Privacy Policy

Last updated: November 9, 2026

Velia is a personal assistant that lives in WhatsApp. To be useful it reads and writes in accounts that belong to you: your calendar, your email, your children’s school portal. That is a lot of trust, so this policy tries to be specific rather than reassuring: what we touch, who else sees it, how long we keep it, and what you can demand from us.

It covers the assistant — whether you reach it by WhatsApp, Telegram or the Velia app — and this website. Last updated: 29 September 2026.

Who is responsible
What we collect
What we use it for
On what basis
The accounts you connect
Google data and Limited Use
Who we share it with
Children’s and school data
How long we keep it
How we protect it
The risks of an assistant that acts for you
Where it is processed
Your rights
Deleting everything
The website, the app and cookies
Changes to this policy
Contact

1. Who is responsible

In short: Hi Luma LLC, and you write to info@luma-agency.com.

Hi Luma LLC, a limited liability company organised in Wyoming, United States, with its registered agent at Registered Agents Inc., 30 N Gould St Ste R, Sheridan, WY 82801, is the controller of your personal data.

For anything related to personal data, including exercising your rights: info@luma-agency.com.

2. What we collect

In short: what you tell the assistant, what is in the accounts you connect, and little else.

Who you are. Your name, the phone number you write from and — if you use Telegram — your identifier there. The names of the people in your household that you register, and each one’s role. Your time zone and your preferred language.

What you tell the assistant. The content of your conversation: text, photos, documents, voice notes and videos you send. Voice notes are transcribed to text so they can be understood. We also keep a summary of earlier conversations, which is what lets the assistant remember your household’s context.

What the assistant remembers. Facts you ask it to keep, or that it infers from the conversation: preferences, birthdays, contact names, allergies. Every time it saves one, it tells you.

What is in the accounts you connect. Only after you connect them, and only to do what you ask: calendar events, email (sender, subject, and the body when you ask to read one), school portal messages and notices, and school-bus updates. Section 5 breaks this down account by account.

What you record. Expenses, budgets, debts, reminders, lists and to-dos you ask the assistant to keep.

If you use the Velia app. The phone number you sign in with (we text it a one-time code), the device’s model, operating system and app version, and — if you allow notifications — the push token Apple or Google assign to it. The photos, files and audio you choose to send. The app does not read your location, your contacts or your photo library beyond what you pick, and it carries no advertising identifiers or third-party analytics.

Sensitive information. Some of what you tell Velia is sensitive by nature: an allergy, a medication reminder, a medical appointment, what you spend and what you owe. We treat it as such: it is used only to do what you asked, it gets the protections in section 10, and it is deleted on the same schedule as everything else. Velia never asks for your bank or card passwords, and we ask you not to send them.

Technical data. Operational records: when a turn happened, how long it took, which tool ran and whether it failed. They keep the service running and meter usage. Our logs redact personal data by default — a phone number keeps its last four digits, an email address only its domain.

What we do NOT do. We do not sell personal data. We do not use it for advertising. We do not train models on your conversations, and the model providers we use operate under commercial API terms under which your data does not feed their training. We do not process card payments or store card data: when billing exists, a specialised payment processor will handle it and we will never see the number.

Aggregated and de-identified data. We may derive statistics that cannot reasonably be linked back to you or your household — how many reminders were set in a month, how long a turn took on average — to run and improve the service. We keep that data de-identified and do not attempt to re-identify it.

3. What we use it for

In short: to do what you ask, tell you what you asked to be told, and keep the service alive and safe.

Running the service: understanding your message, performing the action, answering you.
Remembering your household’s context so you are not asked the same thing twice.
Proactively telling you what you configured: reminders, due dates, important email, school messages.
Keeping the service secure and preventing abuse.
Metering usage for billing and spend caps.
Meeting legal obligations and responding to valid requests from authorities.

4. On what basis

In short: you authorise us, and you can withdraw it whenever you want.

Velia is provided from the United States and used from outside it, so the law that protects you depends on where you are. The common ground everywhere is your prior, express and informed authorisation: by writing to the assistant and connecting an account, you authorise the processing described here.

In addition, where processing is necessary to perform our contract with you or to comply with a legal duty, those are the applicable bases in jurisdictions that recognise them — the GDPR in the European Union and the United Kingdom, for instance.

Where your country imposes additional requirements, we meet those too. In Colombia, for example, Law 1581 of 2012 and Decree 1074 of 2015.

You may withdraw your authorisation at any time, by telling the assistant or writing to info@luma-agency.com. Withdrawing it means we can no longer provide the service.

5. The accounts you connect

In short: they are your credentials, with your permission, and you can revoke them at the provider without going through us.

Velia has access to nothing of yours until you connect an account. Each connection happens through a single-use link that expires in 24 hours; passwords never travel through the chat.

Account	What it reaches	What for
Google (Gmail)	Read, search, send and archive mail	Triaging your inbox, flagging what matters, drafting and sending when you approve
Google Calendar	Read and write events	Checking your agenda and scheduling what you ask
Microsoft / Outlook	Mail and calendar	The same, for Microsoft 365 accounts
Apple iCloud (CalDAV)	Read and write events	The same, for iCloud calendars
School portal (Phidias)	Messages, notices, grades and attendance for your children	Telling you what the school sent, and replying when you approve
School bus (TEM)	Route updates and payment status	Telling you about the route and the due date. Velia never pays: it hands you the link
Subscribed calendars (ICS)	Read only	Seeing a calendar shared with you

What we do with credentials. We store them encrypted (section 10) and use them only for the actions you ask for. We share them with no one.

How to cut off access. You can disconnect an account by asking the assistant, and you can also revoke it directly at the provider, without involving us: Google, Microsoft, Apple (revoking the app-specific password).

6. Google data and Limited Use

In short: we comply with Google’s Limited Use policy. Your email trains nobody.

Velia’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically:

We use Gmail and Google Calendar data only to provide the features you asked for.
We do not transfer it to third parties except to provide the service, when required by law, or with your express consent.
We do not use it, and do not allow it to be used, to train generalised AI models.
No human reads your email, unless you ask us to in order to resolve a problem, it is necessary for security, or the law requires it.

In short: with the providers that make the service work, and nobody else.

We do not sell or rent your data. We share it only with the processors we need in order to operate, each limited to its part:

Provider	What it receives	What for	Policy
Anthropic	The content of the turn the assistant needs to understand	The model that reasons and writes	View
Amazon Web Services	Everything stored (database, backups, servers)	Hosting and infrastructure	View
Twilio	Your number, WhatsApp messages and app sign-in codes	The channel, and the SMS login code	View
Telegram	Your identifier and messages, if you use that channel	Alternative channel	View
Groq	The audio of your voice notes	Transcribing them to text	View
OpenAI	The text of the reply, when you ask for voice	Generating the spoken answer	View
Google	Your mail and calendar, if you connect them	Doing what you ask in those accounts	View
Microsoft	Your mail and calendar, if you connect them	The same	View
Apple and Google	The push token and notification text, if you use the app	Delivering the app’s notifications	Apple · Google

What you ask Velia to send. When you approve an email, a message to someone or a reply to the school, its recipient receives what you approved. From then on it is in their hands and under their own policies, as with any message you send yourself.

Links to other sites. Velia and this site may point you to pages we do not control — a payment link, a school notice, a provider’s site. Their privacy practices are theirs; read their policies.

We may also disclose data if a competent authority requires it through a valid request, or where necessary to defend rights against fraud or a security risk. If the company merges or is acquired, your data would remain subject to this policy until we notify you of a change.

8. Children’s and school data

In short: Velia is not for children. It processes your children’s data because you ask it to, and with particular care.

The service is intended for people over 18. We do not collect data from minors who contact us directly, and we do not provide the service to them. If we learn that a minor — in particular a child under 13 — has given us personal data directly, we delete it.

That said: if you connect the school portal, Velia processes data about your under-age children — their name, their grade, their marks, their attendance and the messages the school sends about them. It does so because you, as their legal guardian, ask for it and authorise it, and only in order to give that information to you.

Laws protecting children’s and adolescents’ data — among them Law 1581 of 2012 in Colombia — require that such processing serve their best interests and respect their fundamental rights. We handle this data to that standard wherever you are, not only where a law compels it. So with it:

It is used for nothing other than informing you.
It is not shared with third parties beyond the processors in section 7.
It is deleted when you disconnect the school or delete the account, along with everything else.
Your child, or their other legal guardian, may exercise the rights in section 13 over it.

9. How long we keep it

In short: content expires after 90 days; what you record lives as long as your account does.

The cleanup runs on its own, hourly, and does not depend on anyone remembering.

What	How long
Conversation with the assistant	90 days, and only what is already folded into the summary
Email index (sender and subject)	90 days, except what you flagged for follow-up
Form responses	90 days
Messages between Velia users	90 days
Drafts awaiting your approval	Expire in 12–24 hours; deleted after 30 days
Operational and diagnostic records	Between 30 and 180 days depending on type
What you record (expenses, reminders, facts, contacts)	As long as you have an account, until you delete it
Credentials for connected accounts	Until you disconnect the account or delete the account
App push tokens	Until you sign out of that device or it stops responding

Encrypted backups are kept for a limited time by rotation; deleted data disappears from them when the backup holding it rotates out.

10. How we protect it

In short: here is what exists, specifically. No system is infallible and we are not going to tell you ours is.

Encryption. The credentials for the accounts you connect — school passwords, Google and Microsoft tokens, Apple app-specific passwords — are stored encrypted with AES-256-GCM, not in plain text. The database and the servers’ disks are encrypted at rest. Traffic travels over TLS end to end, and the database connection verifies the certificate against a pinned authority.

Backups. The copy that leaves the machine is encrypted with a different key from the one above, kept separately. The code refuses to upload an unencrypted backup: if the key is missing, nothing leaves.

Credentials never go through the chat. We will never ask you for a password over WhatsApp. To connect an account we give you a single-use link that expires in 24 hours and dies after five failed attempts.

Separation between households. Your family’s identity is derived in code from who is authenticated, never from something the model can choose. A query that tries to read another family’s data is refused, and automated tests fail if that barrier breaks.

Nothing irreversible without your permission. Sending an email, writing to a third party or deleting something requires your confirmation in a genuinely new message. A confirmation the model gives itself does not count: the code prevents it.

Third-party content is data, not instructions. An email, a school message or a document somebody sends you may contain instructions written to manipulate the assistant. Everything arriving from outside is marked as external content and the assistant is forbidden from obeying it. Processes that run without you present have read-only tools.

No false confirmations. The assistant cannot tell you it did something it did not do. That is verified in code, not left to its judgement.

Logs without personal data. Our logs redact phone numbers, email addresses and credentials by default.

What we do not have. We have no SOC 2 or ISO 27001 certification. We are a small team and we would rather say so than imply otherwise.

11. The risks of an assistant that acts for you

In short: an assistant that can send, schedule and delete can also get it wrong. Here is where, what we do about it, and what we ask of you.

Velia does not only answer: it acts in your accounts. That brings risks a search engine does not have, and we would rather name them than bury them:

Unintended actions. It can misread an instruction and propose the wrong action — an email to the wrong person, an event on the wrong day. That is why anything irreversible or directed at someone else waits for your yes in a new message, and why that draft is exactly what goes out.
Wrong or incomplete answers. A summary can leave something out, a transcription can mishear, a date can be misread. Check at the source anything that matters.
Manipulation from outside. Someone can write an email or a document designed to trick an assistant into doing something. Velia treats everything that arrives from outside as data, never as instructions, and processes that run without you present cannot write anything.
The conversation is the key. Whoever has access to your WhatsApp, Telegram or the app on your phone can instruct Velia as though they were you. Protect that access as you would your email.

The safeguards are in section 10 and in the terms. None of them removes the need for you to read what Velia proposes before you approve it.

12. Where it is processed

In short: in the United States.

Our servers and our database are in the United States (Amazon Web Services). The providers in section 7 also operate there or in other jurisdictions.

If you are outside the United States, using Velia involves an international transfer of your data into it. You authorise it by accepting this policy, and we undertake to require from our processors a level of protection equivalent to what this policy promises.

Where your law requires a specific basis for that transfer, we apply the one that fits: article 26 of Law 1581 of 2012 in Colombia, or the standard contractual clauses for the European Economic Area and the United Kingdom.

13. Your rights

In short: know, update, correct and delete — wherever you live.

For everyone, in any country. We give these rights to every user, whether or not your local law requires them:

Know what data of yours we process and how.
Update and correct it when it is incomplete or wrong.
Delete it, unless a legal duty requires us to keep it.
Take it with you, in a machine-readable format.
Request proof of the authorisation you gave us.
Withdraw that authorisation and close your account.

Many of these you can exercise by telling the assistant directly: ask it to forget a fact, delete an expense, or disconnect an account. For the rest, write to info@luma-agency.com. We answer any request within fifteen business days, wherever you are.

If you are in Colombia. Law 1581 of 2012 applies: you may complain to the Superintendency of Industry and Commerce, and the statutory deadlines are ten business days for enquiries and fifteen for complaints, extendable once.

If you are in the European Union or the United Kingdom. You also have the right to object to processing, to restrict it, not to be subject to automated decisions with legal effects, and to complain to your data protection authority.

If you are in the United States. Some states — California, Virginia, Colorado, Connecticut, Texas and others — give their residents specific privacy rights. We honour them for every US resident, whichever state you live in:

We do not sell personal information and do not share it for cross-context behavioural advertising, as those laws define those terms. We have not done so in the last twelve months.
We do not use your data for targeted advertising or for profiling that produces legal or similarly significant effects.
We use sensitive information only to provide the service you asked for.
You may know, access, correct, delete and take your data, and you will not be treated worse for exercising any of these rights.
You may act through an authorised agent; we will verify their authority and your identity.
If we deny a request, you may appeal by replying to our answer, and we will respond within the period your state’s law sets.

If you are somewhere else. If your local law gives you rights beyond the list above, write to us and we will honour them too. We are not going to ask you to prove your country obliges us.

14. Deleting everything

In short: it is really deleted, across every table, and the identifier is never reused.

You can request deletion of your account by telling the assistant or writing to info@luma-agency.com.

When an account is deleted, the deletion sweeps every table that holds anything about you or your household — conversation, facts, expenses, reminders, credentials, plans — rather than a hand-written list someone could forget to update. We also revoke any Google tokens we hold, and the identifier is tombstoned so a future account can never inherit anything of yours.

The only things that survive are what the law requires us to keep, and encrypted backups until they rotate out.

15. The website, the app and cookies

In short: neither this site nor the app tracks you.

Today hivelia.ai is a presentation page. It uses no analytics or advertising cookies and loads no third-party scripts. If we add analytics later, it will be behind a prior consent notice and will not run until you accept it. The Velia app has no analytics or advertising SDKs either.

Do Not Track and Global Privacy Control. Since we do not track you across sites or sell your data, there is nothing for those signals to switch off today. If that ever changes, we will treat a Global Privacy Control signal as a valid opt-out.

If you write to us through the contact form, we process your name, your email and your message in order to reply.

16. Changes to this policy

If we change something material — a new purpose, a new processor, a different retention period — we will announce it through the same channel you use the assistant on before it takes effect, and update the date in the header. Minor changes are published here.

17. Contact