Privacy notice

Veldarium Technology Systems LLC (“Veldarium”, “we”) operates the public website at www.veldarium.com, its synthetic demonstrations, the contact address chris@veldarium.com, and the invitation-only application reached from the sign-in page. This notice covers all of them. Where a signed agreement governs a workspace in the application, that agreement controls for that workspace’s data.

• Email you send. The site has no form, newsletter or public sign-up. The only way to send us information is an email to chris@veldarium.com. We receive what you write: usually your name, address and message, and anything you attach.
• Analytics events. A fixed list of events (for example, that a page was viewed or a control on a demonstration was moved), each carrying only the properties a shared contract in the code allows: stable identifiers and bounded values such as a route, a scenario or a control name. The server rejects anything else. With each event it stores the page path, the host name of the referring site (not the full address), any utm_source, utm_medium, utm_campaign and utm_content tags in the link you followed, a device class (mobile, tablet or desktop) worked out from your browser’s user-agent string, a random session identifier and the time. It does not store your IP address, the user-agent string, your name, your email address or anything you type.
• Vercel Web Analytics and Speed Insights, on the production site only. Web Analytics counts page views and reports them to us in aggregate by page, referring site, campaign tag, browser, operating system, device type and country. Speed Insights measures how quickly pages load and respond. We see both as aggregate dashboards, joined to nothing else we hold.
• Abuse-prevention counters. To rate-limit sign-in and the analytics endpoint, the server counts requests under a keyed one-way hash of your network address (at sign-in, also of the account being signed into). The raw address is never stored.
• Hosting requests. Every request reaches our host with your IP address, browser details, the page requested and the referring page. Vercel processes this to serve and protect the site.
• The demonstrations run on synthetic records built into the site: the fictional vessel program VS-001 and its work packages. Nothing you do in them is stored beyond the analytics event that a control was moved.
• The signed-in application, for invited users only: your account email, a scrypt hash of your password or your single-sign-on identity, your roles and workspace memberships, your session, the content you and your colleagues add to a workspace, and a record of the actions taken in it with the account that took each one.

• to answer the email you sent and continue the conversation you started;
• to learn, in aggregate, which pages and demonstrations are read and where visitors come from;
• to keep the site fast, available and protected from abuse;
• to run the signed-in application for the people invited to it;
• to meet a legal obligation, where one applies.

Where data-protection law asks for a lawful basis, the analytics described here rest on our legitimate interest in learning, in aggregate, how the site is read and in keeping it fast and available. You can object at any time with the analytics opt-out under Your rights and choices, or by email to chris@veldarium.com.

We do not sell personal information, share it for cross-context behavioral advertising, or build advertising profiles. The site carries no advertising pixel and no third-party tracker.

The public site sets one cookie, and only while the analytics event log is running:

• veld_funnel_session: a random identifier that ties one browser’s analytics events together, so a page view and a later click count as one visit without anyone knowing whose. HttpOnly, Secure, SameSite=Lax, first-party only; it expires after 90 days.
• In the signed-in application only, set when you sign in: veld_session and veld_session_sig (your session and its signature, HttpOnly, 24 hours), oidc_state and oidc_nonce (the single-sign-on handshake, 10 minutes) and veld_workspace (the workspace you last opened, an identifier, 365 days).
• Browser storage. If you opt out of analytics (see Your rights and choices), veld_internal_analytics_off is kept in your browser’s local storage, and if you pause the site’s films, veldarium.films keeps them paused on later pages and visits. The signed-in application keeps short-lived interface state in session storage, which the browser clears when the tab closes.

There are no advertising or cross-site cookies.

• Email: as long as the conversation needs, and after that only where a security or legal reason requires it. The inbox has no automatic deletion schedule; ask, and your messages are deleted unless the law requires us to keep them.
• Analytics events: deleted automatically once they are more than 13 months old.
• The analytics cookie: expires after 90 days.
• Abuse-prevention counters: expire 60 minutes after their counting window closes and are deleted by a later sweep.
• Vercel Web Analytics, Speed Insights and hosting logs: kept by Vercel for the period its service sets. We do not copy them into our own database.
• The signed-in application: a session ends after 24 hours or when you sign out. Account and workspace data has no automatic deletion schedule; it is kept while the account exists and deleted on request, subject to any agreement that governs the workspace.

These companies process personal information on our behalf, under their own terms and only to provide their service to us:

• Vercel hosts the website and the signed-in application, serves every request, and runs Web Analytics and Speed Insights on the production site.
• Supabase hosts the PostgreSQL database that holds the analytics event log, the abuse-prevention counters and the signed-in application’s data.

Email to chris@veldarium.com is held by the provider that hosts the veldarium.com mailbox. If your organization signs you into the application through its own single-sign-on provider, that provider tells us who you are under your organization’s arrangement with it. Typefaces are served from this site, so loading a page sends nothing to a font provider.

Beyond the processors above, information is disclosed only:

• when the law, a court or a government request requires it, or to protect the rights, property or safety of Veldarium, its users or the public;
• in a merger, acquisition, financing or sale of assets, to a recipient bound to handle it consistently with this notice.

Depending on where you live, you may have the right to know what we hold about you, to receive a copy, to correct it, to delete it, and to object to or restrict its use. To exercise any of them, email chris@veldarium.com with the subject “Privacy request” from the address concerned. We may ask you to confirm the address is yours before acting, and we answer within the time the applicable law sets. You may also complain to the data-protection authority where you live.

• Analytics opt-out. Use the control at the end of this section, or open any page with ?veld_internal=1 added to its address. Your browser then keeps a marker that stops this site sending its own analytics events and Vercel Web Analytics page views from that browser, so no new visit cookie is set; the same control, or ?veld_internal=0, removes it. A visit cookie already set expires on its own date. Speed Insights load measurements are not affected.
• Blocking cookies or scripts. Public pages render on the server, so they can be read with cookies or JavaScript blocked; the interactive demonstrations need JavaScript to respond.
• Global Privacy Control and Do Not Track. Nothing is sold or shared for advertising, so there is nothing for these signals to switch off, and the site does not read them.

The site is for businesses and industry and is not directed to children. We do not knowingly collect information from anyone under 13, or under 16 where local law sets that age. If you believe a child has sent us information, email chris@veldarium.com and it will be deleted.

Veldarium is a United States company. Information is processed in the United States, and our processors may also process it in other countries where they operate. If you write from outside the United States, your information leaves your country to reach us.

Information is protected by the measures on the security page. No method of transmission or storage is completely secure.

When this notice changes, the effective date above changes with it. The notice in force is always the one at this address.

Questions and requests about this notice or your information: chris@veldarium.com.