Skip to content
VELQUARIA Local AI tools you own.
Get early access

Privacy Policy

Last updated: 26 October 2026

This policy explains what personal data velquaria.com processes and why. The short version: this site has no accounts, no analytics and no advertising trackers.

Who we are

Velquaria (Italy; company details coming soon) is the data controller. Person in charge of personal information protection (also for Québec Law 25): Andrea Sorci, [email protected]. Contact: [email protected].

What this site does not do

  • No user accounts and no payments on this site.
  • No analytics, no advertising or remarketing pixels, no social-media embeds.
  • Fonts, images and videos are served from our own domain, not from third-party CDNs. The free guide is sent by email through Substack (section 2 below).

Data we process

1. Technical logs (hosting)

velquaria.com is hosted on Cloudflare Pages (Cloudflare, Inc.). To deliver pages and protect the site from abuse, Cloudflare processes technical data such as your IP address, browser type, the page requested and the time of the request.

  • Purpose: delivering the site and keeping it secure.
  • Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR).
  • Retention: we do not receive the raw server logs; Cloudflare keeps them for a limited period under its Data Processing Addendum ([X] days, to confirm with Cloudflare).
  • Cloudflare acts as our processor. Transfers outside the EU are covered by the EU–US Data Privacy Framework (Cloudflare is certified) and, as a fallback, the European Commission's Standard Contractual Clauses.

2. Early-access list and newsletter (Substack)

When you enter your email and press "Get early access", your browser is taken to our newsletter on Substack (velquaria.substack.com) with your email already filled in, so you can confirm the subscription there (double opt-in). The email address travels to Substack in the page address.

  • Who processes it: Substack, Inc., 548 Market Street PMB 72296, San Francisco, CA 94104, USA, runs the list on our behalf (our processor, under Substack's publisher terms) and is an independent controller for its own purposes (your Substack account, its own privacy policy). We see your email address, subscription date and status in our Substack dashboard.
  • Transfer outside the EU/UK: Substack is certified under the EU–U.S. Data Privacy Framework and its UK Extension (adequacy decision of 10 July 2023); if that certification lapses, Standard Contractual Clauses apply.
  • Purpose: sending the free guide, early access to our software, and occasional updates when something ships.
  • Legal basis: your consent (Art. 6(1)(a) GDPR).
  • Retention: until you unsubscribe. Every email has an unsubscribe link, and you can also ask us to remove you.

3. Emails you send us

If you write to us, we use your email address and message only to reply.

  • Legal basis: answering your request (steps at your request before a contract, Art. 6(1)(b)) or our legitimate interest in replying (Art. 6(1)(f)).
  • Retention: [24] months after the last message.

4. Contacts and leads (our own records)

We keep a list of people who asked for early access, wrote to us, met us at an event or asked for a consultation, on a computer in our office (name, email, where we met, status, notes).

  • Purpose: following up on your request and offering our software and services.
  • Legal basis: our legitimate interest in running the business (Art. 6(1)(f)); you can object at any time and we will stop (Art. 21(2)).
  • Retention: [24] months after the last contact, or until you object or unsubscribe.

Data stored in your browser

The site saves two preferences in your browser's local storage: light or dark theme (q_theme) and language (vel_lang). They stay on your device and are never sent to us. See the Cookie Policy.

Your rights

Under the GDPR you can ask to access, correct or delete your data, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time without affecting earlier processing. Write to [email protected]. We reply within one month.

You also have the right to lodge a complaint with a supervisory authority; in Italy this is the Garante per la protezione dei dati personali (garanteprivacy.it).

If you are outside the EU

  • United Kingdom. The UK GDPR and the Data Protection Act 2018 give you the same rights listed above. You can complain to the Information Commissioner's Office (ico.org.uk).
  • United States. We are a small business below the thresholds of the California Consumer Privacy Act and similar state laws. Our emails follow the CAN-SPAM Act: every message shows our postal address and an unsubscribe link, honoured within 10 business days. We do not sell or share personal information.
  • Canada. We follow PIPEDA and Canada's Anti-Spam Legislation: we email you only with your express consent (double opt-in on Substack), every message identifies us and lets you unsubscribe. Québec residents: our person in charge of personal information protection is Andrea Sorci, [email protected]. Complaints: Office of the Privacy Commissioner of Canada (priv.gc.ca) or the Commission d'accès à l'information du Québec.
  • Australia. We are a small business operator not covered by the Privacy Act 1988, but we apply the same principles described here. Our emails follow the Spam Act 2003: sent only with your consent, with our name and address and a working unsubscribe link.
  • Switzerland. The Federal Act on Data Protection (FADP, SR 235.1, in force since 1 September 2023) applies to situations that have an effect in Switzerland even if they occur abroad (Art. 3). We process your data in line with its principles (Arts. 6-8) and, where a justification is needed, on the basis of your consent, a contract with you or our overriding interest (Art. 31). You have the right of access (Art. 25), to receive the data you gave us in a common electronic format or have it transferred to another controller (Art. 28), to rectification and erasure and to object (Arts. 30-32). Some of our providers are outside Switzerland: the EU/EEA and the UK are recognised by the Federal Council as providing adequate protection (Art. 16(1) FADP; Annex 1 of the Data Protection Ordinance, SR 235.11); for the United States only companies certified under the Swiss-U.S. Data Privacy Framework are (since 15 September 2024), otherwise we use standard data protection clauses (Art. 16(2)). We have not appointed a representative in Switzerland (Art. 14): that duty applies only if the processing is, at the same time, large-scale, regular and high-risk, and ours is not. You can report a suspected breach to the Federal Data Protection and Information Commissioner (edoeb.admin.ch), who may open an investigation (Art. 49).
  • Brazil. The Lei Geral de Proteção de Dados (LGPD, Law 13,709/2018) applies to anyone offering goods or services to people located in Brazil (Art. 3, II). Our legal bases are consent, performance of the contract and legitimate interest (Art. 7, I, V and IX). You have the right to confirmation and access, correction, anonymisation, blocking or deletion of unnecessary or non-compliant data, portability, information on who receives your data, information on the possibility of refusing consent, and withdrawal of consent (Art. 18). We are in Italy and some providers are in other countries: the European Union and the European Economic Area are recognised by the ANPD as adequate (Art. 33, I LGPD; Resolução CD/ANPD No. 32 of 26 January 2026); for other countries we rely on the ANPD's standard contractual clauses (Art. 33, II; Resolução CD/ANPD No. 19 of 23 August 2024) or the other cases in Art. 33. We have not appointed an encarregado (Art. 41): for small-scale processing agents, Resolução CD/ANPD No. 2 of 27 January 2022 (Art. 11) does not require one, provided there is a contact channel: it is [email protected]. Complaints: Autoridade Nacional de Proteção de Dados (gov.br/anpd) (Art. 18, § 1).

Other things to know

  • We do not make decisions about you by automated means.
  • The site and the newsletter are not directed at children under 16 (under 13 in the United States); our software and paid plans are for adults (18+), see each product's own notice. If we learn we hold data of a child, write to us and we will delete it.
  • Links to other sites (for example GitHub or Substack) are governed by those sites' own policies.

Changes

We will update this page if what we do with data changes, and change the date at the top.