Who we are
Velocity is provided by Kevin Klein, Grünstiege 89B, 48599 Gronau (Westfalen), Germany ("Velocity", "we", "our", or "us"). We are the controller for the personal data described in this policy unless stated otherwise. For legal and privacy matters, contact legal@velocitystreaming.io. Full provider details are available in the Imprint.
Controller and processor roles
Velocity has three modes: Interactive Sessions, Live Streaming, and Interactive Live Streaming, plus a workspace (Cloud, Whiteboard, Workspace, and an IDE).
- We act as controller for the data we process for our own purposes: account and profile data, workspace membership, security and abuse prevention, support, and our own legal and business records.
- We act as processor when a Host uses Velocity to run sessions or streams involving their Guests, Viewers, Listeners, Team Members, or customers. For that content (for example recordings, session content, chat, uploaded files, and workspace content), the Host or their organisation is the controller and decides what happens. Business customers may conclude a Data Processing Agreement with us.
Data we collect and process
The categories below reflect what the product actually stores and processes.
- Account data. Your email address and password (managed by our database and authentication provider), and, if you sign in with a supported identity provider, the identity information it returns.
- Profile data. A display name and avatar image, if you add them, and a public handle if you claim one.
- Workspace and team data. Your workspace, membership and role, and invitations, which can include the email address of a person you invite.
- Session data. Sessions and streams you create or take part in, including titles, notes, timestamps, participant and viewer counts, and technical session identifiers.
- Guest, Viewer, and Listener data. People who join by invitation or as audience are not required to have a Velocity account. A display name you type is used to present you in the session and, for real-time audio and video, is carried in temporary access credentials needed to join. We do not create a stored profile for anonymous Guests or audience members. If you send a message in an audience chat, your chosen display name and message are stored.
- Recordings. If a Host records a session, the recording (which can contain the images, voices, and shared content of the people who take part) is stored, together with metadata such as title, duration, retention period, and a reference code. See the Recording & Streaming Notice.
- Live streaming. For Live Streaming, media is delivered to an audience through Velocity's streaming and delivery infrastructure. A Host may also restream to third-party platforms via a destination the Host configures; the destination's stream key is stored securely.
- Uploaded files and cloud storage. Files you upload to Cloud, and a workspace logo you upload for branding, along with metadata such as name, type, size, and storage location.
- Chat and messages. Messages you send in team/workspace chat and in audience chat.
- Whiteboards and IDE files. Whiteboard content and code files you create in the workspace are stored so you can reopen them. These may contain any content you choose to put in them.
- Support communications. The content of messages you send us for support or other enquiries, and the email address you use.
- Technical, log, and security data. To operate the service securely and prevent abuse, we process technical data such as IP address, access times, and connection metadata. IP addresses are used for security and rate-limiting and are redacted in our operational event logs. We do not use device fingerprinting.
We do not currently process payment or card data, because paid billing is not active (see Terms of Use). We do not run third-party advertising. Optional analytics runs only if you consent — see "Analytics with your consent" below.
Why we process it, and the legal basis
- To provide the service you request (accounts, sessions, streaming, recordings, workspace features): Art. 6(1)(b) GDPR (performance of a contract).
- To keep the service secure and prevent abuse (rate-limiting, logging, fraud prevention): Art. 6(1)(f) GDPR (legitimate interests).
- To respond to support and other enquiries: Art. 6(1)(b) or Art. 6(1)(f) GDPR.
- To meet legal obligations where they apply: Art. 6(1)(c) GDPR.
- Where we ask for consent (optional analytics, see "Analytics with your consent"): Art. 6(1)(a) GDPR. You can withdraw consent at any time on the Cookie Notice page, with effect for the future.
Cookies and local storage
By default we use only strictly necessary and functional first-party cookies and local storage (for example to keep you signed in and to remember preferences such as theme). We do not use advertising cookies. Analytics cookies are set only after you consent through the banner on our public pages. See our Cookie Notice for details and to change your choice.
Analytics with your consent
If you allow it, we use Google Analytics 4 to see how many people visit our public pages and which pages they read. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It processes pseudonymous identifiers stored in cookies, the pages you visit, approximate location derived from your IP address, and device and browser information. Google Analytics 4 does not log or store your IP address.
The legal basis is your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG. Nothing loads before you agree, declining is one click, and you can withdraw at any time on the Cookie Notice page, with effect for the future. Google may process this data on servers of Google LLC in the United States; this transfer is covered by the EU-US Data Privacy Framework, under which Google LLC is certified. Analytics data is retained for 14 months. We do not use Google Signals, ads features, or audience building.
Recipients and processors
We use service providers only where needed to operate Velocity, such as database and authentication, media delivery, object storage, hosting, security, and support infrastructure. We also share data with third parties where you direct us to (for example a third-party platform you choose to restream to) or where required by law. Business customers can request more detailed information under the Data Processing Agreement.
Where we process data
Velocity's primary application systems and storage are operated in European regions. Where service providers support delivery, security, or technical operation of the platform, we use contractual and organisational safeguards appropriate to the processing. If you consent to analytics, Google may process that data in the United States, as described in "Analytics with your consent". We do not sell personal data.
How long we keep data
- Account and profile data: for as long as your account is active. If you close your account, we delete or anonymise your data within 90 days, unless we must retain it to meet a legal obligation.
- Recordings: for the retention period set for each recording, after which they are removed automatically. The Host can also delete a recording earlier.
- Session, usage, and workspace content: until you delete it or your account is closed. Items moved to Trash can be restored until they are permanently removed where that option is available.
- Security and log data: for a limited period needed for security and abuse prevention. Rate-limiting data is short-lived.
Data security
We apply technical and organisational measures appropriate to the risk, including access controls, tenant separation, private storage with access-controlled delivery for recordings, and encryption in transit. These are described in our Technical & Organisational Measures.
Your rights
Under the GDPR you have the right to:
- access your personal data (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data deleted (Art. 17);
- restrict processing (Art. 18);
- data portability (Art. 20);
- object to processing based on legitimate interests (Art. 21); and
- withdraw consent at any time, where processing is based on consent (Art. 7(3)).
To exercise these rights, contact us at legal@velocitystreaming.io. If Velocity processes your data on behalf of a Host (as processor), please also contact that Host, who is the controller for that content. Where your data was captured in a session run by a Host, we will direct your request to the Host where appropriate.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work. Our competent authority is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen).
Children
Velocity is not intended for children. You must be at least 18 years old to create an account, as set out in our Terms of Use.
Changes to this policy
We may update this policy as the product develops. We will post the updated version on this page and change the "Last updated" date. Where a change is significant, we will take reasonable steps to make it more visible.