Last updated: October 30, 2026
This Privacy Policy explains how Nwbrains LLC (Wyoming, United States), trading as Veilbrook, handles personal information for the Veilbrook service. For customer documents, the Data Processing Addendum also applies.
1. Information we collect
- Account information: email address, password hash, account status, DPA/Terms acceptance versions and timestamps, plan and usage counters.
- Authentication and security data: hashed session tokens, API key hashes, hashed IP addresses, hashed browser information, login and security events.
- Document metadata: page count, masked-item counts, review counts, residual counts and document processing timestamps. Document contents are processed and deleted; we do not retain them.
- Billing data: when paid plans are enabled, our payment processor handles card data and billing details. We receive billing status and identifiers, not full card numbers.
- Support communications: messages you send to support.
2. How we use information
We use information to create and secure accounts, verify email addresses, provide the redaction service, enforce quotas, prevent abuse, send transactional and legal notices, provide support, comply with law, and improve reliability. We do not sell personal information and do not use customer documents to train models.
3. Legal bases (international customers)
Where GDPR or UK GDPR applies, we rely on performance of a contract, legitimate interests in securing and improving the service, consent where required, and legal obligations. You may withdraw consent where consent is the basis.
4. Sharing and subprocessors
We use service providers for hosting, model inference, email delivery, payments and network delivery. The current list is at /legal/subprocessors. We impose data-protection obligations and use appropriate transfer safeguards (including Standard Contractual Clauses and the UK Addendum where applicable).
5. Retention
- Documents: deleted after processing, within 24 hours at most; no document content is retained.
- Account and document metadata: deleted within 30 days after account deletion.
- Backups: metadata backups expire within 14 days; document content is not included.
- Security/audit events: pseudonymous audit records may be retained for up to 12 months.
- Technical logs: up to 30 days.
- Billing and tax records: retained as required by law.
6. Your rights
Depending on your location, you may request access, correction, deletion, restriction, portability, or objection, and may appeal or complain to a supervisory authority. California residents may request to know, delete, correct, and opt out of sale/sharing; we do not sell or share personal information for cross-context behavioural advertising. We will verify requests and respond within the time required by applicable law (for example, 45 days under the CCPA/CPRA, subject to extension).
Contact: privacy@veilbrook.com. You can also export account metadata and delete your account from the account area.
7. Security
We use Argon2 password hashing, hashed API keys and session tokens, HTTPS, restricted access, audit logging, rate limiting and deletion controls. No system is perfectly secure; report suspected issues to security@veilbrook.com.
8. International transfers
Our application and database are hosted in the European Union, model inference may use providers in the United States, and email delivery may use providers in the European Union. We use appropriate safeguards for restricted transfers.
9. Children
The service is for businesses and professionals and is not directed to children under 16. We do not knowingly collect information from children.
10. Changes
We may update this policy. Material changes will be notified by email or in the service. The “Last updated” date shows the current version.
11. Contact
Nwbrains LLC (trading as Veilbrook) · privacy@veilbrook.com