Privacy Policy.

1. Who we are and what this policy covers

veli(Q Lab ("veli(Q Lab", "we", "us") is a business registered in India. We design, build and operate AI systems and software products for businesses, including veli(Q CRM, and we offer an AI assistant called Primues.

This policy explains how we handle personal data when you visit veliqlab.com, chat with Primues on LINE or this website, email us, or deal with us commercially. It is written to meet the requirements of India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000 with its rules, and it sets out notices for people in other regions in section 13.

Our two roles. For the personal data described in this policy (website visitors, enquiries, chat conversations, business contacts) we decide why and how the data is used, so we act as the Data Fiduciary under the DPDP Act, or as the controller under laws that use that term. When we build or operate a system for a client and process the client's own data on the client's instructions, we act as a Data Processor and the client is responsible for that data. Those engagements are governed by the written agreement with the client, not by this policy.

Our services are intended for businesses. We do not knowingly collect personal data from anyone under 18 years of age, and you must not use the website or Primues if you are under 18. If you believe a child has given us personal data, tell us at the address in section 16 and we will delete it.

2. Personal data we collect

Data you give us

• Contact details: your name, work email address, telephone number, company and job title.
• Conversation content: messages and files you send to Primues or to our team, including what you write in the contact form on our Contact page (which is relayed through our server to our team and recorded in our own veli(Q CRM) and descriptions of your business needs.
• Commercial information: details you share during scoping, proposals and projects.
• Recruitment information if you apply to work with us, such as your CV and portfolio.

Data collected automatically

• Messaging identifiers that LINE passes to us, such as your display name, user ID and the time of your messages.
• Server and security logs kept by our hosting provider, such as IP address, browser and device type, pages requested and timestamps.

We do not run advertising trackers, and the veliqlab.com marketing website uses no analytics trackers (the CRM application is covered in section 14). We do not intentionally collect sensitive personal data (for example health, financial account, biometric, caste or religious data) through the website or Primues. Please do not send it. If you do, we will delete it where we can.

3. Why we use your data

We use personal data only for the purposes below, and for no purpose that is incompatible with them:

• to respond to your enquiry, scope your use case and arrange calls;
• to prepare proposals, enter into and perform contracts with you or your organisation, and send invoices;
• to provide, secure, support and improve the website, Primues and our services;
• to send service messages and, only with your consent and with an easy way to opt out, updates about our work;
• to detect and prevent fraud, abuse and security incidents; and
• to comply with law, respond to lawful requests and establish, exercise or defend legal claims.

4. Our lawful grounds

Under the DPDP Act we process personal data on the basis of your consent, which you give when you contact us or chat with Primues after seeing the notice at that point, and for the legitimate uses the Act recognises, including where you voluntarily provide data for a specified purpose and have not indicated that you do not consent to its use, where we must comply with law, and where we need to respond to a medical or security emergency.

Where the law of another country applies, we rely on the equivalent ground: consent, performance of a contract or steps before a contract, legitimate business interests (such as securing our systems and answering business enquiries) that are not overridden by your rights, or a legal obligation. You may withdraw consent at any time as described in section 10. Withdrawal does not affect processing done before it, and we may keep data we are legally required or permitted to keep.

5. How AI is used

Primues and the systems we build use machine-learning models supplied by third-party providers through commercial interfaces. When you chat with Primues:

• Primues tells you it is an AI system, and you may ask to speak with a person at any time.
• Your messages are processed to produce replies and to summarise your enquiry for our team.
• We use providers under commercial terms that do not allow them to train their models on the data we send them by default. We do not use your conversations to train our own models without your separate permission.
• Our team may read conversations to follow up with you, to keep the service safe and to check the quality of answers.
• AI replies can be wrong or incomplete. Please treat them as information, not professional advice.

We do not use AI to make decisions that have a legal or similarly significant effect on you without human involvement.

6. Who we share data with

We do not sell personal data. We disclose it only to:

• Service providers that process data for us under written terms, in these categories: cloud hosting and content delivery, database and authentication services, AI model providers, bot and abuse protection, email delivery, performance measurement, and security and monitoring tools;
• Messaging platforms (LINE) that you choose to use to contact us. They are independent from us and their own privacy policies govern what they do with your data;
• Professional advisers such as lawyers, accountants and auditors, who are bound by confidentiality;
• Courts, regulators and law-enforcement or government bodies, where we believe in good faith that disclosure is required by law or needed to protect rights, safety or security; and
• a successor in a merger, acquisition, restructuring or transfer of the business, who must honour this policy.

We remain responsible for personal data we hand to processors, and we require them to protect it and to use it only on our instructions.

7. Storage and international transfers

Our systems and our providers' systems may be located in India and in other countries. By contacting us, you understand that your personal data may be transferred to and processed in countries outside your own. Transfers from India take place in line with section 16 of the DPDP Act, which allows transfers except to countries the Government of India restricts by notification. Where another law requires safeguards for a transfer, we use contractual protections, access controls and encryption, and we only transfer what is needed.

8. How long we keep data

We keep personal data only as long as it is needed for the purposes in section 3, or longer where the law requires. As a guide:

• enquiries and chat conversations that do not lead to a contract: up to 24 months after our last contact, then deleted or anonymised;
• contract, invoice and tax records: for the period required by Indian law, which is generally between six and eight years depending on the record;
• security and server logs: up to 12 months unless needed for an investigation;
• recruitment data: up to 12 months after the process ends, unless you ask us to remove it sooner.

When the purpose is complete or you withdraw consent and no law requires us to keep the data, we delete it or irreversibly anonymise it.

9. Security and breaches

We apply reasonable security safeguards as required by the DPDP Act and the IT Act, including encryption in transit, least-privilege access, authentication controls, logging and regular review of the providers we use. No system is completely secure, and we cannot guarantee absolute security of data sent over the internet.

If a personal data breach affects you, we will notify you and the Data Protection Board of India in the manner and within the time that the law requires, and we will report certain cyber incidents to CERT-In as required.

10. Your rights

Under the DPDP Act, and under other laws that apply to you, you may:

• ask for a summary of the personal data we process about you and who we have shared it with;
• ask us to correct inaccurate or misleading data, complete incomplete data, update it, or erase data that is no longer needed;
• withdraw consent to processing at any time (as easily as it was given);
• use our grievance process in section 11 and, if you are not satisfied, complain to the Data Protection Board of India or the data protection authority in your country; and
• nominate another person to exercise these rights on your behalf if you die or become unable to do so.

To exercise a right, email office@veliqlab.com from the address we hold for you. We may need to verify your identity, and we aim to respond within 30 days. We may refuse a request that is unfounded, excessive or prohibited by law, and we will tell you why.

Your duties. The DPDP Act also asks you to comply with applicable law, not to impersonate another person, not to suppress material information when giving us your data, not to file a false or frivolous complaint, and to give only verifiably authentic information when you ask for correction or erasure.

11. Grievance Officer

If you have a complaint about how we handle your personal data, write to the Grievance Officer. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days, or sooner if the law requires. You should use this process before approaching the Data Protection Board of India.

12. Cookies and similar technologies

The veliqlab.com website uses only essential browser storage that it needs to work, for example to remember that you have seen the intro animation. The veli(Q CRM application uses essential cookies to keep you signed in and secure, and aggregated performance and usage measurement to keep the application fast and reliable (see section 14). If you use the website chat with Primues, your messages are relayed through our server to the assistant and the AI provider behind it, and the conversation is kept in your browser's session storage for the visit and cleared when you close the tab. The website also offers an optional Thai translation toggle. Nothing is loaded from Google unless you choose it; if you do, your browser loads Google's Website Translator, Google receives the page text and your IP address in order to translate it, and we store a small functional cookie (googtrans) in your browser to remember your language choice. Switching back to English clears it. Machine translation can contain errors, so the English text is the authoritative version. We do not use advertising or cross-site tracking cookies anywhere. If we later add analytics or marketing tools to the website, we will ask for your consent where required and update this policy first.

Our website links to third-party sites and services, including messaging platforms and our CRM at crm.veliqlab.com. Those have their own privacy practices and we are not responsible for them.

13. Notices for other regions

We are established only in India and our services are directed at businesses. We do not target individual consumers in other countries or monitor their behaviour. If you are in one of the places below and the law there applies to our handling of your data despite this, the following applies in addition to the rest of this policy:

• European Economic Area and United Kingdom: you may have rights of access, rectification, erasure, restriction, objection and portability under the GDPR or UK GDPR, and a right to complain to your supervisory authority. Transfers of your data to India rely on your consent, on contractual safeguards or on another mechanism the law allows.
• Thailand: you may have rights under the Personal Data Protection Act B.E. 2562 (2019), including access, portability, objection, erasure, restriction and correction, and a right to complain to the Personal Data Protection Committee.
• Singapore: you may access and correct your personal data and withdraw consent under the Personal Data Protection Act 2012, and complain to the Personal Data Protection Commission.
• United States and elsewhere: we do not sell or share personal data for advertising. If a state or national law gives you additional rights, you may exercise them using section 10.

14. veli(Q CRM and the data stored in it

veli(Q CRM, available at crm.veliqlab.com, is a multi-tenant business application used by our customers' organisations. It involves two kinds of data, and we treat them differently.

1. Account data: we are the Data Fiduciary

• Your name, work email address, role and workspace membership, and the credentials you use to sign in. Passwords are kept only in protected form and are not readable by us.
• Security and sign-in events (for example, sign-in times and password or two-factor recovery requests), and support correspondence.
• Essential session cookies, and aggregated performance and usage measurements of the application, used to run, secure and improve the CRM.

We use this data to provide and secure your account, support you, bill your organisation and meet legal duties, on the grounds in section 4.

2. Customer Data: we are the Data Processor

"Customer Data" is everything your organisation puts into its workspace, such as contacts, companies, deals, tickets, tasks, notes and files imported by CSV. Your organisation decides what to store and why, and it is the Data Fiduciary (or controller) for that data. We process Customer Data only to provide the CRM on your organisation's documented instructions, under the Terms of Service and any data-processing agreement we sign. In particular:

• each organisation's data is logically separated from every other organisation's;
• we do not sell Customer Data or use it for advertising, and we do not use it to train AI models;
• our staff access it only where needed to give support your organisation asks for, to keep the service secure or to comply with law; and
• we use sub-processors in the categories listed in section 6, under written terms.

AI features. The CRM includes optional AI features, such as an assistant, record and email summaries, email drafting, call-transcript analysis, automation drafting and AI-assisted search. When a user uses one of them, the text and the CRM records needed for that request are sent to an AI model provider to produce the result. We configure these requests so that the provider does not store the conversation, we mask recognisable secrets (such as access tokens and payment card numbers) before sending, and we identify users to the provider only by a hashed identifier. The provider may keep request data for a limited period for abuse monitoring, and under its commercial terms it does not use that data to train its models by default. We do not use Customer Data to train AI models. A workspace administrator can switch AI features off for the workspace or for individual people, and we recommend doing so for any data your organisation does not want processed by an AI provider.

Connected accounts. If your organisation connects a mailbox, calendar or payment account, we access it only through the provider's authorisation flow, on your organisation's authority and for the features you use. You can disconnect it at any time, and you can revoke our access from the provider's own settings.

On termination, your organisation may export its Customer Data for at least 30 days, after which we delete it from live systems, and it leaves backups in the normal backup cycle. We may keep data we must keep by law.

3. If you are a contact in someone else's CRM

If your details sit in a workspace belonging to one of our customers, that organisation, not us, decides how they are used. Please contact that organisation about your rights. If you write to us instead, we will pass your request on to the relevant customer where we can, and we may be unable to act on it ourselves.

This section does not limit the rest of this policy. A signed data-processing agreement, where there is one, prevails over it for Customer Data.

15. Changes to this policy

We may update this policy as our services or the law change. We will post the new version here with a new effective date, and where a change is material we will give you notice by a prominent message on the website or by email. Continued use after the effective date means you accept the updated policy, but where the law requires fresh consent we will ask for it.

16. Contact us

This policy is governed by the laws of India and subject to the dispute resolution terms in our Terms of Service.