Privacy Policy

Last updated July 19, 2026

Vellum helps you turn your experience into a course you can sell. To do that we handle some personal data — your account details, the answers you give our AI interviewer, the courses you create, and your payments. This policy explains what we collect, why, who we share it with, and the rights you have over it. We do not sell your data for money, and you can decline non-essential cookies at any time.

This Privacy Policy describes how Pyrean B.V. (trading as Vellum AI) (“Vellum”, “we”, “us”, or “our”) collects, uses, shares, and protects personal data when you use vellum.to, our applications, and related services (together, the “Service”). It also explains your rights under the EU General Data Protection Regulation (“GDPR”) and other applicable privacy laws.

It applies to everyone who uses Vellum — whether you create courses (an “Instructor”), enroll in them (a “Student”), or simply browse. Some sections call out whichever role they affect. This policy works alongside our Terms of Service; capitalised terms we do not define here have the meaning given there.

1. Who we are and how to contact us

Pyrean B.V. (trading as Vellum AI) is the data controller responsible for your personal data, except where this policy says an Instructor acts as an independent controller (see “Sharing between Students and Instructors”). We are incorporated in the Netherlands.

Privacy and data-protection enquiries: privacy@vellum.to
General support: support@vellum.to
Postal address: Keizersgracht 391-A, 1016 EJ Amsterdam, Netherlands

We are established in the Netherlands, in the European Union, and are therefore directly subject to the GDPR. Our lead supervisory authority is the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens. (In this policy, the “EEA” means the European Economic Area.) You can also raise concerns with the supervisory authority in your own country (see “Contact us and complaints”).

2. The personal data we collect

We collect the following categories of personal data, depending on how you use the Service.

Information you give us

Account and identity data — your name, email address, and the password and login method managed by our authentication provider. Instructors may add a public handle and a short description of their role or expertise.
Interview content — the answers, stories, and details you share with our AI interviewer, including any voice notes you record. Voice notes are transcribed to text; we keep the transcript, and the audio is processed only to produce it.
Course content — the lessons, scripts, descriptions, prices, and any videos or images you upload for your course.
Payment and billing data — for Instructors, the details needed to pay you and to bill any subscription plan; for Students, a record of the courses you enrol in and what you paid. Card and bank details are entered directly with our payment processor and are never stored on Vellum’s servers (see “How we share your data”).
Communications — messages you send us, including support requests and feedback.

Information we collect automatically

Usage and device data — basic technical information such as your IP address, browser and device type, and the pages and actions you take, collected to operate, secure, and improve the Service.
Diagnostic data — error reports and performance traces generated when something goes wrong, used to diagnose and fix problems.
Cookies and similar technologies — see “Cookies and similar technologies” below.

Information we receive from others

From our authentication provider — your name, email, and authentication metadata when you sign up or log in.
From our payment processor — confirmation that a payment or payout succeeded, the amount, and the identifiers we need to reconcile it, but not your full card or bank details.
From platforms you connect — if you choose to connect an external account (such as YouTube, X, LinkedIn, Substack, or Notion) to import your own content as course sources, we receive your profile and content data from that platform, as described in “Connected accounts and imported content”.

3. How and why we use your data

We use your personal data only where the law allows. The table below sets out each purpose and the legal basis under Article 6 GDPR that we rely on for it.

Purpose	Data used	Legal basis
Create and manage your account	Account and identity data	Performance of our contract with you (Art. 6(1)(b))
Run the AI interview and generate, edit, and host your course	Interview content, course content	Performance of our contract with you (Art. 6(1)(b))
Import your content from platforms you choose to connect, as sources for your course	Connected-account profile and content data	Performance of our contract with you (Art. 6(1)(b))
Process course purchases, payouts, and subscription billing	Payment and billing data	Performance of a contract (Art. 6(1)(b)); compliance with tax and accounting law (Art. 6(1)(c))
Give Instructors the information they need about their Students	Enrolment data, Student account data	Performance of a contract (Art. 6(1)(b)); our legitimate interests in operating a marketplace (Art. 6(1)(f))
Promote the platform and feature courses (including using uploaded assets in marketing)	Course content, public profile data	Our legitimate interests, and the licence you grant in our Terms (Art. 6(1)(f)); consent where required (Art. 6(1)(a))
Send you service messages and, where permitted, marketing	Account and identity data, communications	Legitimate interests or your consent (Art. 6(1)(a)/(f))
Keep the Service secure, prevent fraud and abuse, and fix errors	Usage, device, and diagnostic data	Our legitimate interests in protecting the Service (Art. 6(1)(f))
Comply with legal obligations and resolve disputes	Any relevant data	Compliance with a legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f))

Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms. You can object to that processing at any time (see “Your privacy rights”). Providing account and payment data is necessary to use the paid parts of the Service; without it we cannot deliver them.

4. AI and automated processing

Vellum uses artificial intelligence to interview you, transcribe your voice notes, and draft and rewrite your course. To do this, the relevant text and audio are sent to our AI provider, which processes them on our behalf as a data processor under contract.

We do not use your content to train third-party AI models, and our AI provider does not use data submitted through our business API to train its models.
Limited provider retention. Our AI provider may keep a short-lived copy of requests to monitor for abuse and keep its service secure, after which it is deleted — unless a longer period is required by law.
No solely automated decisions with legal effect. The AI assists you in producing a course; it does not make decisions that produce legal or similarly significant effects about you within the meaning of Article 22 GDPR. You review and edit everything the AI drafts, and a human (you) decides what to publish. We may also use automated checks to detect fraud and abuse and to rank or recommend courses; these do not produce legal or similarly significant effects on you, and where any automated decision would, we provide human review and the safeguards in Article 22(3).
Quality monitoring. A sample of AI requests and responses, together with account and course identifiers, is traced so we can monitor and improve quality, cost, and reliability.

5. Connected accounts and imported content

Instructors can connect external accounts — currently YouTube, X, LinkedIn, Substack, and Notion — so Vellum can import their own content as sources for their course. Connecting is always your choice and happens through the platform’s own authorisation flow, which shows you exactly what access you are granting. Depending on the platform, we access your basic profile there (such as your name, handle, account identifiers, and email address where the platform provides it) and a listing of your content — such as the titles, descriptions, links, thumbnails, and publication dates of your videos, posts, articles, or pages. We request read-only access and only the scopes the import needs.

We use this data for one purpose: building the source library that informs your AI interview and course drafts. Like your other course sources, it is processed by the service providers that run Vellum — including our AI provider acting as a data processor — and by no one else. We do not use content or personal data from connected accounts for advertising of any kind, do not share it with our advertising or conversion-measurement partners, do not sell it, and do not use it to train AI models.

You can disconnect a platform at any time in the app. Disconnecting immediately deletes the stored access credentials and stops all further retrieval, and you choose whether to also delete the sources already imported from that platform or keep them in your source library. Sources you keep are treated like any other course source and follow “How long we keep your data”. You can also revoke Vellum’s access from the platform’s own account or security settings at any time.

Google and YouTube

If you connect a YouTube account, Vellum uses YouTube API Services and Google’s authorisation (OAuth) service. Through them we access your Google account’s basic profile (name, email address, and account identifiers) and, read-only, your YouTube channel and the metadata of its uploaded videos — titles, descriptions, thumbnails, and privacy status. By connecting YouTube you also agree to the YouTube Terms of Service; the Google Privacy Policy describes how Google handles data on its side.

Vellum’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, Google user data is never shared with our advertising or conversion-measurement partners, never used for advertising, never sold, and never used to train AI models. Besides disconnecting in the app, you can revoke Vellum’s access to your Google account at any time from your Google security settings.

6. How we share your data

We do not sell your personal data for money. We share it only with the categories of recipients described below: service providers that help us run Vellum, marketplace participants where needed to deliver courses, advertising and conversion-measurement partners that help us understand and improve our advertising, and recipients required for legal, safety, payment, or business-transfer reasons. Where a recipient processes personal data on our behalf, we require contractual confidentiality, security, and data-protection obligations. Some recipients, such as payment networks, external identity providers, or advertising platforms, may also act as independent controllers for limited purposes under their own legal obligations.

Recipient category	Purpose	Data handled	Location
Authentication, identity, and abuse-prevention providers	Creating accounts, signing users in, managing sessions, and protecting auth flows from abuse	Name, email address, login method, authentication metadata, and technical anti-abuse signals	United States and global
Application infrastructure, database, hosting, and content-delivery providers	Hosting the Service, storing application records, running backend functions, and delivering pages and content	All account, interview, course, and enrollment records	United States and global
AI model and transcription providers	Running the AI interview, transcribing voice notes, generating courses, and rewriting lessons	Interview answers, voice-note audio for transcription, course text	United States
AI observability and quality-monitoring providers	Tracing AI requests, monitoring quality, reliability, cost, and abuse patterns	AI prompts and responses, account, interview, course, and generation identifiers, token usage, and technical metadata	United States and global
Product and website analytics providers	Understanding how the Service and marketing site are used so we can improve them (on by default; you can decline in the cookie notice)	Usage events, page views, device and browser metadata, IP-derived approximate location, and pseudonymous analytics identifiers	United States and global
Advertising and conversion-measurement providers	Measuring and improving our advertising through browser pixels and server-side conversion APIs (Meta, TikTok). The browser pixels are on by default and can be declined; the server-side measurement of transactions and concrete steps towards them — checkout starts, purchases, plan sign-ups, registrations — happens regardless of the cookie choice, as it is tied to the transaction or checkout rather than a browser cookie	Hashed email address, IP address, browser user-agent, advertising cookie identifiers, and — for purchases — amount, currency, and country	United States and global
Payment, billing, tax, fraud-prevention, and payout providers	Payment processing, payouts, and subscription billing	Payment and payout details, billing identifiers, transaction records, tax information, fraud signals	United States and global
Media storage, transcoding, and delivery providers	Storing, processing, and delivering uploaded course videos and images	Uploaded videos and images, media metadata, delivery request metadata	United States and global CDN
Error monitoring, diagnostics, and logging providers	Detecting, diagnosing, and fixing errors, performance issues, and security problems	Error reports, stack traces, technical diagnostics, request metadata, account and correlation identifiers	United States and global
Optional user-selected identity providers	Letting users sign in with external identity accounts when they choose that method	Identity-provider account identifiers, name, email address, profile metadata, authentication confirmation	Determined by the provider
Content platforms you choose to connect	Fetching your profile and your content from an external platform when you connect it as a course source (see “Connected accounts and imported content” in the Privacy Policy)	Authorisation tokens, platform account identifiers, and requests for your profile and content on that platform	Determined by the platform
Instructors, Students, and public visitors	Operating the course marketplace, delivering courses, showing public course pages, and supporting course interactions	Public profile and course content; Student enrolment, progress, messages, reviews, posts, or comments where relevant	Where those users are located
Professional advisers, authorities, and transaction counterparties	Complying with law, enforcing our terms, protecting rights and safety, resolving disputes, and handling business transfers	Relevant account, transaction, communications, technical, and course data depending on the request or transaction	Where the recipient is located

We may also disclose personal data: (a) to comply with the law, a court order, or a lawful request from a public authority; (b) to enforce our Terms of Service or protect the rights, safety, and property of Vellum, our users, or the public; and (c) in connection with a merger, acquisition, financing, or sale of assets, in which case we will require the recipient to honour this policy or notify you of any material change. A business transfer of this kind is not a sale of your data for advertising.

8. Marketing and your communication preferences

We send two kinds of messages: service messages (for example, receipts, security alerts, and important changes to the Service or this policy), which are necessary and which you cannot opt out of while you hold an account; and marketing messages about features, tips, and offers, which you can opt out of at any time.

You can unsubscribe from marketing using the link in any marketing email or by contacting us. Where the law requires consent for marketing, we ask for it and you may withdraw it at any time. As described in our Terms of Service, Vellum may also feature published courses and the assets you upload (such as cover images, video clips, and your public profile) in its own marketing and across the Service; where those assets contain your personal data we rely on the licence you grant us and our legitimate interest in promoting the platform, and, where required, your consent. If you withdraw consent or object, we will stop using your personal data for new marketing going forward, but this does not require us to recall materials we have already published or distributed.

9. International data transfers

As a controller established in the EU, Vellum is the data exporter for these transfers. Some categories of recipients store or process personal data in the United States and, for hosting, security, and content delivery, at global edge locations. This means your personal data may be transferred outside the EEA to countries that may not provide the same level of protection as your own.

Where we make such transfers, we rely on appropriate safeguards recognised under the GDPR — primarily the European Commission’s Standard Contractual Clauses; or, for recipients certified under the EU–US Data Privacy Framework, that framework; or another finding of adequacy where one applies. You can ask us for a copy of the safeguards we use by contacting privacy@vellum.to.

10. How long we keep your data

We keep personal data for as long as we need it for the purposes set out in this policy, and then delete or anonymise it. In practice:

Account, interview, and course data is kept while your account is open and deleted within 90 days of account closure, except where it must be retained to honour Student access (see below) or to meet a legal obligation.
Transaction and tax records are kept for as long as tax and accounting law requires — generally up to 10 years — even after your account closes.
Published course content that Students have purchased is retained for as long as those Students keep access to it (see our Terms of Service), even after the Instructor leaves.
Diagnostic and AI-tracing data is kept for up to 90 days for security and quality purposes and is then deleted automatically.
Content you contribute to shared spaces — such as reviews, posts, or comments — may remain visible after your account closes, as explained in “Account closure and data deletion”.

11. Your privacy rights

If you are in the EEA, you have the following rights over your personal data under the GDPR. Comparable rights may apply under the laws of other countries where you live.

Access — to be told whether we process your data and to receive a copy of it.
Rectification — to have inaccurate or incomplete data corrected.
Erasure — to ask us to delete your data in certain circumstances (the “right to be forgotten”).
Restriction — to ask us to limit how we use your data while a concern is resolved.
Portability — to receive certain data in a structured, machine-readable format and to have it transmitted to another controller where technically feasible.
Objection — to object to processing based on our legitimate interests, and to object to direct marketing at any time.
Withdraw consent — where we rely on consent, to withdraw it at any time, without affecting processing already carried out.
Lodge a complaint — to complain to a data-protection supervisory authority (see “Contact us and complaints”).

To exercise any of these rights, email privacy@vellum.to. We will respond within the time the law allows (generally one month) and will not charge a fee except where permitted. We may need to verify your identity first. Note that some data must be retained for legal reasons, and that content connected to courses Students have purchased, or content you have contributed to shared spaces, may be retained or remain visible as described in this policy and our Terms.

12. Cookies and similar technologies

Vellum uses cookies and similar technologies. Some are strictly necessary to run the Service — for example, to keep you logged in securely and to protect against fraud; these are required for the Service to function and do not need consent. We also use analytics cookies, through PostHog and Google Analytics, to understand how the Service is used so we can improve it, and advertising and conversion-measurement cookies, through Meta (Facebook and Instagram) and TikTok, to measure and improve our advertising.

Analytics and advertising cookies are on by default; you can turn the browser-based ones off at any time by choosing “Decline” in our cookie notice, and we will stop non-essential analytics and pause the Meta and TikTok advertising pixels on your device. You can also control cookies through your browser settings, though blocking strictly necessary cookies may stop parts of the Service from working.

Separately from those cookies, when you complete a transaction with us or take a concrete step towards one — starting a paid checkout, buying a course, starting or subscribing to a plan, or creating an account — we send a server-to-server record of that event to Meta and TikTok using their Conversions and Events APIs, so we can measure and improve our advertising. Because that measurement is tied to the transaction or checkout rather than to a browser cookie, it happens whether or not you accept cookies. The data we send is limited to what those platforms need to match the event — such as a hashed (pseudonymised) version of your email address, your IP address, your browser user-agent, and, for checkouts and purchases, the amount, currency, and (for purchases) country. We do not sell this data for money. If you would prefer we not carry out this transaction-based advertising measurement for you, contact us at privacy@vellum.to.

13. Children’s privacy

Vellum is not directed to children. To use the Service you must be at least 16 — or, if your country sets a lower age of digital consent under Article 8 GDPR, that age, but never under 13. Buying or selling courses has the higher age requirements set out in our Terms of Service. We do not knowingly collect personal data from children below the applicable age. If you believe a child has provided us with personal data, contact us at privacy@vellum.to and we will delete it.

14. How we protect your data

We use technical and organisational measures appropriate to the risk to protect your personal data, including encryption in transit, access controls, isolation of secrets, and careful selection of service providers that maintain their own security and compliance programmes. Card and bank details are handled directly by PCI-compliant payment providers and never stored on our servers.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a personal-data breach that is likely to put your rights at risk, we will notify the relevant supervisory authority, and you, as and where the law requires.

15. Account closure and data deletion

You can ask us to close your account and delete your personal data at any time by contacting privacy@vellum.to. When you do, the following applies.

You lose access to courses. Closing your account ends your access to courses you created or enrolled in, including any course you bought with “lifetime access”. Lifetime access lasts for the life of *your* account; it does not survive your own account deletion.
Students keep their access when an Instructor leaves. If you are an Instructor, closing your account or removing a course does not remove access for Students who already enrolled — we retain and continue to serve that course to them under the licence described in our Terms of Service.
Content you contributed to shared spaces stays. Reviews, posts, comments, and similar contributions you made to shared or community areas may remain on the platform after your account closes. Where practical we disassociate them from your name, but the content itself may persist — we rely on the legitimate interests of other users and the integrity of community discussions (Article 17(3) GDPR) to retain it.
Some data is retained. We keep what we must for legal, tax, security, and dispute-resolution reasons, and we may keep anonymised or aggregated data that no longer identifies you.

16. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you by email or through the Service. Your continued use of the Service after an update means you accept the revised policy, except where your consent is required by law.

17. Contact us and complaints

For any privacy question or to exercise your rights, contact us at privacy@vellum.to or by post at Keizersgracht 391-A, 1016 EJ Amsterdam, Netherlands.

If you believe we have not handled your data properly, you have the right to lodge a complaint with a data-protection supervisory authority. Our lead authority is the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl); if you are elsewhere in the EEA, you may also complain to your own local authority. We would, however, appreciate the chance to address your concern first.

This document is provided for transparency about how we handle your data. Questions? See the contact details above.