Privacy Policy - VeLens
Last updated: August 11, 2026
Applies to: VeLens Cloud, and VeLens for Marketing Cloud v1.3.0 and later, and any earlier version still in use.
VeLens adds productivity and AI-assisted features to Salesforce Marketing Cloud (SFMC). This policy describes what data VeLens accesses, how it is stored, who it is shared with, and your rights.
VeLens for Marketing Cloud was previously published as MC Lens. This policy covers that installation too; the product was renamed, not replaced.
Who is responsible for your data. VeLens, Inc., a Delaware corporation, is the data controller for the account data described in section 5, and acts as a processor when VeLens reads data from your own SFMC account on your instruction. Contact details are in section 12.
1. The two VeLens surfaces
- VeLens Cloud - the web app at
app.velens.cloud. The same web app also opens inside Marketing Cloud from SFMC's app menu; that is the same application in an iframe, not a separate product. - VeLens for Marketing Cloud - the Chrome extension that adds UI directly to the SFMC interface.
Both surfaces share the same backend, the same account, and the same data handling described below. "VeLens" on its own refers to the company and platform.
2. How VeLens reaches your SFMC data
2.1 The extension, using your existing browser session
Some extension features call SFMC's own in-application endpoints from the SFMC page you already have open, using the session you are already signed in with (a same-origin request that carries your existing SFMC cookies). The extension does not capture, read, store, or transmit your SFMC session token or any other SFMC credential, and no data from these calls is sent to VeLens servers. The responses stay in your browser.
Features that work this way include the Command Palette and in-page navigation, Data Extension listings and schemas, query and data-filter listings, the Query Studio overlay, the Dependency Mapper, and Journey and Automation listings (including the Automation Health Monitor).
2.2 A connected account, using OAuth
When you choose "Connect SFMC", you are taken through Salesforce Marketing Cloud's own OAuth sign-in for the VeLens Installed Package. VeLens never asks you for your SFMC username or password, and you do not enter any client secret. After you approve, SFMC issues VeLens tokens that are stored on VeLens's servers (see section 5).
A connection is required for anything that uses SFMC's SOAP API or the VeLens backend, including Subscriber Lookup and Cross-BU Subscriber Search, the Error Log, Send Performance, the Engagement Hub, the Admin Dashboard, and all AI features. Without a connection these features do not run; they show a "Connect SFMC" prompt instead.
When the web app is opened from Marketing Cloud's app menu, Marketing Cloud posts a signed single-sign-on request to the VeLens login endpoint. VeLens does not read or store the contents of that request; the browser is redirected into the same OAuth sign-in described above.
2.3 First-run consent
On first run the extension shows a privacy disclosure and will not process data until you accept it. Until consent is recorded, the extension's background worker refuses every data request except a small allowlist (extension status, opening the popup, clearing the local cache, clearing page context, and account deletion - erasure is never blocked by the consent gate). If this policy changes materially, the stored consent is invalidated and you are asked again.
3. What data is processed
- SFMC metadata - names, keys, IDs, folder paths, schemas and statuses of Data Extensions, Journeys, Automations, Lists, Emails, Query Activities, Data Filters and Content Builder assets.
- Send and event data - send metrics, automation run status, bounce, not-sent, unsubscribe, complaint and forward events, and import results, for the Business Units you have access to in SFMC.
- Subscriber data - subscriber keys, email addresses, list memberships and event history, retrieved only when you run a subscriber lookup, and never sent to an AI model (see section 7).
- SQL and email content - the SQL you author in Query Studio, and email subject lines, preheaders and HTML when you use an AI email feature.
- Account information - your SFMC user ID, enterprise ID, Business Unit IDs, and (best effort, from SFMC) your SFMC name and email address.
VeLens does not read Data Extension row data on your behalf, and no Data Extension row data is sent to VeLens servers.
4. Data stored on your device
The extension stores the following in chrome.storage on your machine. None of it is transmitted to VeLens servers.
| Data | Retention |
|---|---|
| Cached SFMC metadata | 5-60 minutes, depending on the data type |
| Automation health snapshot | Until the next poll |
| Local bookmarks | Until you remove them |
| Toolbar and feature settings | Until you change them |
| Query Studio tabs and recent queries | Until you clear them |
| Privacy consent record (version and timestamp) | Until you uninstall or re-consent |
| Your VeLens sign-in session (when connected) | Until you disconnect or uninstall |
The web app stores your VeLens sign-in session and your selected Business Unit in your browser's local storage. VeLens does not hold your SFMC refresh token in the browser in either surface.
5. Data stored on VeLens servers
Stored in Supabase. Row-level security restricts every record to your own user and organization, including over the API.
| Data | Retention | Notes |
|---|---|---|
| User identity | Until you delete your account | Derived from your SFMC tokenContext, plus your SFMC name and email where SFMC returns them |
| Organization and Business Unit records | Until you delete your account | Scopes features per Business Unit |
| Team invitations | Until revoked, or until the organization is deleted | Created when an owner or admin invites a colleague: the email address they entered, the role assigned, who sent it, and, once accepted, the Marketing Cloud address that was used to accept. Only a one-way hash of the invite link is stored, never the link itself |
| SFMC OAuth tokens | Until you disconnect or delete your account | AES-256-GCM encrypted at rest; no plaintext token column exists in the schema |
| Conversations and messages | Deleted after 90 days | Lets you resume past chats; enforced by a daily scheduled purge |
| Images attached to AI Chat messages | Image deleted after 30 days | Stored with the conversation so a follow-up question can refer back to the image; the conversation itself follows the 90-day rule above |
| Tool invocation records | Deleted after 30 days | What each AI tool call requested and returned |
| Audit log | Deleted after 365 days | Every tool execution; for support and security. Email addresses in audit entries are redacted |
| AI usage telemetry | Until you delete your account | Model, token counts, latency, status, and size/count summaries - not prompt or response text |
| Subject-line scores | Until you remove them | The subject line you scored, its score and suggestions |
| Cloud-synced saved queries and bookmarks | Until you remove them | Only items you explicitly save to the cloud |
| Cached SFMC metadata (server-side) | Per-record expiry | Deleted by the same daily purge once expired |
| Organization health snapshots | Until you delete the organization | Daily aggregate counts only (contacts, sends, automation failures, journey counts) - no personal data |
| Terms of Service acceptance | Until you delete your account | Recorded when you connect Marketing Cloud after agreeing to the Terms: which version of the Terms you accepted, when, your IP address, and your browser's user-agent string. Kept so both sides can establish what was agreed and when, including after the Terms are revised. Not used for analytics, profiling or marketing |
| Deletion receipt | Kept as the permanent record of an erasure | Created only when an account is deleted. Irreversible hash of the account identifier, date, record counts and prior AI credit usage - no personal data. See section 10 |
Backups. The table above is backed up once a day so the service can be restored after a failure. Each backup is encrypted before it leaves the database, stored with Cloudflare (section 6), and deleted automatically after 30 days. The backups are encrypted with a key held only by VeLens - neither Cloudflare nor the automated job that writes them can read their contents. Backups are opened only to recover from a disaster or to test that recovery works; they are never searched or read in normal operation. See section 10 for what this means when you delete your account.
6. Sub-processors
| Sub-processor | Purpose | Data shared |
|---|---|---|
| Vercel, Inc. | Hosts the VeLens web app and API | All VeLens backend traffic |
| Supabase, Inc. | Database and authentication | User identity, organization, encrypted SFMC tokens, conversation history, audit log, scoring history, saved queries and bookmarks |
| Cloudflare, Inc. | Stores the daily encrypted backups (section 5) | The same data as Supabase, but encrypted before it is sent - Cloudflare stores an unreadable file and holds no key to it |
| Vercel, Inc. (AI Gateway) | LLM routing | Conversation messages, system prompts and tool results - routed to the model providers below |
| Anthropic, PBC | LLM for all AI features (AI Chat, Query Studio AI, the Subject Scorer, the AI Email Editor and AI Data Extension descriptions) - reached through the Vercel AI Gateway | Your prompts and instructions, any images you attach to an AI Chat message, system prompts, conversation history and tool results (SFMC metadata only), email subject, preheader and HTML content, and Data Extension field names and types |
Anthropic receives data only through the Vercel AI Gateway; VeLens has no direct integration, and there is no alternative model route in the code. Every request is sent with the gateway's zero-data-retention option enabled, configured to fail closed: the gateway restricts routing to zero-data-retention-capable providers and returns an error rather than falling back to a provider that would retain the request. If the gateway is not configured, AI features are designed to fail with an error instead of routing elsewhere. Using the Service constitutes your general written authorisation for these sub-processors to process your data for the purposes above. We will update this table and give notice through the Service or by email before we add or replace one.
7. Data sent to AI models
- Subject Scorer - the subject line, the preheader, and the email's HTML body as context.
- AI Email Editor - the email's HTML body and your natural-language instruction.
- AI Data Extension descriptions - the Data Extension name, its field names and types, and the names of objects that depend on it. No row data.
- AI Chat and Query Studio AI - your prompt, the system prompt, conversation history, and the results of any tools the model calls, and any image you attach to a message in AI Chat (downscaled in your browser before it is sent). Tool results contain SFMC metadata only, for example automation names, Data Extension schemas, send metrics and bounce category counts.
- Query Studio Explain & Optimize - the SQL you submit for analysis.
Subscriber data and AI
The Service is designed so that subscriber contact details do not reach the model. The subscriber lookup tools that return email addresses and profile attributes, and the tool that changes a subscriber's status, are on a denylist applied to every AI surface before any tool list is built, and again when a write is confirmed. Any tool that returns subscriber-row data is stripped from every AI surface by a second, independent check.
One narrower capability is available only if an organization owner or admin switches it on (it is off by default): the AI can check a single subscriber's engagement history, meaning current journey membership and sent, clicked, bounced or unsubscribed events, looked up by a SubscriberKey or ContactKey that the user types in. The result contains email, journey, and list names, dates, statuses, and bounce categories only: no email addresses, no profile attributes, no Data Extension row values, and the identifier itself is masked in everything sent to the model.
Where a permitted tool can still surface an identifier - for example an email address quoted inside an SMTP bounce reason - VeLens masks it in its own backend, at the point the tool result is produced, before that result is sent to the model or written to storage. To be precise: this masking happens inside VeLens's backend after the data has been read from your SFMC account, not before the data leaves your SFMC account.
Content sent to the Vercel AI Gateway and its model providers is subject to their privacy policies (vercel.com/legal/privacy-policy and anthropic.com/legal/privacy).
8. Extension permissions
| Permission | Why |
|---|---|
storage | Cache SFMC data locally and store your preferences |
activeTab | Inject the toolbar and UI into the active SFMC tab |
notifications | Desktop alerts when automations enter an error state (opt-in) |
alarms | Background polling and service worker keepalive |
tabs | Detect SFMC navigation and route messages between tabs |
webNavigation | Detect when the SFMC OAuth sign-in redirect completes, to finish connecting your account |
Host access to *.exacttarget.com, *.marketingcloudapis.com | SOAP and REST API calls to your SFMC tenant |
Host access to *.marketingcloudapps.com | Detect Data Extension and email context inside Contact Builder and Content Builder iframes |
Host access to querystudio.herokuapp.com | Inject Query Studio enhancements into SFMC's hosted Query Studio iframe |
Host access to app.velens.cloud | API calls to the VeLens backend |
9. Privacy protections
- No credential capture - VeLens does not capture, store or transmit SFMC session tokens. Server-side OAuth tokens are the only SFMC credential VeLens holds, and the browser never holds the refresh token.
- Consent gate - the extension processes no data until you accept the first-run disclosure.
- Email masking - subscriber email addresses are masked in the Error Log, in AI tool results, in the audit log, and in server error reports.
- Shadow DOM isolation - all injected UI is encapsulated in closed Shadow DOM, so the SFMC page cannot read it.
- Row-level security - every database query is filtered by your
user_idandorg_id. - Encrypted secrets - SFMC tokens are encrypted at rest with AES-256-GCM using a key held outside the database.
- Enforced retention - a daily scheduled job deletes aged conversations, tool invocations, audit entries and expired cache rows.
- No analytics or telemetry - VeLens includes no analytics SDKs, page-view tracking or behavioral telemetry.
10. Your rights
- Disconnect at any time - use "Disconnect" in the extension popup's Settings tab. Disconnecting revokes the server-side SFMC credentials and stops API access.
- Delete your account and data, in product - the extension popup offers "Delete my account & data". You are shown a count of exactly what will be removed and must type
DELETEto confirm. VeLens then revokes the SFMC session, deletes the stored SFMC tokens first, and deletes your account, which cascades your conversations, messages, tool invocations, bookmarks, saved queries, subject scores, usage records, credits, quotas, memberships and your Terms acceptance records. VeLens also deletes the contact record and email-subscriber entry it created about you in VeLens' own customer systems. The deletion cannot be undone. - Proof of erasure - VeLens keeps one deletion receipt containing an irreversible hash of the deleted account identifier, the date, record counts, and how many AI credits the account had used. The hash cannot be reversed to identify you, the receipt contains no personal data, and it is never used to contact you or to rebuild anything that was deleted. It exists for two reasons: so an erasure can be evidenced, and so that free AI credits cannot be reset by deleting an account and reconnecting the same Marketing Cloud user. If the same Marketing Cloud user reconnects within 12 months, the earlier credit usage carries over to the new account; after 12 months the receipt is no longer matched to anything.
- Delete by email - if you do not use the extension, or cannot use the in-product flow, email thrishul@velens.cloud with the subject "VeLens account deletion" and all server-side data tied to your user will be purged.
- Deletion and backups - deletion removes your data from the live service immediately. Copies inside backups taken before you deleted remain until those backups expire, which is at most 30 days (section 5), after which no copy of your data exists anywhere. Backups are never searched, queried or partially restored to look anything up; they are only ever opened in full to recover the service. This is the standard position for encrypted backups and it does not delay the deletion itself.
- Clear local cache - use "Clear Cache" in the extension popup at any time.
- Remove the extension - uninstalling removes all browser-stored data. Server-side data is unaffected and requires one of the deletion routes above.
11. Changes to this policy
Material changes will be reflected in the "Last updated" date above, and will re-trigger the extension's first-run consent prompt.
12. Contact
For questions about this policy or about your data:
VeLens, Inc.
380 B Riverglade Drive, Amherst, MA 01002, United States
General and privacy enquiries: thrishul@velens.cloud
Security reports and vulnerability disclosure: security@velens.cloud
VeLens, Inc. is the data controller. Data protection contact: Thrishul Pola.
VeLens is not affiliated with, endorsed by, or sponsored by Salesforce, Inc.