Privacy Policy

What we collect

Server access logs

Our web server logs each HTTP request: IP address, User-Agent header, timestamp, request URL, and HTTP status code. These logs are stored on our infrastructure for 30 days, then deleted automatically.

We use access logs to diagnose outages, detect abuse, and understand aggregate traffic patterns. We do not use them to build profiles of individual visitors.

Theme preference

When you switch the color theme (light / dark / system), we store your choice in localStorage under the key theme. This is a functional preference stored on your device only — it is never transmitted to our servers.

What we do not collect

• No analytics scripts or tracking pixels
• No advertising network tags
• No fingerprinting
• No session identifiers beyond what the CDN sets for DDoS mitigation (see below)

Third parties

CDN

vaelor.ai is proxied through a CDN. Every request passes through the CDN's infrastructure, which means the CDN provider sees your IP address and request metadata before the request reaches our server. The CDN may set a short-lived security cookie for bot mitigation; this is exempt from consent under the ePrivacy Directive Art. 5(3) as a strictly necessary security measure.

GitHub

This site links to GitHub repositories. If you click a GitHub link, GitHub's own privacy policy applies. We do not embed GitHub scripts on this site.

No analytics, no ad networks, no tracking pixels are loaded on this site.

Legal basis (GDPR Article 6)

Our lawful basis for processing server access logs is legitimate interest (Art. 6(1)(f)): operating a reliable, secure public service requires logging requests. We apply the minimum retention period necessary (30 days) and do not use logs for individual profiling.

The theme localStorage key is processed exclusively on your device and is not a form of data processing by us.

Your rights

Under GDPR you have the right to:

• Access — request a copy of data we hold about you
• Rectification — correct inaccurate data
• Erasure — request deletion of your data
• Portability — receive your data in a structured format
• Objection — object to processing based on legitimate interest
• Restriction — request we limit processing while a dispute is pending

To exercise any right, email contact@vaelor.ai with subject line "DSAR — [Right]". We respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority. In the EU, your local Data Protection Authority (DPA) is the relevant body.

International data transfers

The CDN operates a global network with edge nodes in the EU, US, and other regions. Transfers outside the EEA are covered by the provider's participation in the EU-US Data Privacy Framework and Standard Contractual Clauses (SCCs).

Our origin servers are located in the United States. Operational server logs are retained on our self-hosted infrastructure under the legitimate interest basis (Art. 6(1)(f) GDPR). They are not transferred to any third-party processor.

CCPA (California residents)

We do not sell personal information as defined by the California Consumer Privacy Act. California residents have the same access and deletion rights described above under "Your rights." Contact contact@vaelor.ai to submit a CCPA request.

Children's privacy

This service is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has submitted data to us, contact us at contact@vaelor.ai and we will delete it.

Data Protection Officer

We are not required to designate a DPO under GDPR Article 37 (no large-scale systematic monitoring and no special-category data). Privacy inquiries go to contact@vaelor.ai.

Changes to this policy

Material changes will be reflected in an updated "Last updated" date at the top of this page. We will not retroactively weaken privacy protections for data already collected under a prior version.

Contact

Anatoly Koptev
San Francisco, CA, USA
contact@vaelor.ai