Security

We apply technical and organisational measures appropriate to the sensitivity of the data we handle, including encryption in transit and at rest, access controls, and regular security reviews. For more detail, see our Security page.

10. Children

The service is directed at businesses and adults. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact us and we will delete it promptly.

11. Cookies

For a full description of the cookies and browser storage we use and how to control them, see our Cookie Policy.

12. Changes to this policy

We may update this policy from time to time. For material changes, we will notify you by email or by a prominent notice in the platform at least 30 days before the change takes effect. The date at the top of this page shows when it was last updated.

13. Contact

For any questions about this policy or your personal data:

• Email: privacy@vaelfinance.com
• Post: Vael, Inc., 535 Mission Street, Suite 1400, San Francisco, CA 94105, United States

If you are a California resident with a complaint about our data practices, you may contact the California Attorney General. If you are in the EU or UK, you have the right to lodge a complaint with your local supervisory authority. UK residents may contact the Information Commissioner's Office (ICO) at ico.org.uk.