Privacy notice

Notice under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") for those who use the Vemploy site and service. Version of 2 November 2026. Draft, to be reviewed before public launch. The Italian version prevails.

Controller

Velion S.r.l., registered office Via del Coroneo 19, 34133 Trieste (TS), Italia, tax and VAT number 01421440320, REA TS-214729. For data protection requests write to privacy@velion.it.

The controller has not appointed a Data Protection Officer, since the conditions of Article 37 GDPR do not apply; an appointed internal data protection contact can be reached at the same address. Velion S.r.l. is adopting an information security management system that complies with ISO/IEC 27001.

What stays on your computer

Vemploy works on your computer. Chats, documents, knowledge, procedures, the credentials of your systems, screenshots and browser profiles are not sent to our servers, with two exceptions only, described below: what you choose to send to support, and the app's error reports.

The data we process

• Account data: email address, password (kept only as an irreversible hash), language, company name, role in the account, the version of the terms accepted and when.
• Billing data: tax area and, for Italy, the SDI recipient code or PEC, or the tax code. Address and VAT number are collected by Stripe.
• Payment data: processed by Stripe; we keep the customer and subscription identifiers, the state of payments and, for each payment, the data needed to issue the invoice.
• Usage data: for each call to the model, date and time, the person and computer that made it, the model, the amount of text processed (tokens), web searches and cost.
• Technical and security data: IP address and the number of sign-in, registration and password-reset attempts.
• Reports to support: only when you press «Send» in «Send to support» in the app, after seeing its preview: your description, the screenshots you attach and, if you leave the technical details box on, the details the app prepares (the chat lines and steps of the job and of the jobs linked to it, the lines of the app's log of that time, what the app knew of the computer, for instance the titles of browser tabs and the names of open programs, documents and files), cleaned on your computer of passwords, keys and saved credentials. Screenshots and details may contain personal data of yours or of other people: you attach only what you choose. We link them to your account, and to the person and computer that sent them.
• Error reports: when the app meets an error it cannot handle, the error's type and message, the places in the program where it happened, the app's version and channel, the Windows version and the time; no chat, file or screen content. They are sent automatically, unless you turn them off in Settings → «Support».
• Requests to the AI model: they pass through our gateway to be forwarded to the model's provider, and the answer returns to your computer. We do not keep them. They may contain personal data you or your company provide: if you use Vemploy for a business, for that transit we act as a processor under the data processing agreement.

Why we process them, and on what basis

• Registration, providing the service, managing the account, spend limits and payments, service notices (included usage spent, spend limits, invoices available): performance of the contract (Art. 6(1)(b)).
• Issuing invoices and keeping accounting and tax records: legal obligation (Art. 6(1)(c)).
• Securing the service and preventing abuse (attempt limits, blocking temporary mailboxes, checking that whoever registers is a person): legitimate interest (Art. 6(1)(f)).
• Support: answering the reports you send (performance of the contract, Art. 6(1)(b)) and fixing the app's errors from its error reports (legitimate interest, Art. 6(1)(f); you may turn them off at any time). Reports and error reports are used for nothing else.
• Establishing, exercising or defending legal claims: legitimate interest (Art. 6(1)(f)).

Account and billing data are needed to use the service and to buy a plan.

Who we share them with

The providers that help us deliver the service, appointed as processors under Article 28 GDPR and bound by instructions and security obligations:

• Microsoft (Azure: infrastructure and Azure OpenAI models, in the European Union);
• Stripe (payments, subscriptions, tax calculation);
• the email provider through which we send the service's messages;
• Cloudflare (checking that whoever registers is a person, when on);
• the adviser who assists us with accounting and invoicing, and the public authorities to which disclosure is due by law (for instance through the Italian e-invoicing exchange system).

If you turn on web search, searches are run by Microsoft Bing, a service Microsoft does not cover with its data processing agreement. Data are not disclosed to the public.

Transfers outside the European Union

Data are processed within the European Union. When a provider processes them outside the European Economic Area, the transfer relies only on the safeguards of Chapter V GDPR (adequacy decisions of the European Commission or standard contractual clauses), about which you may ask us.

For how long

• Account and usage data: while the account exists; they are deleted with it.
• Data needed for invoicing, and accounting and tax records: 10 years, under Article 2220 of the Italian Civil Code and tax law, also after the account is deleted.
• Sign-in, registration and password-reset attempts: one day at most.
• Reports to support (with their screenshots) and error reports: 90 days from the last one sent, earlier if you delete the account; only support staff read them.

When the period ends, data are deleted or anonymised.

Automated decisions

We take no decision based solely on automated processing, including profiling, that produces legal effects on you or similarly significantly affects you. Vemploy's AI works on your behalf, on the tasks you give it.

Your rights

You may exercise at any time the rights of Articles 15–22 GDPR: access, rectification, erasure, restriction, portability, and objection to processing based on legitimate interest. From the Account page you can also download your data and delete your account yourself. Write to privacy@velion.it: we answer without undue delay and in any case within one month, extendable by two months in the cases of Article 12 GDPR.

You also have the right to lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali) or the supervisory authority of your country, without prejudice to judicial remedies.

Updates

This notice may change following changes in the law, our organisation or the service. Material changes are announced by email and require a new acceptance from the account page.