We are committed to minimal data collection. Prompt content never leaves your process. This policy explains what we collect, how we use it, and your rights.
This policy applies to ScopeVeil's marketing website (scopeveil.com), dashboard (app.scopeveil.com), LLM gateway (gateway.scopeveil.com), observability ingest pipeline (ingest.scopeveil.com), and the ScopeVeil SDKs for TypeScript and Python.
Payments are handled by Stripe; we store only a Stripe customer ID, never card numbers.
We receive operational metadata only:
We never collect: prompt content, completion text, system prompts, tool arguments or responses, raw end-user identifiers, or any data you did not explicitly choose to send. Our SDKs read response bodies locally to count tokens and discard them before transmission.
When you use our website or dashboard, we log IP address (retained 30 days for security and rate limiting), browser type, viewport, pages visited, and referrer. We use New Relic for our own application performance monitoring. Service telemetry only, no prompt or completion content.
scopeveil-session (httpOnly, secure, SameSite=Lax): authentication session, 7 days.XSRF-TOKEN (secure, SameSite=Lax): CSRF protection.We do not use third-party tracking, advertising, or fingerprinting cookies.
We rely on the following legal bases (GDPR Art. 6 / LGPD Art. 7):
We do not sell or rent personal data, train AI models on your data, profile users for advertising, or share data with data brokers.
The following third parties process data on our behalf:
Material changes to subprocessors will be announced at least 30 days in advance.
You may request earlier deletion at any time (Section 8).
Our primary infrastructure is hosted in the United States (Fly.io, region iad, Ashburn, Virginia). For users in the EEA, the UK, or Switzerland, we rely on Standard Contractual Clauses (SCCs) as the legal basis for transfers. EU data residency is on our roadmap; get in touch if you require it.
You have the right to access, correct, delete, port, restrict, and object to processing of your data. You may also withdraw consent at any time where processing is based on consent.
Most rights can be exercised directly from your account (Export data, Delete account). For anything else, use our contact form from the address associated with your account. We respond within 30 days.
Region-specific frameworks: GDPR (EEA, UK, Switzerland), LGPD (Brazil, Lei 13.709/2018), CCPA / CPRA (California). See /data-rights for a detailed breakdown per jurisdiction.
No system is fully secure. We commit to notifying affected users within 72 hours of confirming a data breach, in line with GDPR Art. 33 and LGPD Art. 48.
Our Data Protection Officer (Encarregado de Proteção de Dados Pessoais, per LGPD Art. 41) can be reached through our contact form. Pick the "Privacy / data rights" topic so it lands directly with the right team. Use this channel for any privacy concern, formal request, or regulatory inquiry.
ScopeVeil is a B2B developer platform, not directed at anyone under 18. If we learn we have collected data from a minor, we will delete it promptly.
We may update this policy. The "Last updated" date at the top reflects any change. For material changes affecting how we collect or use your data, we notify by email at least 30 days before they take effect. The current version is always available at scopeveil.com/privacy.
All privacy, DPO, and legal inquiries go through our contact form. Pick the topic that fits your message ("Privacy / data rights", "Legal", or "Other") and we route it to the right person internally. Same response time, fewer dead-letter mailboxes.