Vaelis
Legal

Privacy, terms & data processing

Plain-language pilot versions. Short on purpose.

Privacy Policy

Pilot version, 2026-08-14. This is a working document, not legal advice.

TopicPractice
What we processMedia you submit for verification (in memory only, never stored), server logs (IP, user agent, timestamps, request IDs), and pilot account email addresses.
What we storeEvidence files you explicitly request: content hashes, verdicts, timestamps, our signature. No media, no personal content.
Legal basisLegitimate interest (providing the verification service) and contract performance for pilot customers.
SharingNo sale or sharing of personal data. Sole subprocessor: Render (hosting, Frankfurt EU).
Your rightsAccess, erasure, objection: email hello@vaelistrust.com. Pilot accounts are deleted on request.

Terms of Service (pilot)

ClauseSummary
Pilot windowAll plans are free during the pilot programme. If paid subscriptions start, we will give pilot participants at least 3 months' advance notice; pilot participants lock in founding rates.
ServiceVerification of C2PA provenance and generation of evidence files, provided as-is during the pilot phase.
No verdicts of authenticityTrust Scores and verdicts are cryptographic-evidence signals for human judgment, not declarations that content is "real" or "fake".
Not legal adviceVaelis is a technical measurement tool. Nothing we produce — scores, verdicts, evidence files, documentation — is legal advice or a legal opinion.
No compliance guaranteeUsing Vaelis does not by itself make you compliant with the EU AI Act or any other law. Regulatory duties remain yours; our evidence files document checks performed, nothing more.
Evidence scopeEvidence files record what was measured, at a stated time, with stated validator versions and stated limitations. They are point-in-time technical records, not warranties.
Customer responsibilitiesYou are responsible for how you act on our output: labelling decisions, disclosures, and filings are yours.
Fair useRate limits apply; abuse or attempts to probe internal networks via URL fetches result in suspension.
Limitation of liabilityTo the maximum extent permitted by law: no indirect or consequential damages (including regulatory fines arising from your own disclosure decisions). Paid tiers: aggregate liability capped at the fees you paid in the 12 months before the claim. Pilot (free) tier: no liability at all.
No third-party relianceEvidence files are issued to the named customer alone. No regulator, platform, or other third party may rely on them as a certification of anything.
IndemnificationWe indemnify you only for third-party IP-infringement claims against the API itself. You indemnify us for content you submit and decisions you make from our output.
Claims windowAny claim against us must be brought within 12 months of the event giving rise to it.
No indemnity (pilot)We do not indemnify pilot users. Enterprise customers may negotiate indemnities in their order form.
ChangesWe notify by email before material changes.

Data Processing summary (GDPR Art. 28)

ElementPosition
Controller / ProcessorCustomer is controller; Vaelis is processor for verification traffic.
Subject matterMedia verification and evidence file generation under Article 50 workflows.
Data categoriesNo special categories. Contact emails for pilot accounts; content hashes in evidence files.
LocationProcessing in the EU (Frankfurt) by default.
Security measuresSee /security: TLS, SSRF guard, rate limiting, signed sessions, no media persistence.
DeletionEvidence files and account data deleted on request or at pilot end.

A signed DPA incorporating these terms is provided to pilot customers on request.