Legal

Privacy Policy

How Vellum Intelligence collects, uses, and protects your information.

Last updated: May 2026 · Vellum Intelligence Corp.

1. Who we are

Vellum Intelligence Corp. ("Vellum Intelligence", "we", "us", or "our") operates the website at vellumintel.com and provides AI-native intelligence services covering regulatory, policy, and compliance matters across digital and financial regulation. We are the data controller for any personal data you provide to us.

For all data protection enquiries, contact us at: [email protected]

2. What data we collect

We collect personal data only when you voluntarily provide it to us, or when it is generated as a necessary part of delivering our services. This includes:

Contact form submissions — name, organisation, email address, and the content of your message when you use our "Get in touch" form.
Client onboarding data — information you provide through our secure onboarding form, including organisational details, strategic priorities, and contact information.
Communications — the contents of emails or messages you send to us directly.
Technical data — if you consent to analytics cookies, we may collect anonymised information about how you interact with our website (pages visited, time on site, device type). This data does not identify you personally.
MCP add-on data — for subscribers who activate the add-on: the issued API key, tool-call metadata, timestamps, and a minimal record of the ecosystems and briefs queried. Vellum does not log the subscriber's broader conversation or other data held in the host application. Further detail is set out in Section 6 below.

We do not collect sensitive personal data (such as health information, political opinions, or financial data) through this website.

3. How we use your data

We use your personal data for the following purposes:

To respond to your enquiries and assess whether our services are a suitable fit for your needs.
To deliver intelligence services to clients who have engaged us.
To communicate with you about your account, our work, or relevant developments.
To improve our website and service offering, where you have consented to analytics.
To comply with applicable legal obligations.

4. Legal basis for processing

We rely on the following legal bases under UK GDPR and EU GDPR:

Legitimate interests — to respond to enquiries, deliver services to clients, and improve our operations, where these interests are not overridden by your rights.
Contract performance — to fulfil our obligations under any agreement with you or your organisation.
Consent — for optional analytics cookies, where you have given explicit consent through our cookie preference banner.
Legal obligation — where we are required to process your data to comply with applicable law.

5. Third-party processors

We use a small number of trusted third-party services to operate this website and our services. Each processes data only as necessary for the specified purpose:

Formspree (formspree.io) — processes contact form submissions and securely routes them to our team. Formspree is subject to its own privacy policy at formspree.io/legal/privacy-policy.
Cloudflare — provides security, performance, and bot-protection services for this website. Cloudflare may process limited technical data (such as IP addresses) to deliver these functions. See cloudflare.com/privacypolicy.
MCP host provider — the provider of the MCP-enabled application chosen by the subscriber may process tool calls and returned content under its own privacy policy, contractual terms and security controls. Further detail is set out in Section 6.

We do not sell, rent, or share your personal data with any other third parties for marketing or commercial purposes.

6. MCP add-on

Vellum offers a remote Model Context Protocol (MCP) integration as part of selected ecosystem subscriptions. It allows subscribers to query subscribed Vellum content from supported MCP-enabled host applications. This section describes the data handling that applies when the add-on is activated.

6.1 What is processed

When a subscriber configures a supported host application to use the Vellum MCP service, the following data is processed:

Authentication credential — the API key issued to the subscriber, transmitted with each tool call to authenticate the request and verify the subscriber's entitlements.
Tool-call metadata — the Vellum tool called, the parameters supplied to it, the subscriber identifier and a timestamp.
Response content — the Vellum ecosystem or brief content returned in response to the call, limited to the subscriber's entitled ecosystems.

Vellum does not log, store, or have access to the subscriber's broader conversation or to documents, emails, calendar items, files, or other data held in the host application. The integration exposes read-only Vellum tools and cannot read from, write to, or otherwise act on other data in that environment.

6.2 The data flow

The subscriber configures a supported host with the Vellum MCP service address and subscriber credential. When the host calls a Vellum tool, Vellum authenticates the request, checks the subscriber's entitlements, retrieves the relevant published content and returns it to the host. The chosen host provider handles its side of that interaction under its own terms, privacy policy and security controls. The relationship governing subscriber-side data in that host is between the subscriber and the host provider.

6.3 No use of subscriber data for AI training

Vellum does not use data processed through the MCP add-on — including tool calls, parameters, response content or inferences from usage patterns — to train, fine-tune or otherwise develop AI models.

6.4 Retention

Tool-call metadata logs are retained for up to 90 days for operational monitoring, security incident investigation and entitlement enforcement. After 90 days, individual tool-call logs are deleted; aggregated and anonymised usage metrics may be retained for longer to operate and improve the service.

Response content is drawn from Vellum's existing editorial library and is not separately stored by Vellum as a persistent per-call copy.

6.5 Security

API keys are issued per subscriber and tied to plan entitlements. Subscribers are responsible for protecting their keys; an exposed key can be revoked and reissued by contacting [email protected]. Vellum applies HTTPS in transit, authentication checks on every call and rate limiting.

6.6 Subscriber controls

Subscribers may disable the Vellum connection in their host application, ask Vellum to revoke their API key, request a copy of associated tool-call metadata, or request earlier deletion of those logs, subject to the rights in Section 9. Removing the MCP add-on does not affect the underlying ecosystem subscription.

7. Data retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:

Contact form enquiries that do not lead to an engagement are retained for up to 12 months.
Client data is retained for the duration of the engagement and for a reasonable period thereafter (typically 3 years) for record-keeping and legal compliance purposes.
Analytics data, where collected, is retained in anonymised or aggregated form only.
MCP add-on tool-call metadata is retained for up to 90 days, as further set out in Section 6.4.

8. Cookies

This website uses cookies in two categories:

Essential cookies — strictly necessary for the website to function (e.g. security and session management). These cannot be disabled.
Analytics cookies — used to understand how visitors interact with the site in order to improve it. These are only set if you choose to "Accept" via our cookie consent banner. You may withdraw consent at any time by clearing your browser cookies.

We do not use advertising, tracking, or social media cookies.

9. Your rights

Under UK GDPR and EU GDPR, you have the following rights regarding your personal data:

Right of access — to request a copy of the personal data we hold about you.
Right to rectification — to request correction of inaccurate or incomplete data.
Right to erasure — to request deletion of your personal data, subject to our legal obligations.
Right to restriction — to request that we limit how we use your data in certain circumstances.
Right to data portability — to receive your data in a structured, machine-readable format.
Right to object — to object to processing based on legitimate interests.
Right to withdraw consent — where processing is based on consent, to withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) in the UK at ico.org.uk, or with your local supervisory authority within the EU.

10. International transfers

Vellum Intelligence operates primarily from the United Kingdom. If any personal data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place, including reliance on adequacy decisions or standard contractual clauses.

For subscribers using the MCP add-on, tool calls may transit infrastructure operated by the subscriber's chosen MCP host provider. Processing locations and safeguards depend on that provider and the subscriber's arrangement with it. Vellum maintains appropriate safeguards with its own infrastructure providers.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we do, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Material changes affecting active subscribers will be communicated directly.

12. Contact

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at:

Vellum Intelligence Corp.
Email: [email protected]