Legal
Last updated 2026-08-31 · Vela Board Advisors, LLC
This policy explains what information Vela Board Advisors, LLC collects through velaboards.com and through our assessment and advisory engagements, how we use it, who it is shared with, and what you can ask us to do with it.
When you request a briefing or contact us, we collect your name, email address, organization, role, and anything you choose to write in the message field.
When directors and executives complete the AI Board Governance Compass, we collect their responses to the assessment indicators, their role, and the organization they are answering on behalf of.
Our host records standard server logs. We do not operate advertising trackers and we do not track you across other websites. If we introduce analytics tooling, we will update this policy before doing so.
Individual assessment responses are aggregated before any results are presented. We do not attribute an individual director’s responses to that person — not to the rest of the board, not to management, and not to whoever engaged us. Where a readout identifies a divergence between how directors and management answered, it describes that divergence at group level.
If a future engagement requires individual-level reporting, we will ask for the explicit consent of each participant before it happens.
We use Anthropic’s API to help analyse assessment responses and prepare engagement material. Content sent to that API is processed to return a result to us and is not used to train Anthropic’s models. We do not use assessment responses to train any AI model of our own, and we do not sell or license them to anyone for that purpose.
We do not sell personal information. We do not share personal information for cross-context behavioural advertising.
Where the EU or UK GDPR applies, we rely on: contract, to deliver an engagement you or your organization has commissioned; legitimate interests, to respond to enquiries and run our business; consent, for material you have asked to receive and for any individual-level reporting; and legal obligation, where we are required to retain or disclose something.
We use a small number of service providers who process information on our behalf:
Both operate under agreements that restrict their use of the information to providing the service. We may also disclose information where we are required to by law. We do not otherwise share your information with third parties.
We are based in the United States and our providers process information there. If you are in the EU, the UK or Canada, your information will be transferred outside your jurisdiction. Where the GDPR or UK GDPR applies, those transfers are made under the European Commission’s Standard Contractual Clauses or the UK Addendum, as applicable.
We retain engagement records and assessment responses for as long as the relationship continues, so that a board can compare its position against an earlier baseline. We do not currently apply a fixed deletion schedule.
You can ask us to delete your information at any time and we will do so unless we are required to keep it. If you would prefer a defined retention period written into your engagement, tell us and we will agree one.
Whatever jurisdiction you are in, you can ask us what information we hold about you, ask us to correct it, ask us to delete it, or ask us to stop sending you material. We will respond within 30 days.
Depending on where you are, you may also have the right to: receive a copy of your information in a portable format; object to or restrict processing; withdraw consent you have given; know the categories of information collected and disclosed; and not be discriminated against for exercising any of these rights. We do not use automated decision-making that produces legal effects about you.
To exercise any of these, email [email protected]. You can also authorise someone to make a request for you. If you are in the EU or UK and are unhappy with our response, you may complain to your national data protection authority.
Assessment data is held in access-controlled systems, encrypted in transit and at rest by our providers, and visible only to the Vela personnel working on that engagement. No system is perfectly secure, and we will tell you promptly if a breach affects your information.
This site and our services are for boards and executives. We do not knowingly collect information from anyone under 16.
We may update this policy. The date at the top shows when it last changed, and we will tell engagement participants directly if a change materially affects how their assessment responses are handled.
Vela Board Advisors, LLC — [email protected]
Vela Board Advisors, LLC does not provide legal advice. This policy describes our own handling of information and is not guidance for your organization.