Privacy

Overview

Vraelis checks whether a deployed web application does what someone says it does: you describe what it should do in a sentence, approve the plan Vraelis writes from it, and a real browser runs that plan against your live deployment and captures the evidence. This page explains how data is handled when you use the website, app, verification runs, API, webhooks, and exports at vraelis.com. We have kept it plain and specific to what the product actually does.

Data we collect

• Account details: your name, email, and which sign-in provider you used (email, Google, or GitHub).
• Applications you connect: names, deployment URLs, environment and build metadata, and the requirements and verification flows you define.
• Connection data for integrations you link (provider metadata and OAuth tokens), and test-account sign-in credentials you provide for verification runs, stored encrypted (AES-256-GCM) and used only to execute your verifications.
• Verification data: the runs Vraelis executes against your application, the evidence they capture, and the results and decisions generated from them.
• API key metadata: a key's name, prefix, scopes, created date, and last-used time. The full key is shown once at creation and stored only as a hash.
• Webhook endpoint URLs and delivery logs, including status, timestamps, and response or error details.
• Plan, balance, billing, and subscription records, and checkout and payment status.
• Support and contact messages you send us.
• Usage, security, and abuse-prevention logs.
• IP addresses used to limit abuse. The contact form keeps the IP address as a rate-limit key, as described under Contact form below. We do not show raw IP or device data in reports.

How we use data

• Operate the product and your account.
• Run verification against your connected applications and capture the resulting evidence.
• Generate reports and enable exports, webhooks, and the API.
• Manage plans, balance, billing, and checkout.
• Prevent spam, fraud, and abuse.
• Keep the service reliable and secure.
• Respond to support, privacy, and account requests.
• Only if you turn them on in Privacy choices: measure how fast pages load, count anonymous visits, and report a sign-up to an advertising platform so we can see whether an ad worked.

Cookies, browser storage, and your choices

Vraelis uses the cookies and browser storage the service needs to work: keeping you signed in, protecting sign-in and payments, and remembering your privacy choice. Three further categories are optional and stay off unless you turn them on: preferences, analytics, and advertising measurement. The first time you visit, Vraelis asks you to choose, and “Essential only” is always one click. You can read this policy and the other legal pages before choosing.

Your choice is saved in a cookie called vraelis_privacy for six months and applies on vraelis.com and app.vraelis.com. Change it at any time from Privacy choices, in the footer of every page, under the sign-in form, and in the console sidebar. Turning a category off removes what it stored in your browser and stops it from storing or sending anything more. The cookie policy lists every cookie and storage item, who sets it, what it does, and how long it lasts.

If your browser sends a Global Privacy Control signal, Vraelis treats it as an opt out of every optional category for as long as the signal is on. The page checks it before loading anything optional, and the server checks it before reporting a sign-up.

Payments

Payments are processed by Stripe. Vraelis does not store full card numbers. We may retain billing records where needed for accounting, fraud prevention, or legal reasons.

Report access

Reports are private to your account and team. There are no public report links. A workspace can grant a read-only client-viewer role, which can see reports but cannot change anything or reach private workspace controls. A report never exposes your account email, billing data, API key secrets, raw IP or device data, or private owner fields.

API keys and webhooks

• Treat API keys as secrets. The full key is shown once at creation; after that we display only its metadata (name, prefix, scopes, and dates).
• API keys are stored as a hash, not in plain text.
• Webhook delivery logs may store the delivery status, timestamps, endpoint URL, and response or error details.
• Webhook events are signed so your app can verify they came from Vraelis.

Vendors and processors

We use a small set of service providers to run Vraelis. They process data on our behalf to operate the service. By category:

• Hosting, database, and storage providers.
• Authentication providers, for email, Google, and GitHub sign-in.
• Payment processing, handled by Stripe.
• Email delivery, for sign-in verification and account messages.
• Security, logging, and monitoring tools.
• Performance measurement by Vercel Speed Insights, only if you turn on Analytics.

If you turn on Advertising measurement, Meta also receives the sign-up report described in the cookie policy. With it off, nothing is sent to Meta.

California privacy notice

If you are a California resident, this section describes how Vraelis handles personal information. We are a small product and may not meet the thresholds that trigger every California privacy obligation, but we want to be transparent.

• Categories of personal information we collect: identifiers such as name and email; account and authentication data; commercial information such as plan, balance, and billing or payment status; internet and usage activity such as verification activity and logs; and limited inferences used only for abuse detection.
• Purposes: to operate the product, run verification, generate reports, manage billing, prevent abuse, and provide support.
• Sources: directly from you, automatically as you use the product, and from your sign-in and payment providers.
• Service providers and third parties: hosting, database, authentication, payments (Stripe), email, and security or logging providers, used to operate the service; and Meta, only if you turn on Advertising measurement.
• Rights that may apply: to know or access the personal information we hold, to request deletion, to request correction, to opt out where applicable, to limit the use of sensitive information where applicable, and to not be discriminated against for exercising these rights.

Vraelis does not sell personal information. It shares personal information for cross-context behavioral advertising only if you turn on Advertising measurement, and then only this: when you create an account, a hashed copy of your email address goes to Meta with a note that a sign-up happened. It is off unless you turn it on, you can turn it off at any time from Privacy choices, and a Global Privacy Control signal turns it off automatically.

If California privacy rights apply to you, contact us at [email protected] to request access, deletion, correction, or other available rights. Requests are reviewed manually.

EU, EEA, and UK privacy rights

If you are in the EU, EEA, or UK, this section describes your privacy rights. It is a plain explanation of how we handle your data and how to reach us, not a claim of full regulatory compliance.

Controller and contact: Vraelis, reachable at [email protected].

We process data to provide production verification, reports, the API, webhooks, exports, billing, and support, and to keep the service secure. In plain terms, the lawful bases we rely on are:

• Contract, to provide the service you sign up for.
• Legitimate interests, to secure the product and prevent abuse.
• Consent, for the optional cookie categories (preferences, analytics, and advertising measurement). You can withdraw it at any time from Privacy choices.
• Legal obligations, for billing, tax, and accounting where needed.

Your rights include access, correction, deletion, restriction, portability, objection, withdrawing consent where applicable, and complaining to a supervisory authority. Data may be processed in the United States or by United States based providers.

Retention

• Account, verification, and report data is kept while your account is active, unless you delete it or ask support to handle a request.
• API keys can be deleted, and webhook endpoints can be removed.
• Billing records may be kept where required for accounting, fraud prevention, or legal reasons.
• Rate-limit records, which hold an IP address or an email address with a count and a start time, are kept in our database to limit abuse. Nothing deletes them automatically at present; a record is reset when the same address is used again after its time window.
• Our hosting provider (Vercel) keeps request logs for the period its logging plan sets. If the rate limiter fails, the error it logs can include the IP address or email address it was checking.

Contact

Questions about privacy or your data? Email [email protected].