Privacy Policy

Veldun (“we,” “us,” “our”) provides a membership management platform for small organizations. This policy explains what data we collect, how we use it, and your rights regarding that data.

Account information. When you sign up, we collect your name, email address, and organization name. If you invite members, we store their names and email addresses as provided by your organization.

Usage data. We collect standard analytics: pages visited, features used, browser type, and device information. This helps us understand how the product is used and where to improve it.

Payment information. Dues payments are processed by Stripe. We do not store credit card numbers or bank account details. Stripe handles all payment data under their own privacy policy.

Content you create. Events, emails, member records, and documents you create within Veldun are stored on our servers to provide the service.

We use your data to:

• Provide and maintain the Veldun platform
• Process membership dues and event payments via Stripe
• Send transactional emails (confirmations, reminders, receipts)
• Power AI features (event creation, newsletter assembly, renewal alerts)
• Improve the product based on aggregate usage patterns
• Respond to support requests

We do not sell your data. We do not use your data for advertising. We do not share member lists with third parties. And we do not use your data to train AI models - not ours, and not our providers', who are contractually barred from training on what we send them.

Veldun uses the following third-party services to operate:

• Amazon Web Services (AWS) - hosting, database, file storage, and background job processing
• Stripe - payment processing for membership dues and event fees
• Resend - transactional and campaign email delivery
• Anthropic (Claude API) - AI features including event creation, newsletter assembly, and renewal intelligence. Content sent to Claude is processed according to Anthropic's data usage policy and is not used to train their models.
• Sentry - error monitoring and performance tracking
• Cloudflare - DNS and static website hosting for organization public sites
• Google - two separate things. Google Analytics measures how the marketing site and dashboard are used, and only runs if you agree to it (see Cookies below). Separately, when an administrator asks the platform to generate a cover image for an event or a newsletter, we send Google's Gemini image model the organization name and the title and description of the item being illustrated, so it has something to work from.

We retain your data for as long as your account is active. If you cancel your account, we keep your organization's data for 30 days - so you can still request an export - and then delete it permanently. Backups roll off within a further 30 days.

Payment records processed through Stripe are retained according to Stripe's data retention policies and applicable financial regulations.

You have the right to:

• Export your data. Download your member list, event history, and email records at any time from your dashboard.
• Delete your data. Request complete deletion of your organization's data by emailing us.
• Correct your data. Update your account information and member records directly in the platform.
• Restrict processing. Request that we limit how we use your data.

If you are located in the European Economic Area, you have additional rights under the GDPR. Contact us to exercise any of these rights.

Data is encrypted in transit (TLS) and at rest (AES-256). Database access uses IAM authentication. All file uploads use signed URLs with expiration. We follow AWS security best practices for infrastructure management.

Your data is stored and processed in the United States, on Amazon Web Services in the US-East region. That does not change.

Veldun is a small team, and the people who operate and support the platform work from outside the United States - currently the United Arab Emirates and India. They reach your data by logging in remotely to that same US environment, under named accounts with role-based, need-to-know access, and every access is logged. We do not copy or cache your data onto devices outside the United States, and we do not use a support provider outside the United States without telling the organization first.

We say this plainly because it is the sort of thing an organization's counsel asks about, and the honest answer is better than a vague one.

Essential cookies. These keep you signed in, remember which organization you are looking at, and record the cookie choice below so we stop asking. They are set whatever you decide, because the product does not work without them.

Analytics cookies, if you agree. We ask before setting these. Say yes and Google Analytics records which pages are visited and which features get used, which is how we decide what to build next; we also set a first-party cookie recording how you first arrived (a search engine, a link, a campaign) so a signup can be attributed to it. Say no and neither is set, and nothing is sent to Google. You can change your mind by clearing cookies for this site, which brings the question back.

We do not use advertising cookies, and we do not let anyone use what we collect to target you elsewhere.

We may update this policy as our practices evolve. We will notify account administrators by email of any material changes before they take effect.

For privacy questions or data requests, email privacy@veldun.com. We respond to every inquiry within 24 hours.