Vela

Privacy Policy

Last updated: 18 June 2026

This Privacy Policy explains how Vela ("we", "our", or "the app"), operated by Cheah Wai Kit, collects, uses, and protects your information when you use the Vela mobile application and the recipient web page at card.velacard.app.

By using Vela, you agree to the practices described in this policy. If you do not agree, please discontinue use of the app.

1. Information We Collect

We collect only the information you explicitly provide when creating your Vela profile:

• Full name
• Job title
• Company name
• Phone number and work phone number
• Email address
• LinkedIn profile URL
• WhatsApp number
• Company website
• Company address

We also collect the following account information:

• Email address used to register your account
• Account type (free or premium)
• AI scan credit balance and monthly scan usage count
• In-app purchase transaction records (product ID, amount, store, date)

2. Business Cards You Scan

To be clear about what this means:

• The card photo is processed only on your device and is never uploaded to us or any third party.
• The extracted text transits our server and Google Gemini transiently for parsing, and is not retained by us afterwards.
• The finished contact record is stored only locally on your device, never on our servers.
• Follow-up reminders: if you choose to set a follow-up reminder for a scanned contact, Vela creates a single event directly in your device's native calendar app, at your request. We do not read, store, or receive any calendar data — the event is created on-device and Vela has no visibility into it afterwards.

We do not collect:

• The card image (photo) from cards you scan
• The finished contact records, on our servers
• Location data
• Device identifiers or advertising IDs
• Browsing or usage analytics
• Any data from your device's contacts, camera roll, calendar, or files beyond the active scan session

3. How We Use Your Information

Your profile information is used solely to:

• Display your digital business card to recipients who scan your QR code or open your link
• Generate your shareable vCard (.vcf) for recipients to save your contact
• Manage your account, scan credits, and subscription status
• Process and verify in-app purchases
• Send account emails, such as email address confirmation and password reset links, when required

We do not use your data for advertising, profiling, or any purpose beyond operating the Vela service.

4. How Your Card is Shared

Your Vela profile is accessible via a unique URL of the form card.velacard.app/view.html?id=YOUR_ID. This URL is encoded in your QR code. Anyone who scans your QR code or has your link can view the profile fields you have chosen to fill in. Only fields you have populated are shown — empty fields are not displayed.

Your account type, scan credits, and usage are never shown on your public card.

5. AI Card Scanning

When you scan a physical business card, your device's on-device text recognition (Google ML Kit OCR) first extracts the text from the card image. This step happens entirely on your device — the card image itself is never uploaded. That extracted text — not the card image — is then sent to our secure server-side function, which forwards it to Google Gemini (a large language model API) to parse it into structured contact fields. This text is used only to perform the parsing and is not retained by Vela after the parsed result is returned to your device.

Google's handling of data sent to the Gemini API is governed by Google's Privacy Policy. By using the card scanning feature, you acknowledge that text extracted from scanned cards is processed by Google Gemini for the purpose of structuring contact details.

6. Third-Party Services

Vela uses the following third-party services to operate:

• Supabase — cloud database and authentication (AWS-hosted). Stores your profile and account data. Privacy Policy
• Google Gemini — AI parsing of text extracted from scanned business cards. Privacy Policy
• RevenueCat — in-app purchase management and receipt validation. Privacy Policy
• Resend — delivery of account emails such as confirmation and password reset messages. Privacy Policy
• Cloudflare — hosting of the recipient web page and email routing for our contact addresses. Privacy Policy
• Apple App Store / Google Play — app distribution and subscription payment processing.

7. Data Storage and Security

Your profile data is stored in Supabase's managed PostgreSQL database, hosted on AWS infrastructure. All data is transmitted over encrypted connections (TLS). Access to your profile is protected by Row-Level Security policies — only you can modify your own profile, and billing-related fields cannot be altered from the client. Your public card is served through a restricted database function that returns only your own card's public fields.

Your session credentials are stored in your device's secure storage (iOS Keychain / Android Keystore) and are never stored in plain text.

8. Data Retention

Your profile data is retained for as long as your account is active. Contact data from cards you scan is held only in local storage on your device and is removed when you save or discard the contact; it is never backed up to our servers.

Purchase records are retained for accounting and dispute-resolution purposes, even after account deletion, where required for legal or financial compliance.

9. Your Rights

You have the right to:

• Access the data we hold about you
• Correct any inaccurate profile information (via the Edit Profile screen in the app)
• Delete your account and associated data

You may also email us at privacy@velacard.app to request access to, or deletion of, your data. We will respond within 30 days.

10. Additional Information for EEA, UK & Swiss Residents (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the following additional information applies to you under the General Data Protection Regulation (GDPR) and equivalent UK and Swiss law. Where this section conflicts with anything above, this section governs for residents of those regions.

10.1 Data Controller and EU Representative

The data controller for your personal data is Cheah Wai Kit, operating as Vela (contact: privacy@velacard.app). Vela is not currently offered to users in the EEA, the United Kingdom, or Switzerland. If and when Vela becomes available in those regions, we will appoint a representative as required under Article 27 GDPR and publish their contact details here. Until then, you may contact us directly at privacy@velacard.app regarding the processing of your personal data.

10.2 Legal Bases for Processing

We process your personal data on the following legal bases:

• Performance of a contract (Art. 6(1)(b)) — to create and manage your account, display your digital card, process your scans, and provide the service you signed up for.
• Consent (Art. 6(1)(a)) — where you have given it, for example by choosing to scan a card or use optional features. You may withdraw consent at any time.
• Legitimate interests (Art. 6(1)(f)) — to operate, secure, and improve the service, prevent fraud and abuse, and process the contact data of business cards you choose to scan (see 10.5). We balance these interests against your rights and freedoms.
• Legal obligation (Art. 6(1)(c)) — to retain purchase and tax records as required by law.

10.3 Your GDPR Rights

In addition to the rights listed in Section 9, you have the right to:

• Access — obtain a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — delete your data, which you can do in-app via Settings → Delete Account, or by contacting us.
• Data portability — receive your data in a structured, commonly used, machine-readable format.
• Restriction — ask us to limit how we process your data in certain circumstances.
• Objection — object to processing based on our legitimate interests.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing.
• Lodge a complaint — with your local data protection supervisory authority. A list of EEA authorities is available from the European Data Protection Board (edpb.europa.eu); UK residents may contact the ICO (ico.org.uk).

To exercise any of these rights, email privacy@velacard.app. We will respond within one month, as required by GDPR.

10.4 International Data Transfers

Vela operates from Singapore, and some of our service providers are located outside the EEA, including in the United States. In particular, text extracted from scanned cards is processed by Google Gemini, and your account data is hosted on Supabase (AWS) infrastructure.

Where personal data is transferred to the United States, we rely on the EU-U.S. Data Privacy Framework (DPF) and its UK and Swiss extensions, under which Google is certified, and/or on the European Commission's Standard Contractual Clauses (SCCs) as a safeguard. Transfers to Singapore and other locations are made under appropriate safeguards or applicable adequacy decisions. You may request more information about these safeguards by contacting us.

10.5 Contact Data From Scanned Cards

When you scan a business card, you are acting as the controller of the resulting contact data — it is your contact, saved for your own use, much like typing it into your phone's address book. Vela acts as a processor that performs the parsing on your behalf, and (as described in Section 2) does not retain the extracted text or store the finished contact on our servers.

If you are a business user scanning cards for professional purposes, you are responsible for ensuring you have a lawful basis to process the contact details of the individuals whose cards you scan, and for honouring their data-protection rights. If an individual whose card was scanned wishes to exercise their rights, they should contact the Vela user who scanned their card; you may also contact us at privacy@velacard.app and we will assist where we are able.

10.6 Automated Processing

The AI parsing described in Section 5 structures text into contact fields. It does not make any decision that produces legal or similarly significant effects about any individual, and you review and confirm every parsed contact before it is saved. We do not carry out automated decision-making within the meaning of Article 22 GDPR.

11. Children's Privacy

Vela is intended for working professionals and is not directed at children. We do not knowingly collect personal information from children under the age of 13. If you believe a child has provided us with personal information, please contact us at privacy@velacard.app and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of Vela after changes are posted constitutes acceptance of the updated policy.

13. Governing Law

This Privacy Policy is governed by the laws of Singapore, including the Personal Data Protection Act 2012 (PDPA). For residents of the EEA, the UK, or Switzerland, nothing in this section limits the mandatory data-protection rights you have under GDPR or equivalent local law, including the right to bring a claim before the courts or supervisory authority of your country of residence.

14. Contact

If you have any questions or concerns about this Privacy Policy, please contact us at:

Cheah Wai Kit
Operating as: Vela
Privacy enquiries: privacy@velacard.app
Support: support@velacard.app