Privacy Policy

Who we are.

Veltrace is operated by BB/aH Labs Limited, a company registered in England and Wales (Company number 17241577). When this policy says "Veltrace", "we", "us", or "our", it refers to BB/aH Labs Limited.

We are the data controller for personal data collected through this website and the Veltrace platform. For any privacy-related questions, contact us at privacy@veltrace.co.uk.

What data we collect.

We collect the minimum data necessary to provide the service. This falls into two categories: data you give us directly, and data we collect automatically.

Data you provide

• Account data: your email address and name when you create an account.
• Creator watchlist preferences: the creators you add to your personal watchlist and any associated alert settings.
• Payment data: billing details are handled directly by our payment processor (Stripe) and are never stored on Veltrace servers.
• Communications: any messages you send us via email, including support requests.

Data we collect automatically

• Usage data: pages visited, features used, and interactions within the dashboard — used to improve the product.
• Session data: authentication tokens stored in your browser to keep you signed in.
• Log data: standard server logs including IP address, browser type, and request timestamps. Retained for 30 days.

Creator data (not personal data)

Veltrace tracks publicly available metrics for content creators — subscriber counts, view counts, and post frequency — sourced from official platform APIs. This is not personal data about you as a user. See the section below on API usage for details.

How we use your data.

We only use your data for the purposes listed below. For each purpose we identify the lawful basis under UK GDPR.

• Providing the service — authenticating your account, loading your dashboard, and personalising your experience. Lawful basis: performance of a contract.
• Billing and subscription management — processing payments and managing plan changes. Lawful basis: performance of a contract.
• Product improvement — analysing aggregated usage patterns to improve features. Lawful basis: legitimate interests.
• Service communications — sending transactional emails such as account confirmations, password resets, and data digests (paid plans). Lawful basis: performance of a contract.
• Security and fraud prevention — detecting and preventing abuse or unauthorised access. Lawful basis: legitimate interests.

We do not sell your personal data. We do not use your data for advertising or share it with advertising networks.

YouTube and Twitch API usage.

Veltrace uses official APIs to retrieve publicly available creator metrics. No private or authenticated creator data is accessed. We do not collect data about Veltrace users' YouTube or Twitch accounts.

Data retrieved from both APIs is stored on our servers and retained indefinitely as a historical record for the purpose of calculating score trends and history. Creator data is public information; we do not delete historical snapshots as these form the core of our momentum scoring service. It is not shared with third parties and is not used for any purpose other than computing Veltrace Deal Signal Scores.

How your data is stored.

All personal data processed by Veltrace is stored in Supabase, hosted in the EU region. Data is encrypted at rest using AES-256 and encrypted in transit using TLS 1.2 or higher. Access to production data is restricted to authorised personnel only.

Supabase manages physical infrastructure security on our behalf as a GDPR-compliant sub-processor. Payment data is processed and stored exclusively by Stripe — Veltrace systems never store full card numbers or payment credentials.

How we use cookies.

We use essential cookies necessary for the service to function, and analytics and error-tracking cookies to improve reliability. For a full breakdown of all cookies used, see our Cookie Policy.

Essential cookies do not require your consent under PECR. Analytics and error-tracking cookies are set only with your consent via our cookie banner. You may withdraw consent at any time by clearing your cookies or adjusting your browser settings. To opt out of Google Analytics specifically, use the Google Analytics Opt-out Browser Add-on. See our full Cookie Policy for more detail.

Who we share data with.

We use a small number of trusted sub-processors to operate the service. Each is bound by data processing agreements and GDPR-compliant terms.

• Supabase — database, authentication, and storage. Data is hosted in the EU region and is encrypted at rest and in transit. Supabase Privacy Policy.
• Stripe — payment processing. Card data is processed and stored by Stripe; Veltrace never sees full card numbers. Stripe Privacy Policy.
• Resend — transactional email delivery (account confirmations, password resets, weekly digests). Only your email address is shared for the purpose of delivery. Resend Privacy Policy.
• Netlify — website hosting and CDN. Standard web server logs are processed. Netlify Privacy Policy.
• Sentry — error tracking and performance monitoring. Anonymised error reports and stack traces are sent to Sentry when a JavaScript error occurs. No personally identifiable data is deliberately included in error reports. Sentry Privacy Policy.
• Google Analytics (GA4) — website usage analytics. Anonymised usage data (pages visited, session duration, general location) is collected via Google Analytics. IP addresses are anonymised. You can opt out using the Google Analytics Opt-out Browser Add-on. Google Privacy Policy.
• Cloudflare — DNS, DDoS protection, and web application firewall. Network request metadata (IP addresses, request paths) passes through Cloudflare's infrastructure. Cloudflare Privacy Policy.

We do not sell, rent, or share your personal data with any other third parties. We will not disclose your data to law enforcement unless legally compelled to do so, in which case we will notify you where permitted.

How long we keep your data.

• Account data (email, name): retained for the lifetime of your account, plus 30 days after deletion to allow for recovery if requested.
• Creator data (public metrics): retained indefinitely as a historical record. This is publicly available data that forms the core of our momentum scoring service.
• Server logs: retained for 30 days then automatically deleted.
• Billing records: retained for 7 years as required by UK tax law.

When you delete your account, all personal data is permanently removed within 30 days, except where retention is required by law.

Your rights under UK GDPR.

The UK General Data Protection Regulation gives you the following rights in relation to your personal data. You can exercise any of these by emailing privacy@veltrace.co.uk with the subject line "Data Rights Request" and your account email address. We will acknowledge your request within 5 business days and respond in full within 30 days.

If you believe we have not handled your data lawfully, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) — the UK's supervisory authority for data protection. You can do this at ico.org.uk/make-a-complaint or by calling 0303 123 1113.

ICO registration.

BB/aH Labs Limited is registered with the Information Commissioner's Office (ICO) as a data controller under the UK Data Protection Act 2018 and UK GDPR. ICO registration number: [PENDING — to be inserted upon completion of registration].

You can verify our registration on the ICO's public register at ico.org.uk/ESDWebPages/Search by searching for "BB/aH Labs Limited".

Cross-border data transfers.

Some of our sub-processors are based in the United States. When personal data is transferred outside the UK to these processors, we ensure adequate safeguards are in place as required by UK GDPR Article 46.

• Resend — based in the US. Data transfers are governed by Standard Contractual Clauses (SCCs) as approved by the UK Information Commissioner's Office.
• Sentry — based in the US. Data transfers are covered by Sentry's Data Processing Addendum incorporating SCCs.
• Google Analytics / Google LLC — based in the US. Google participates in the EU–US Data Privacy Framework. Google Analytics data is processed under Google's data processing terms which incorporate SCCs where applicable.
• Stripe — has UK and EU entities; Stripe Ltd (UK) processes payments for UK customers. Transfers to US entities are governed by SCCs.

Supabase and Netlify host data in EU/UK regions for Veltrace; no cross-border transfer occurs for data held on those platforms. If you have questions about our transfer mechanisms, contact privacy@veltrace.co.uk.

Changes to this policy.

We may update this Privacy Policy from time to time. When we make material changes we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email. Continued use of Veltrace after changes take effect constitutes acceptance of the updated policy.

Get in touch.

For any privacy questions, data requests, or concerns, contact us at: