Privacy Policy

1. Who we are

Marsalis ("we", "us", "our") is operated by Vela AI Ltd, a private limited company registered in England and Wales (company number 17235407), with its registered office at 66 Paul Street, London EC2A 4NA, trading at marsalis.co.uk. For the purposes of UK GDPR and the Data Protection Act 2018, we are the data controller of personal data processed through Marsalis.

For any privacy-related questions, requests, or complaints, contact us at:

Email: support@tryvela.co
Postal address: 66 Paul Street, London EC2A 4NA

If you are located in the European Union, our EU Representative under Article 27 EU GDPR is not yet appointed (pending — to be appointed before accepting EU users, or EU access restricted at launch).

You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk at any time. If you are in the EU, you may also complain to your local supervisory authority.

2. What this policy covers

This policy explains what personal data we collect when you use Marsalis, why we collect it, how we use it, who we share it with, how long we keep it, and what rights you have over it.

This policy applies to:

• The Marsalis platform at marsalis.co.uk
• The Marsalis marketing website at marsalis.co.uk
• Any other product, integration, or service we offer under the Marsalis name

This policy does not apply to third-party services you connect to Marsalis (Gmail, Outlook, HubSpot and GitHub) or to services we use to run Marsalis (such as Stripe) — those services have their own privacy policies that apply to your use of them.

3. Who can use Marsalis

Marsalis is intended for use by adults aged 18 or over operating, founding, or working in business contexts. By creating an account, you confirm that you are at least 18 years old. We do not knowingly collect personal data from anyone under 18. If we discover that we have collected data from someone under 18, we will delete it promptly.

4. The data we collect

4.1 Account information

When you create an account, we collect:

• Your email address
• A password (which is stored only as a salted hash — we never store your password in plain text)
• Confirmation that you have accepted these terms

You verify your email address within 24 hours of signup. Unverified accounts may be deleted.

4.2 Onboarding information

During onboarding, you provide information about you and your business. This includes:

• Your name (as you wish to be addressed)
• Your company or project name
• The size of your company
• Your competitors (if you choose to share them)
• Your company's stage
• Any text, PDFs, or URLs you upload during onboarding
• Any additional context you provide before completing onboarding

This information is stored in your founder memory and used to give your AI team relevant context when they work for you.

4.3 Knowledge base uploads

You can upload URLs, PDF files, and documents to Marsalis's knowledge base. We store these uploads on our servers (hosted in the European Union via Supabase) and process them through our AI providers in order to make their content available to your agents. We do not currently accept image uploads to the knowledge base.

By uploading content, you confirm that you have all necessary rights to use it (see our Terms of Service for the full warranty).

4.4 Agent interaction data

When you interact with your AI agents in your boardroom or in direct messages, we collect and store:

• Message content and timestamps
• Behavioural patterns (such as response times, frequency of engagement, and which agents you interact with most)
• Sentiment and tone signals (used to help Vera coordinate the team around you)
• Vera's inferred state about how you are working (such as periods of higher pressure or distraction)

This data is used to make your team more useful to you specifically over time. We explain how this constitutes profiling under Section 5 below.

4.5 Integration data

If you connect third-party services to Marsalis, we collect data from those services as required to provide the integration. Specifically:

• Telegram: if you connect Telegram for notifications, we store your Telegram chat ID. We send Marsalis's outbound messages (briefings, notifications) to that chat ID. If you message your team from Telegram, their replies go back to that chat, and may mention what an email said. We do not read your other Telegram conversations.
• Calendar: we store calendar entries you create through Marsalis on our servers, including titles, descriptions, times, permission tiers, and statuses. Calendar entries created by Marsalis on your behalf are stored under the same model.
• Email we send you. We use Resend to send you service emails (welcome, briefings, reminders, billing).
• Connected Gmail (optional). If you connect a Gmail account, your team can send email from it, but only emails you have approved. We keep a record of what was sent on your behalf, to whom, when and why, which you can see in the app. Data received from Google APIs is handled under the Limited Use commitment in Section 4.5.1.
• Reading Gmail (optional; off unless you turn it on). If you also turn on reading, Marsalis looks at the sender, recipients, subject, time and folder of mail in your Gmail inbox and sent mail, starting 14 days back, to find mail sent to you by someone on your Contacts list, and mail you sent to them. For those messages only, it keeps the newest text, up to 4,000 characters, any dates the email mentions, the subject, when it was sent, who on your list it involved, whether you or they wrote it, and Google's reference for the message so that a reply can go in the same conversation. Your team uses this to raise emails that need you, to answer when you ask about someone's email, sometimes quoting it in your boardroom, and to prepare replies for you to approve. Before your team's AI model sees any of it, it is checked for hidden instructions by an automated check that itself uses an AI service. What's kept is deleted 90 days after the mail was sent, and at once when you disconnect Gmail in Marsalis. If you turn reading off but stay connected, the text and dates are deleted at once, and the record that the email was exchanged (who, when, the subject, who wrote it and Google's reference for it) stays until it is 90 days old. A boardroom message that quotes an email, and anything your team remembered from it, stays until you delete your account. Marsalis never changes, labels or deletes your mail. Reading Gmail is being introduced gradually and may not be available on your account yet.
• Connected Outlook / Microsoft 365 (optional; reading, contacts and sending). If you connect a Microsoft account:
  • Mail involving people on your list. Your team looks at the sender, recipients, subject, time and whether you have opened it, for mail in your Inbox and Sent Items — starting 14 days before you connect — that involves someone already on your Contacts list. It matches people by exact email address. Mail that does not involve someone on your list is not opened and nothing about it is kept.
  • Dates in those messages. For those messages, your team reads the message's own newest text to find upcoming dates (for example "Thursday at 2") and keeps each date with the few words it came from (up to 80 characters, at most five per message). Unless you allow your team to read your email (below), the text is then discarded.
  • Message text, if you allow it. If you allow your team to read your email, Marsalis also keeps that newest text, up to 4,000 characters, for messages in your own mailbox, including messages it had already matched. It never keeps earlier messages quoted below. It keeps an attachment only when you choose to add it as someone's CV. Before that, and only if you have agreed to it, it keeps the name, type and size of a PDF or Word file sent to you, and who sent it, so it can offer it to you. If you do not act on it, that note is deleted with the rest after 90 days. From a shared mailbox, no text is kept beyond the date words above.
  • What is stored. For each matching message: who on your list it involved, whether they wrote to you or you wrote to them, the time, whether it has been read, the subject line (up to 200 characters), any upcoming dates with the few words each came from, and, if you allowed it, the text above.
  • What your team does with it. Roman uses that text when you message your boardroom: to raise up to three emails that need you, and to answer when you ask about someone's email. For this, the text is sent to our AI model provider: Microsoft Azure OpenAI, or Google Gemini if Azure can't take the request. What Roman writes about an email becomes part of your boardroom conversation. The rest of your team sees it and may remember it, and it is kept like any other conversation, memory or draft, including after the email's text is deleted. When Roman drafts a reply, you approve it before it is sent.
  • The people who wrote to you. The text is written by people on your Contacts list. For their information you are the controller and Marsalis processes it on your behalf (see 4.6).
  • People who are new to you. When you message your boardroom, your team may check who has emailed your Inbox since you connected and is not on your Contacts list — sender and subject only, never the message body — so it can offer to add them. That offer names them, their address and the subject of their latest email, and it stays in your boardroom conversation. Their address is remembered so you are not asked about the same person again for at least 90 days. Nobody is added unless you choose to add them.
  • Shared mailboxes. If you have access to a shared mailbox, nothing in it is read unless you add that mailbox yourself in Settings. Your team cannot send from a shared mailbox.
  • Your Outlook contacts. Your contacts are read only when you ask to bring them in. You are shown how many would be added and what would be held for them first, and nobody is added until you confirm.
  • Sending. Your team can send email from your Outlook address — only an email you have approved, and the approval card shows which address it will send from before you approve it.

  You can disconnect Outlook at any time in Settings → Connections. Disconnecting immediately deletes the mail details we hold from it and removes the addresses we remembered from offers; where an offer already appears in your boardroom conversation, the person's details are replaced with a note that they are no longer kept, so your own transcript keeps its shape. Contacts you chose to import stay on your Contacts list, because they are yours. You can also stop your team reading your email without disconnecting, in Settings → Connections; the kept text is deleted at once.

• Enquiries: with your consent, Marsalis also reads new-enquiry emails in your Outlook inbox from property portals, job boards and your CRM, including from people not yet in your contacts. From an enquiry it keeps only the person's name, email address and phone number, what they asked about and their own message, so your team can suggest adding them and draft a reply you approve. If you add them, they become a contact — and, when the enquiry names exactly one of your properties or roles, an applicant or candidate on it. What was kept from the enquiry is deleted 90 days after the email arrived, whether or not you added them, and at once if you withdraw the permission. When Marsalis can't read an enquiry's layout, the email's text is sent to our AI providers (Section 6) to find those details, and the card says it was read by AI so you can check them.
• Meeting invitations: Marsalis reads the title, time, place, organiser and attendees of meeting invitations in your inbox, so you can add them to your Marsalis calendar with one tap; nothing is written to your Outlook calendar.
• Work done while you're away: your team may review new emails and prepare drafts and suggestions outside your working hours. Everything it does is recorded in your boardroom with when and why, and nothing is sent without your approval.
• Other integrations: you can also connect HubSpot and GitHub, which we read to answer questions you ask about them. As you connect these services we store the credentials and access tokens needed to operate the integration. Tokens are stored in a credentials vault and used only as needed to fulfil tasks you have approved.

4.5.1 Data from Google APIs

Marsalis's use of information received from Google APIs, including Google Workspace scopes, will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4.6 People in your book

When you add people to Marsalis — clients, candidates, applicants, landlords, tenants, buyers — and track them against a role or a property, we store what you give us: their name and contact details, the role or property they're linked to, the stage it's at, any notes you write, and a dated record of each change.

You decide who goes in and why. For this information you are the controller, and Marsalis processes it on your behalf and on your instructions. We never use it to train AI models, never share it with another Marsalis account, and only contact these people when you approve a specific email.

Leads. You can keep a list of leads: companies and people you might work with, which you add yourself, import from a spreadsheet, or paste from a job advert. For each lead we keep the company, the person it is about (someone on your Contacts list), who told you about it, its stage, how warm it is, the next step and when, your notes, the jobs you spotted (title, place, pay, where you saw it and its link) and a dated record of each change. A spreadsheet you import is read once and not kept. The text of an advert you paste is read to fill in the job and is not kept. When you ask your team to research a lead, the company's name (or the job's title) is sent to our search provider and the dated public results to our AI providers (Section 6); we never search for a person. A lead stays until you delete your account; archiving one hides it and keeps it. If you delete the person from your Contacts, the lead stays without them, with any notes you wrote.

If someone asks you to delete their details, deleting them from your Contacts removes their record, their links to roles or properties and the history of those links, and the mail we matched to them. The roles and properties themselves stay on your desk. Their name may still appear where it was written elsewhere in your account — for example, conversations with your team, emails your team drafted or sent, tasks, calendar entries and notes you wrote, what your team has remembered, and documents you uploaded or asked the team to write. You can delete documents you uploaded yourself; everything else is deleted when you delete your account. (Archiving a boardroom hides it but keeps what is in it.) If your team had offered to add them to your Contacts, we keep their email address on a short list so you aren't asked about them again: addresses that came from your Outlook inbox are removed within 90 days (sooner if you disconnect Outlook); others may stay until you delete your account. Deleted information leaves our backups within 90 days, and everything is deleted when you delete your account.

When a recruiter sends you a link to choose an interview time, we record the time you choose and when you chose it, and add it to that recruiter's Marsalis diary. The page shows only the times the recruiter offered; we do not ask you for anything else, and the link stops working once a time is chosen or after 14 days.

4.6.1 The Marsalis Chrome extension

If you install the Marsalis extension for Chrome, it reads the LinkedIn profile you are looking at only when you click its button: the person's name, headline and location, the organisations the profile shows, and the profile's address. It sends the name to your Marsalis account to check whether that person is already among your contacts, and saves them — their name, the company you pick or confirm, and their headline, location and LinkedIn address in the notes — only when you click Add. Undo removes them. "Draft a message" puts a request to Roman in your boardroom; your team reads it only once you send it. The extension never sends anything on LinkedIn, and never reads any other page, your messages or your feed.

To sign in, the extension receives your current Marsalis sign-in from marsalis.co.uk when you click "Connect the extension". It is kept in your browser's memory only, never on disk, and ends when you disconnect, sign out of Marsalis or close the browser — and an hour after Marsalis was last open. The extension sends us nothing about your browsing.

People you add this way are part of your book, and Section 4.6 applies to them: you decide who goes in, and we process their details on your behalf.

4.7 Finance tracker data

If you use the finance tracker feature, you enter your financial data manually. This includes revenue figures, costs, balances, and transactions you enter. We do not access your bank account, card details, or any financial institution directly. We do not handle Open Banking credentials. All financial data in the finance tracker is data you manually enter or approve.

Felix (your finance agent) may make observations about this data and suggest actions. Felix does not provide regulated financial advice. All observations are based on your data with your permission and should not be relied upon as professional financial guidance.

4.8 Billing information

Payment details (card numbers, billing addresses) are collected and processed by Stripe, our payment processor. We do not store your card details. We store the minimum information needed to manage your subscription, including your subscription tier and status, your billing email (if different from account email), and a reference to your Stripe customer record.

4.9 Usage and analytics data

We collect data about how you use Marsalis in order to improve the service. This includes:

• Pages visited, features used, time spent
• Events such as signup, onboarding completion, first agent interaction, subscription changes
• Device, browser, and operating system information
• Approximate location based on IP address (country and region only — we do not collect precise location)

This data is processed by PostHog (hosted in the EU, on eu.posthog.com) and Google Analytics 4. See our Cookie Policy for details on how this works and how to opt out.

Your choice. Product analytics only run if you accept analytics cookies on the banner shown on your first visit. You can decline — choosing “Reject non-essential” (or turning off the Analytics toggle under “Manage”) means we will not track your usage patterns. Core product features work exactly the same either way; nothing about your team, your boardroom, or your account depends on analytics being on.

We count visits to our public pages and presses of the sign-up button as daily totals. This uses no cookies and keeps nothing that identifies you or your device.

Retention. Analytics events are retained for up to 12 months from collection. If you delete your account, we also delete your associated analytics history (your PostHog person and their events) within 30 days of the account deletion completing, alongside the rest of your data.

4.10 Voice notes and pasted conversations

You can speak to your team — a voice note after a call or viewing, or a message you dictate — or paste a conversation, such as a WhatsApp or text thread, an email or your own notes. Your voice is sent to Microsoft (Azure OpenAI) to be turned into text; the audio is held only in memory for that one request and is never stored by Marsalis. The text of a voice note or a pasted conversation is sent to our AI providers (Section 6) to propose updates to your book. Nothing is saved until you choose which updates to keep, and only what you choose is kept — as notes, stages, contact details, new contacts, new properties or roles, what a client asked for on a role or property, tasks, calendar entries (and, when your team moves one for you, the time it had, so you can undo the change) or email drafts waiting for your approval — where you can see, change and delete it. If you upload or paste a job spec, Marsalis reads it to suggest the role's details and what the client asked for. The file and its text are not kept. Only what you choose is saved. A pasted conversation contains other people's words: before you paste one, you confirm you have the right to use it, and for the people in it you are the controller, as set out in Section 4.6. Details your team suggests from a contact's own email signature come only from emails you allowed your team to read, and are added only when you tap them. When you ask your team in a typed message to change your book or diary, the change is kept the same way, and you can undo it.

4.11 Documents you upload about people in your book

If you upload a document about someone in your book, such as a candidate's CV, or ask Marsalis to take one from an email, Marsalis stores the file and the text in it. A CV you upload before its person is on your list is kept until you add them, and deleted within 24 hours if you don't. The text is checked for hidden instructions and then sent to Microsoft Azure OpenAI to suggest details for that person's record, each shown with the words it came from. Nothing is added to their record until you choose it. Marsalis does not score, rank or reject anyone, and does not take details such as date of birth, health, religion or ethnicity from a document. When you ask for a CV pack, the layout and the removal of contact details are done by fixed rules; the summary and cover note are drafted only from the CV, your notes and the role, checked against the CV, and you approve them before anything is sent. For the people in these documents you are the controller and Marsalis processes the documents on your behalf (Section 4.6). A document and its text are deleted when you delete the document or the person, and with your account; they leave our backups within 90 days.

4.12 Try a role

Try a role, on our home page, without an account. When you paste a job advert, we first remove email addresses, phone numbers and the names of people it gives as contacts, then send the rest to our AI providers (Section 6) to write the cards, and the job's title and location to our search provider to find what the market pays. We do not keep the advert or the cards: they exist only for that request and in your browser. If you then start a trial and choose to keep them, they are saved to your new account. To stop the page being overused, we count tries per visitor using a code made from your internet address that cannot be turned back into it; the count is held only in our server's memory, never stored, and resets within a day. We also count how many tries happen each day, in total, with no detail about who made them.

5. Profiling and automated decision-making

Marsalis performs personalisation and automated behavioural inference that constitutes profiling under Article 22 UK GDPR. We disclose this here because we believe in transparency.

What we infer

Your AI team uses your interaction history to:

• Adapt to your communication style (length, tone, frequency)
• Build a working model of your business context
• Anticipate which suggestions you are likely to find useful
• Identify periods when you appear under pressure (Vera coordinates the team accordingly)
• Recognise patterns in your decision-making over time

How you control it

This profiling is core to Marsalis's value — your team gets to know you and becomes more useful over time. We do not make solely-automated decisions that produce legal or similarly significant effects on you without your involvement. All significant agent actions require your approval unless you explicitly enable autonomous execution via the Freedom Dial.

You can control the profiling that happens in Marsalis:

• Settings → Agent Settings → Growth & Learning lets you control how each agent learns, including options to turn learning off entirely, limit learning to 30 days, or roll back an agent's development to a previous state.
• Settings → Freedom Dial lets you control how much autonomy agents have. The default is approval-required for all significant actions.
• Settings → Vera → Preferences lets you control what Vera infers and how she coordinates the team around you.

You have the right to object to profiling at any time. To object, contact us at support@tryvela.co or use the in-product controls above.

6. How Marsalis uses AI

Marsalis's service is delivered through a multi-provider AI routing system. We are transparent about this because it is uncommon and the implications matter.

How routing works

When you interact with agents, your messages and any necessary context are routed to the AI provider best suited to the specific task. This may be:

• Microsoft (Azure OpenAI) runs your team. Our Azure resource is in the United Kingdom, and anything Microsoft stores is kept there; requests themselves may be processed in other regions where Microsoft runs the model.
• Google (Gemini models) — used for certain background tasks, and if Azure can't take a request
• Brave Search — used when web search is needed

Data minimisation

Each AI provider receives only the context necessary to complete the specific task. No provider receives more than is needed.

Provider data use

Microsoft and Google don't use what we send them to train or improve their models. For Google this holds because we use its paid Gemini service; its free service is different. Each may keep prompts and responses for a limited time, only to check for misuse of its service. Brave Search receives only the search terms an agent looks up, not your conversations.

How Marsalis's agents are improved

Marsalis's agents are continuously improved using behavioural patterns extracted from publicly-available business literature, podcasts, and articles. These patterns are paraphrased and attributed; no verbatim third-party content is reproduced. Your private data and conversations are never used to train cross-user behavioural patterns. Your data stays yours.

Marsalis's agent personality archetypes are abstracted from publicly-available business literature and operational patterns. They do not reproduce, endorse, or imply association with any specific individual.

Visibility

The app doesn't show which provider handled a request. If you want to know, email support@tryvela.co and we'll tell you.

7. How our AI provider list evolves

Marsalis continuously monitors the AI ecosystem for new tools and providers that could improve the service. Changes are categorised by data implication:

Within-provider improvements

When an existing AI provider releases a better or cheaper model, we may begin routing relevant tasks to that model automatically. This does not change which third parties have access to your data and requires no separate notice.

New providers entirely

When a fundamentally new AI provider becomes available, we will not route user data to that provider until:

1. We have signed a Data Processing Agreement with them, and
2. We have updated this Privacy Policy to list them as a processor, and
3. We have given users at least 14 days' notice via email and in-product notification of the change.

Runtime web use

Marsalis's agents may read publicly available information from websites and public APIs during their work (for example, when researching a competitor or looking up market data). They will not send your personal or business data to any service that is not listed as a processor in this Privacy Policy.

Your right to object

You can object to a new processor being added to your data processing. If you object, your account will continue to function but may have reduced capability while we work with you to find an alternative or honour your objection.

8. Why we process your data — legal bases

Under UK GDPR Article 6, we rely on the following legal bases for processing your personal data:

We do not knowingly process special category data under Article 9 unless you voluntarily disclose it in conversation with an agent. In particular, if you disclose mental health information (such as stress, anxiety, or distress) in a conversation, Vera may use that disclosure to coordinate the team around you, but we do not store or process this in a clinical or medicalised category. Marsalis does not provide medical advice. If you are experiencing a mental health crisis, please contact your GP, NHS 111, or Samaritans on 116 123.

9. Third-party processors

We work with the following third-party processors. Each one has a Data Processing Agreement with us, and each processes your data only on our instructions and for the purposes set out below.

This list is current as of the date at the top of this document and reflects the actual state of Marsalis's processor relationships. When this list changes materially, we update this Privacy Policy and notify users in advance as set out in Section 7.

10. International data transfers

Some of our processors are based outside the United Kingdom. Our application servers are hosted by Railway in the Netherlands and our database is stored in Sweden, both in the EU. Railway is a US company, and several other services we use are US-based, so some personal data is processed in the United States. Our AI providers may process requests outside the United Kingdom.

Where we transfer personal data outside the UK, we rely on the safeguards contained in each processor's data processing agreement: the European Commission's Standard Contractual Clauses as amended by the UK Addendum issued by the Information Commissioner, and — where the processor is certified — the UK Extension to the EU-US Data Privacy Framework. Our EU-based processors do not require a transfer mechanism for data they hold in the EU.

You can ask us for details of the safeguard that applies to any processor at support@tryvela.co.

11. How long we keep data

We keep your data only for as long as needed for the purposes set out in this policy. When you delete your account, we delete your data within 30 days unless we are required to keep specific records for longer to comply with a legal obligation.

Backups are technical-recovery copies only and are not used for any other purpose.

12. Your rights

Under UK GDPR, you have the following rights over your personal data:

• Right of access — you can request a copy of all personal data we hold about you
• Right to rectification — you can ask us to correct inaccurate or incomplete data
• Right to erasure — you can ask us to delete your data ("right to be forgotten")
• Right to restriction — you can ask us to limit how we process your data
• Right to portability — you can ask for your data in a portable, machine-readable format
• Right to object — you can object to processing based on legitimate interests, including profiling
• Right to withdraw consent — if processing is based on your consent, you can withdraw it at any time
• Right not to be subject to solely automated decision-making — see Section 5

How to exercise your rights

The fastest way to access or export your data is to use the self-service controls in Settings → Account → "Export all my data" and "Delete my account." For any request that cannot be self-served, contact us at support@tryvela.co.

We will respond to requests within one month. Complex or numerous requests may extend this to up to three months; if so we will tell you within the first month.

You also have the right to complain to the UK Information Commissioner's Office (ICO) at any time, without contacting us first.

13. Cookies and similar technologies

See our Cookie Policy for information on the cookies and similar technologies we use.

14. Marketing communications

If you have given us your consent to send you marketing emails, we will send occasional emails about new features, product updates, and Marsalis news. You can withdraw consent at any time by:

• Clicking the unsubscribe link in any marketing email
• Adjusting your preferences in Settings → Notifications
• Emailing support@tryvela.co

Withdrawing consent for marketing does not affect transactional emails (such as billing notifications, password resets, or agent briefings), which we send as part of providing the service.

15. Children

Marsalis is not directed at children under 18 and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us at support@tryvela.co and we will delete the data promptly.

16. Security

We take reasonable technical and organisational measures to protect your personal data, including:

• TLS/HTTPS encryption for all data in transit
• Encryption at rest for data stored in our database
• Industry-standard password hashing (bcrypt) for stored credentials
• Access controls limiting who can access production systems
• Daily automated backups with point-in-time recovery (via Supabase Pro)
• Continuous monitoring of access and unusual activity

Security event logging

Marsalis logs security events (failed authentication, anomalous patterns, blocked requests) for the purpose of protecting the platform and its users. These logs include IP address, endpoint accessed, and detection signal, but never message content. Logs are retained for 90 days then aged out. We rely on legitimate interests and our legal obligation to keep the service secure (Article 6(1)(f) and 6(1)(c) UK GDPR) as the bases for this processing.

Threat intelligence

Marsalis's security agent (Veil) ingests public threat intelligence feeds (CVE, GitHub Security Advisories, AI safety disclosures) to identify vulnerabilities affecting the platform. No user data is sent to these external feeds.

We do not currently maintain formal certifications such as SOC 2 or ISO 27001. As Marsalis grows we expect to obtain appropriate certifications.

No security measure is perfect. If we become aware of a personal data breach that poses a risk to your rights, we will notify you without undue delay and notify the ICO within 72 hours, as required by UK GDPR Article 33.

17. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes (changes that affect your rights or significantly change how we use your data), we will:

• Notify you by email at least 14 days before the change takes effect
• Display an in-product notification of the change
• Update the "Effective date" and "Last updated" dates at the top of this policy

For minor changes (clarifications, corrections), we will update the "Last updated" date but may not send a separate notification.

This policy has not yet been reviewed by a solicitor. We will update it when it has been.

18. Contact

For any privacy-related questions, requests, or complaints:

Email: support@tryvela.co
Postal: 66 Paul Street, London EC2A 4NA

For our EU Representative (if you are in the EU): not yet appointed (pending — to be appointed before accepting EU users, or EU access restricted at launch)

For complaints to the UK regulator: Information Commissioner's Office

Version history

What changed in v1.25

• We now call the product Marsalis, and its website is marsalis.co.uk. The company, Vela AI Ltd, is unchanged, and so are our email addresses.

What changed in v1.24

• Section 4.6 now ends with how leads are kept: the companies and people you might work with.
• Added Section 4.12: trying a role on our home page without an account.

What changed in v1.23

• Section 4.10 now adds, after calendar entries: “(and, when your team moves one for you, the time it had, so you can undo the change)”, and ends: “When you ask your team in a typed message to change your book or diary, the change is kept the same way, and you can undo it.”

What changed in v1.22

• We added what we record when you choose an interview time from a recruiter's link.

What changed in v1.21

• We added uploading several CVs at once, and that a CV you don't add is deleted within 24 hours.

What changed in v1.20

• We added how Marsalis reads a job spec you upload or paste, and that the file is not kept.

What changed in v1.19

• Marsalis can now offer a CV emailed to you by someone who isn't on your list yet. It notes who sent it and the file's name, type and size until you choose.

What changed in v1.18

• We added how Marsalis handles a CV that someone emails you, and that nothing in the file is opened until you choose.

What changed in v1.17

• We now count visits to our public pages as daily totals, without cookies.

What changed in v1.16

• Added Section 4.11: documents you upload about people in your book, such as a candidate's CV.
• Section 4.10 now lists what a client asked for on a role or property.

What changed in v1.15

• Added how Marsalis reads Gmail for accounts that turn it on (Section 4.5).
• Our application servers moved from the United States to the Netherlands (EU).

What changed in v1.14

• Moved the version history to the end of the page.

What changed in v1.13

• Said that an enquiry's text may be read by our AI providers when its layout isn't recognised, and that an invitation's title is read.

What changed in v1.12

• Added how Marsalis reads enquiries and meeting invitations, and what your team does while you're away, for accounts that agree to it (Section 4.5).

What changed in v1.11

• Added how the Marsalis extension for Chrome works (4.6.1) and how voice notes and pasted conversations are handled (4.10).

What changed in v1.10

• Added Section 4.5.1: our use of data from Google APIs follows Google's API Services User Data Policy, including its Limited Use requirements. Section 4.5 already pointed to this commitment, but the policy did not contain it.

What changed in v1.9

• Said that our AI providers may process requests outside the UK, and removed a description of router settings the app doesn't have.

What changed in v1.8

• Removed AI providers we don't use (Anthropic and OpenAI), said plainly how Microsoft and Google treat what we send them, and where Microsoft processes it.

What changed in v1.7

• Outlook: if you allow it, your team can now read the text of email with people on your list. Section 4.5 says what is kept, what your team does with it and how to stop it; Section 11 says how long it is kept. Telegram: if you message your team from Telegram, their replies go back to that chat.

What changed in v1.6

• Corrected which AI service runs your team: Microsoft Azure OpenAI (UK), with Google Gemini as a fallback.

What changed in v1.5

• Corrected how deleting a contact works: roles and properties stay on your desk, archiving a boardroom keeps its contents, and some things are only deleted with your account.

What changed in v1.4

• Where our services are hosted (Sections 9 and 10). We corrected where our database is stored: it is in the EU in Stockholm, Sweden, not Frankfurt. Our website is served from Vercel's global edge network, with builds run in the US.

What changed in v1.3

• People in your book (new Section 4.6, and Section 11). How we handle the people you add and track against a role or a property, and what deleting one removes.

What changed in v1.2

This version corrects the document where it no longer described what Marsalis actually does. In plain words:

• Connected Outlook is now described properly (Section 4.5). The previous version said we did not read inbound email and that any Gmail or Microsoft 365 connection would be disclosed before it went live. Outlook became available on 17 September 2026 and does read mail involving people on your Contacts list, so that statement was wrong and the promise was not kept. Section 4.5 now sets out exactly what is looked at, what is kept, and for how long.
• Gmail is described as sending only (Sections 4.5 and 9), which is what it has always done.
• International transfers (Section 10). The previous version said a UK IDTA was signed with each US processor. No IDTA was signed. The safeguard is in each processor's data processing agreement, and Section 10 now says so accurately.
• The processor list (Section 9) now includes Microsoft and the Gmail API, and no longer claims we use Supabase file storage, which we do not.
• Retention (Section 11) now lists Outlook mail details, offers to add someone new, contacts, and emails sent on your behalf.
• Services you cannot actually connect — Google Drive, Slack and ad platforms — have been removed from Sections 2 and 4.5.