Privacy Policy

1. Introduction

Vavelio LTD (“we”, “our”, “us”) is committed to protecting your privacy. This policy explains how we collect, use, and safeguard information when you visit our website or engage with our services.

2. Information We Collect

We collect minimal information. We may collect:

• Information you provide when contacting us via the contact form or email.
• Server logs automatically collected by our hosting provider for security purposes.
• Anonymous, privacy-first usage statistics collected by our own VALS (Analytics Service), running on our private cluster in Finland. This includes the pages you view, measured in aggregate.

Our analytics are configured for privacy by default:

• No tracking cookies are set — analytics run entirely without cookies.
• IP addresses are anonymised (the last 2 bytes are removed).
• Only the domain of the referring URL is stored, never the full referrer.
• Device model and screen-resolution detection are disabled; only major browser and OS versions are stored.
• Personally identifiable information in URLs (emails, tokens, passwords, account numbers, etc.) is filtered before storage.
• User IDs, the visits log, and visitor profiles are disabled.
• E-commerce tracking is disabled; no order IDs are collected.
• Aggregate reports are rounded to protect individuals.
• The browser’s Do Not Track (DNT) preference is respected.
• Analytics data is retained for a maximum of 180 days.

3. How We Use Information

Information collected is used solely to respond to enquiries, maintain the security of our infrastructure, and understand, in aggregate, how our website is used so we can improve it. We do not sell, share, or process data for advertising or marketing purposes, and we do not use third-party advertising or tracking services.

4. Legal Basis

We process information under the lawful bases of legitimate interest (responding to enquiries, ensuring network security, and measuring website usage in aggregate) and consent (where you choose to contact us). Because our analytics run without cookies and without identifiers, they align with the CNIL consent-exemption conditions and do not require a consent banner.

5. Data Retention

Correspondence is retained only as long as necessary to fulfil the purpose for which it was collected. Server logs are retained for a maximum of 90 days. Anonymised analytics data is retained for a maximum of 180 days.

6. Analytics

We measure website usage with our own VALS (Analytics Service) — one of the products we build and operate for clients. We use our own products on our own website. When you visit a page, an anonymous analytics request is sent from your browser to our own infrastructure at vals.vavel.io, recording the page view in aggregate.

All analytics data is stored and processed exclusively by VALS on our private cluster in Finland. Analytics data is never sent to, or processed by, third parties, and no US-based analytics services are used.

Analytics processing falls under Vavelio LTD’s ICO registration (ZC024199) and is carried out in compliance with the UK GDPR and the EU General Data Protection Regulation.

You can disable analytics entirely by blocking the domain vals.vavel.io in your browser or network (for example with an ad-blocker or firewall). This prevents any analytics data from being sent to us.

7. Your Rights

Under UK GDPR, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data. To exercise any of these rights, contact us at support@vavel.io.

8. Contact

For questions regarding this policy, please contact us at support@vavel.io or write to Vavelio LTD, 4th Floor, Silverstream House, 45 Fitzroy Street, Fitzrovia, London, W1T 6EB, United Kingdom.

Regional Privacy

In addition to this policy, we publish region-specific guidance for:

• Japan (APPI) — the “Cloud Exception”.
• Korea (PIPA) — delegation, not third-party transfer.
• Europe (GDPR) — GDPR across the EU/EEA.