Privacy Policy

We know that your privacy is important. This Policy explains, in a clear and simple way, how we collect, use, and protect your personal data when you use VeWorld.ai.

At a glance:

• We collect account information, how you use Agents, and (where you use Digital Asset payments) related wallet and transaction data.

• We use your data to run and secure the Platform, and to improve it. We do not sell your data or use it for advertising.

• VeWorld Technology Ltd., a company registered in Liechtenstein, is the data controller responsible for your data.

• You can exercise applicable access, portability, correction, or deletion rights by contacting support@veworld.com (see “Your Rights” below).

1. Who We Are

VeWorld Technology Ltd. operates VeWorld.ai and is the data controller responsible for your personal data under this Policy. Contact: support@veworld.com. For any questions about this Policy or your personal data, reach us without needing to log in to the Platform.

2. Scope of This Policy

This Policy applies to all Users of the Platform, including Creators and Consumers, and covers personal data collected through the Platform website, mobile application, embedded Agent experiences, account registration, identity verification, Agent interactions, integrations, and Creator use of the Agent building tools.

When you interact with an Agent, your inputs are sent to third-party large-language-model providers to generate Agent Outputs (see Section 5). Their processing is also subject to their applicable terms and privacy policies.

For information about our use of cookies, please refer to our Cookie Policy, available alongside this Policy on our website.

3. Personal Data We Collect

3.1 Account Registration Data

Wallet login provides a wallet address and signed authentication proof. If you choose email or social login through Privy, we receive the identifiers and profile information made available for authentication, which may include your email address and an embedded wallet address. We also process account preferences, session identifiers, IP address, and user-agent information needed to operate and protect your account.

3.2 Creator Identity Verification Data

Where identity verification is required to access certain Creator features: government-issued identification documents; date of birth; country of residence. The scope of data collected is determined by our verification process as updated from time to time.

3.3 Usage and Interaction Data

When you use the Platform: log data (IP address, browser type, device type, OS, timestamps, session and invocation identifiers, and rate-limit events); interaction data (pages visited, features used, session duration); Agent interaction data (conversation history and Agent Outputs).

Where enabled, Google Tag Manager and its analytics tags process page and feature usage. Sentry processes errors, performance information, and masked Session Replay data; text and media are masked or blocked in the replay configuration.

Conversation inputs may be transmitted to third-party model providers without a guaranteed pre-transmission personal-data redaction step. Do not include sensitive personal data unless it is necessary for your requested interaction. Where you use memory features, some information you have shared may be included in the context sent to a model provider to the extent needed to provide the service.

3.4 User Memory Data

Where you interact with an Agent that uses memory features, we store contextual information derived from your interactions to enable continuity across sessions. User Memory is stored on a per-user, per-Agent basis and is not accessible to Creators. You may request access, portability, or deletion by contacting support@veworld.com, subject to applicable law and retention requirements.

3.5 Payment Data

Where supported, a Consumer may pay a Creator directly or fund a SmartHold contract using a Digital Asset. You initiate these transactions from your own wallet on the public blockchain. In connection with them, we process public wallet addresses, transaction hashes, digital asset types, amounts, and relevant SmartHold contract state to confirm funding, delivery, release, or refund events shown by the Platform.

Blockchain immutability. Data written to a public blockchain is permanent, public, and cannot be altered or deleted by us or anyone else. We minimize what is written on-chain or otherwise processed in connection with Digital Asset payments to wallet addresses, amounts, and transaction hashes, never the content of your conversations or your identity documents. Your rights of erasure and rectification cannot extend to data already recorded on a public blockchain; where you exercise those rights we will act on the data held in our own systems.

3.6 Communications Data

If you contact Us via support, we collect the content of your communications and any personal data you include.

3.7 Wallet, Integration, and Security Data

Wallet providers and VeChain network services process wallet addresses, connection metadata, transaction requests, and public blockchain data when you use wallet or on-chain features. If you connect an integration, we store connection metadata while Nango holds the provider tokens. Anonymous embedded Agent chat uses a short-lived session identifier and may use Cloudflare Turnstile challenge data to prevent automated abuse.

4. How We Use Your Personal Data

We do not use your personal data to train internal AI models and will not do so without your explicit consent. We do not sell your personal data or share it for marketing or advertising.

5. Data Sharing

5.1 Service Providers (Processors)

We use providers for hosting and infrastructure, authentication, wallet connections, analytics and reliability monitoring, bot protection, integrations, AI model inference, and, where introduced or required, identity verification. Depending on the service and provider, a provider may act as our processor or process data under its own applicable terms and privacy policy. We do not represent that every provider is configured identically or that no provider retains operational data.

5.2 External LLM Services

When you interact with an Agent, your inputs are transmitted to one or more External LLM Services to generate Agent Outputs. This is necessary for the operation of the Platform. External LLM Services process data under their applicable terms and privacy policies.

5.3 Identity Verification Providers

If Creator identity verification is introduced or required, a verification provider may process only the data needed to complete that process.

5.4 Infrastructure, Analytics, and Security Providers

AWS provides hosting, storage, databases, logging, and Application Load Balancer and Amazon Cognito access-gate services. Sentry provides error, performance, and masked Session Replay monitoring. Where enabled, Google provides Tag Manager and analytics services. Cloudflare provides optional Turnstile bot protection for anonymous embedded Agent chat. These providers process data for the relevant operational purpose under their applicable terms.

5.5 Authentication and Wallet Providers

Privy supports optional email and social login and embedded wallets. Reown, WalletConnect, VeWorld, and other selected wallet providers support wallet connections. Google, Amazon Cognito, or another identity provider selected for a login flow may process authentication data under its own privacy terms.

5.6 Integrations

Nango provides our self-hosted OAuth connection and token-vault service. When you connect an integration, the selected provider, such as Microsoft for Outlook features, processes the data needed to authorise and perform your requested action. We store connection metadata but do not store provider access or refresh tokens in the Platform database.

5.7 VeChain Network, Payments, and Creators

Wallet addresses, transaction data, and network requests may be processed by VeChain nodes, block explorers, registry services, and fee-delegation services. Where a Digital Asset payment is made, the transaction is recorded on the applicable public blockchain and is visible permanently. Creators do not receive access to your conversations or User Memory through the Platform.

5.8 Legal and Regulatory Disclosure

We may disclose your personal data to competent authorities, regulators, or courts where required by applicable law or a binding legal order.

5.9 Corporate Transactions

In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the successor entity under the same protections. We will notify you of any such transfer.

5.10 No Other Sharing

We do not share your personal data with any other third parties except as set out in this Section 5.

6. Data Retention

We may retain data beyond these periods where required by applicable law or in connection with ongoing legal proceedings.

7. Your Rights (European Economic Area)

If you are located in the EEA or Liechtenstein, you have the following rights:

7.1 Right of Access

Request a copy of the personal data we hold about you.

7.2 Right to Deletion

Request deletion of your personal data. We will respond within 30 days. Certain data may be retained where required by law. Data recorded on a public blockchain cannot be deleted or altered; we will act on the data held in our own systems.

7.3 Right to Rectification

Request correction of any inaccurate personal data. The on-chain limitation described in 7.2 applies.

7.4 Right to Restriction

Request restriction of processing in certain circumstances.

7.5 Right to Object

Object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds.

7.6 Right to Data Portability

Receive your personal data (including conversation history and User Memory) in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible.

7.7 Right to Withdraw Consent

Where processing is based on consent, withdraw it at any time, without affecting prior processing and without losing access to the core service.

7.8 Right to Lodge a Complaint

Lodge a complaint with your local data protection authority. In Liechtenstein: Datenschutzstelle (DSS).

7.9 How to Exercise Your Rights

Contact us at support@veworld.com (no login required). We will respond within 30 days. We may ask you to verify your identity before processing your request.

8. US State Privacy Rights

Depending on the US state in which you reside, you may have additional rights under applicable state privacy law, including rights to access, correct, delete, and opt out of certain processing activities.

We do not sell your personal data, use it for targeted advertising, or engage in profiling that produces legal or similarly significant effects.

To exercise your US state privacy rights, contact us at support@veworld.com. We will respond within the timeframe required by applicable law in your state.

9. Users Outside the EEA and the United States

If you are accessing the Platform from outside the EEA or the United States, your personal data is processed primarily in the European Economic Area and may also be processed elsewhere by the providers described in this Policy, as explained in Section 11. We apply the protections described in this Policy regardless of where you are located. Where local laws provide additional rights, we will respect them to the extent required by applicable law.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including: encryption of data at rest using customer-managed encryption keys; access controls limiting access to authorised personnel; per-user and per-Agent namespace isolation; and regular security monitoring.

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority in accordance with applicable law.

11. International Data Transfers

Our primary Platform infrastructure is operated in the European Economic Area. Some providers, including Sentry, Google, Privy, Cloudflare, wallet and integration providers, and External LLM Services, may process personal data outside the EEA, including in the United States. Where required, these transfers are subject to appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an applicable adequacy mechanism. Provider retention and training practices are governed by their applicable configuration, terms, and privacy policies.

12. Children’s Privacy

The Platform is not directed at individuals under the age of 18. If you believe we have inadvertently collected personal data from a minor, please contact us at support@veworld.com and we will delete such data promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified at least 14 days before taking effect. Continued use constitutes acceptance.

14. Contact

For any questions about this Policy or your personal data, contact us at support@veworld.com.

VeWorld Technology Ltd. is registered in the Principality of Liechtenstein (registration number FL-0002.610.206-8), with registered address at Marktgass 11, 9490 Vaduz, Principality of Liechtenstein.