Privacy Policy

• Velscor only reads an email when you open the Velscor pane in Outlook — the email you’re viewing, and each email you select while the pane stays open. It can’t browse or search your mailbox.
• Parts of that email are sent to our servers and to our AI provider to produce a verdict. We don’t keep the email’s content after the analysis; we keep the verdict for up to 7 days.
• We don’t sell your information, use it for advertising, or let our AI provider train its models on it.
• If you report a verdict as wrong, we review the report, and approved reports help improve detection for all customers, without identifying you.

Velscor is operated by Jon Jackson, an individual based in North Carolina, United States (“we,” “us”). We decide how the information described here is used. Contact us at support@velscor.com or through our contact page.

If your organization deployed Velscor for you, your organization also has its own policies about your work email; this policy covers what Velscor does.

When Velscor analyzes an email, the add-in sends our servers:

• the sender’s name and email address, the subject, and the Reply-To and Return-Path addresses;
• the email’s authentication results (SPF, DKIM, DMARC and similar) and whether Microsoft marked it as internal to your organization;
• up to the first 3,000 characters of the email’s text;
• your email address and license information, and a sign-in token from Microsoft that confirms who you are.

If you choose to analyze an email attached to a message, the same information from the attached email is sent. Velscor does not open or upload file attachments.

How it’s used: to check your license and to produce the verdict. Email between colleagues in your own Microsoft 365 organization isn’t sent for AI analysis. For other email, the details above (but not your sign-in token or license key) are sent to our AI provider, Anthropic, which processes them to generate the verdict. Under Anthropic’s commercial terms, it may not use this information to train its models, and it keeps it only for a limited period for safety and abuse monitoring.

What we keep: we don’t store the email’s content after the analysis. We keep the resulting verdict and short explanation for up to 7 days, filed under a one-way fingerprint of the email rather than the email itself, so the same email isn’t analyzed twice.

To judge whether a sender is trustworthy, Velscor looks up public information about the sender’s domain — such as when it was registered (from public domain registries), its email security (DNS) settings, and whether its website redirects elsewhere — and visits the sender’s website to check. These results are kept for up to 7 days. They concern the sender’s domain, not you.

If you use “Report this verdict,” we receive the reported email’s sender, subject, authentication details, the first 500 characters of its text, the original verdict and explanation, the verdict you suggest, any note you add, and your email address. A notification with the sender, subject, verdicts, your note, and your email address is emailed to our support inbox.

We review every report. If we reject it, we delete it. If we approve it, we delete the text excerpt and keep details such as the reported sender, subject, and authentication results, plus a lesson we write. Approved lessons are given to our AI as examples when analyzing all customers’ email, which is how Velscor learns from mistakes. We keep your email address and note with the approved report for our records, but they — and the email text — are never included in those examples.

• Usage records: for each day, how many emails each user opened with Velscor and how each was handled (analyzed, previously analyzed, or internal), along with the user’s email address and the AI processing used. We keep these for 180 days and use them to operate, support, and price the Service, and to bill organization plans for active users.
• License records: for organization licenses, the email addresses of people who have used the license, to apply user limits. We keep these while the license exists.
• Security records: IP addresses and identifiers are counted for up to an hour to prevent abuse (rate limiting), and our hosting provider keeps short-lived server logs.
• On your device: the add-in saves your license key and license status in Outlook’s browser storage so you don’t have to re-enter them.

• Account portal: when you create an account at app.velscor.com, our sign-in provider, Clerk, handles your name, email address, and sign-in.
• Purchases: Link (a Stripe service) is the merchant of record and collects your payment details, billing address, and email under its own privacy policy. We receive your email, subscription status, and payment history, but not your full card number.
• Contact form and email: when you contact us, we receive what you send — such as your name, email, organization, role, team size, and message — and keep it as long as needed to respond and for our records.
• Emails we send: license keys, setup instructions, and billing links are sent through our email provider, Resend.

This website doesn’t use advertising or analytics trackers. The account portal uses cookies needed to keep you signed in.

We use these providers to run Velscor. They process information only to provide their services to us:

• Anthropic — AI analysis of email
• Microsoft — Outlook and sign-in (identity verification)
• Vercel — website and server hosting
• Upstash — database
• Stripe / Link — payments and billing (as merchant of record)
• Clerk — account portal sign-in
• Resend — sending email

We don’t sell or rent personal information, and we don’t share it for advertising. We may disclose information if the law requires it, to protect people or the Service from harm or fraud, or to a successor if Velscor is reorganized (for example, transferred to a company formed to run it) or sold — in which case this policy continues to apply to it.

Velscor and its providers are based in, and process information in, the United States. If you use Velscor from elsewhere, your information is transferred to the United States.

• Email content: not kept after analysis (our AI provider keeps it only briefly, as described above).
• Verdicts and sender checks: up to 7 days.
• Usage records: 180 days.
• Reports: deleted if rejected; approved reports are kept, without the text excerpt, while they’re useful for detection.
• License, account, and billing records: while you have a license or account, and afterwards as long as needed for legal, tax, and accounting purposes.

Information is encrypted in transit, access to our systems and data is restricted, and we verify Microsoft sign-ins and limit request rates to prevent misuse. No system is perfectly secure, but we work to protect what we handle and will notify affected users of a breach as required by law.

You can ask us to access, correct, or delete your personal information, or ask questions about how it’s used, by emailing support@velscor.com. Depending on where you live, you may have additional rights under laws such as the GDPR or U.S. state privacy laws, and we’ll honor them as those laws require. If your organization manages your license, we may refer some requests to your organization’s administrator.

You can stop Velscor from analyzing email at any time by closing the add-in or removing it from Outlook.

Velscor is a business tool and isn’t intended for children under 16. We don’t knowingly collect their information.

If we change this policy, we’ll update the date above. If a change is material, we’ll give notice on this page and, where we have your contact details, by email before it takes effect.

Questions or requests: support@velscor.com, or our contact page.