Privacy Policy

VELCAR.AI LLC (“VELCAR”, “we”, “us”) is a limited liability company registered in the State of Florida, United States. We build and operate AI assistants that answer incoming customer messages on behalf of the businesses that hire us.

Registered address: 14 NE 1ST AVE, STE 1403, Miami, FL 33132, United States

Privacy and data protection contact: hola@velcar-ai.com

We process personal data in the United States. If you contact us from outside the United States, your data will be transferred to and processed in the United States.

The way we handle data depends on who you are. This distinction matters, so we state it plainly:

• If you are one of our clients — a business that hires VELCAR — we are the controller of your account, billing and contact data. This policy governs how we use it.
• If you are an end user who messaged one of our clients — for example, you sent a WhatsApp or Instagram message to a business that uses our assistant — that business is the controller of your data, and VELCAR acts as its service provider (processor). We handle your messages only to deliver the service that business asked us to run, following their instructions. You may also contact us directly using the details in section 14, and we will act on your request or route it to the responsible business.

3.1 Data about our business clients

When a business signs up for or evaluates our service, we collect:

• Contact details: company name, contact name, business email address, phone number, and role.
• Commercial and billing data: plan selected, invoices, billing address, tax identifiers, and payment status. Card details are handled by our payment processor — we do not store full card numbers.
• Integration credentials: access tokens and identifiers for the accounts you connect (for example your WhatsApp Business Account, Instagram Professional Account, Facebook Page, or calendar). These are stored encrypted and used only to operate the service you configured.
• Support and account records: messages you send us, configuration changes, and operational logs of your account.

3.2 Messaging data about end users

This is the data that reaches us when a person writes to one of our business clients through WhatsApp or Instagram. We receive and store:

• Message content — the text you send and the replies the assistant sends back, including media you attach (images, audio notes, documents) when the conversation requires it.
• Your identifier on the channel — your WhatsApp phone number, or your Instagram user ID and handle.
• Your public profile name as the platform provides it.
• Conversation history — prior messages in the same thread, so the assistant has context and does not ask you the same thing twice.
• Delivery metadata — timestamps, message IDs, sent/delivered/read status, channel, and error codes returned by the platform.
• Information you choose to provide during the conversation — for example your name, your preferred appointment time, or the service you are asking about. Provide only what is needed; do not send us sensitive information such as health, financial or government ID details.

We do not read your other conversations, your contact list, or any content outside the thread you have with the business that uses our assistant. WhatsApp and Instagram grant us access only to the messages exchanged with that business.

3.3 Website visitors

When you visit https://www.velcar-ai.com, we collect the information you submit in our contact or booking forms, and basic technical and analytics data such as pages viewed, approximate location derived from IP address, referrer, and browser type. We use this only to keep the site working and to understand which pages are useful.

We use the data described above for the following purposes, and no others:

• Operating the AI assistant: reading an incoming message, generating a relevant reply on behalf of the business client, and sending it back through WhatsApp or Instagram.
• Booking and managing appointments: checking availability, creating, rescheduling or cancelling a booking in the client's scheduling system when you ask for it.
• Escalating to a human: detecting when a request needs a person — a complaint, an edge case, a request the assistant cannot resolve, or an explicit request to speak to someone — and handing the conversation to the business client's team with the context of the thread.
• Maintaining conversation continuity so you are not asked to repeat information you already gave.
• Service reliability and troubleshooting: monitoring delivery failures, debugging incidents, and preventing abuse of the service.
• Billing, account administration and communicating with our business clients about their service.
• Meeting our legal, tax and accounting obligations.

• We do not sell personal data. Not message content, not phone numbers, not profile data — to anyone, under any arrangement.
• We do not use your data for third-party advertising. We do not share messaging data with ad networks, data brokers or marketing platforms, and we do not build advertising profiles or audiences from it.
• We do not let our AI provider train general-purpose models on your messages. Message content is sent to our language-model provider only to generate a reply to that conversation, under commercial API terms that prohibit using the content to train their models.
• We do not use one client’s data for another client. Each business client’s conversations are logically separated and are never combined or reused across accounts.

We share data only with the service providers we need in order to run the service. Each is bound by contract to process data solely on our instructions:

• Meta Platforms, Inc. — WhatsApp Business Platform (Cloud API) and Instagram Messaging API. Meta is the channel through which messages are delivered; message content and identifiers necessarily pass through Meta’s infrastructure, governed by Meta’s own terms and privacy policy.
• Our large language model provider (Anthropic) — receives the message content and the relevant conversation context needed to generate a reply, under commercial API terms with no training on submitted content.
• Cloud hosting and database providers — host our application and store conversation records and configuration in the United States.
• Scheduling, payment and business tools — where a client has connected them, such as the booking system an appointment is written into, or our payment processor for client invoicing.
• The business client you messaged — the business whose account the assistant answers on can see the conversations sent to it. That is the point of the service.

We may also disclose data where required by law, valid legal process, or to protect the rights and safety of users and of VELCAR.

Where we access data through the WhatsApp Business Platform or the Instagram Messaging API, we use that data only to provide and improve the messaging service our business client has configured. We handle it in accordance with the Meta Platform Terms and Developer Policies, and we retain it no longer than necessary for that purpose. We do not transfer platform data to any party for advertising, resale, or the creation of user profiles unrelated to the service.

Deletion requests concerning data obtained through these platforms are handled through the process described in section 9.

• Conversation records (messages, identifiers, delivery metadata) are retained for as long as the business client's account is active, and by default for up to 12 months after the last message in a thread. A client may configure a shorter retention period for their account.
• Operational and error logs are retained for up to 90 days.
• Business client account, contract and billing records are retained for the life of the contract and afterwards for as long as tax and accounting law requires.
• Website analytics data is retained in aggregate form and is not linked to messaging data.

When a client contract ends

On termination, the client may request an export of their conversation data. We provide it within 30 days of the request. After that window — or immediately, if no export is requested — we delete the client’s conversation data and revoke and delete their stored integration tokens. Deleted data is removed from encrypted backups within 90 days as backups rotate out. We retain only what we are legally required to keep, such as invoices.

You can ask us to delete your data at any time, whether you are a business client or someone who messaged a business that uses our assistant. Here is exactly how.

How to request deletion

• Send an email to hola@velcar-ai.com with the subject line Data deletion request.
• Tell us which channel you used and include the identifier we would know you by: the WhatsApp phone number (in international format) or the Instagram handle you messaged from.
• Tell us the name of the business you were messaging, so we can locate the right account.
• We will reply to confirm receipt within 5 business days. We may ask one verification question to confirm the request comes from the owner of that number or account — this protects you from someone else deleting your record.
• We complete verified deletions within 30 days of verification and email you a confirmation when it is done.

What gets deleted

• The full content of your conversation with that business, including any media you sent.
• Your phone number or Instagram identifier and profile name as stored in our systems.
• Your conversation history and any context notes the assistant derived from it.
• Delivery metadata associated with your messages.

What we cannot delete

• Records the business client has separately exported into their own systems — their CRM, calendar or inbox. We will tell you which business to contact, and their own privacy policy applies.
• Copies held by Meta in WhatsApp or Instagram. Those are governed by Meta's policies and must be requested from Meta or removed from your own app.
• Encrypted backups, which are purged on a rolling basis within 90 days. Backups are not used for any operational purpose in the meantime.
• Records we are legally required to keep, such as invoices for a business client.

You may ask us to:

• Access the personal data we hold about you and receive a copy of it.
• Correct data that is inaccurate or incomplete.
• Delete your data, as described in section 9.
• Restrict or object to certain processing, or withdraw consent where processing is based on consent.
• Stop receiving messages from an assistant — reply STOP in the conversation, or tell us by email.

To exercise any of these rights, email hola@velcar-ai.com. We acknowledge requests within 5 business days and respond substantively within 30 days. We do not charge for these requests and we will not treat you differently for making one.

Depending on where you live, you may also have the right to lodge a complaint with your local data protection authority. Where we act as a service provider for a business client, we will forward your request to that business and support them in answering it.

We take the following measures to protect the data in our care. No system can be guaranteed to be completely secure, but these are the controls we operate:

• Data is encrypted in transit using TLS, and encrypted at rest in our databases and backups.
• Integration credentials and access tokens are stored encrypted, never in plaintext, and are scoped to the minimum permissions the service requires.
• Access to production systems and conversation data is restricted to the personnel who need it to operate the service, protected by individual accounts and multi-factor authentication.
• Each business client's data is logically separated from every other client's.
• Access to production systems is logged, and tokens are revoked when a contract ends or a credential is suspected to be compromised.

If a breach affects your personal data, we will notify affected clients and, where required, affected individuals and the relevant authorities, without undue delay.

Our service is not directed to children under 13, and we do not knowingly collect personal data from them. If you believe a child under 13 has provided us with personal data, contact us at hola@velcar-ai.com and we will delete it.

We update this policy when our data practices change. The “last updated” date at the top of this page always reflects the current version. If a change materially affects how we handle personal data, we will notify our business clients by email at least 30 days before it takes effect, so they can inform their own users. Continued use of the service after the effective date means the updated policy applies.

Questions, requests, or complaints about this policy or about how we handle your data:

VELCAR.AI LLC
14 NE 1ST AVE, STE 1403, Miami, FL 33132, United States
hola@velcar-ai.com