This content is provided as a good-faith draft and has not yet been reviewed by a licensed attorney in each relevant jurisdiction (US, UK, EU). Do not rely on this as final legal advice before processing real customer data or payments.
Vellum is a client-portal overlay for freelancers, agencies, and law firms. A provider gives each of their clients one branded link — the Hub — that aggregates file previews, a chat link, project status, and an invoice link, all pulled live from the provider's own Google Drive/Dropbox, WhatsApp/Slack, and Stripe/PayPal accounts.
Vellum does not store the underlying files, chat content, or payment card data. We store only routing metadata: which folder, which link, and which client it belongs to.
Vellum is a service operated by THIMAR GENERAL TRADING. CO. SPC("Vellum", "we", "us"). "Vellum" is the trading name under which the service is offered.
Last updated: September 9, 2026
These Terms of Service ("Terms") govern your access to and use of the Vellum service. The service is provided by THIMAR GENERAL TRADING. CO. SPC, trading as "Vellum" — you are contracting with THIMAR GENERAL TRADING. CO. SPC. By creating a Vellum account or continuing to use the service you agree to these Terms. You confirm that you are of legal age and, where you act for an organisation, that you have authority to bind it.
Vellum provides a hosted overlay that relays previews of content held in third-party providers (such as Google Drive, Dropbox, Slack, WhatsApp, Stripe, and PayPal) to clients you designate. You are responsible for the content and for maintaining your accounts with those third-party providers.
You must provide accurate account information, keep your credentials secure, and are responsible for all activity under your account.
You will not use Vellum to violate any law, infringe intellectual property, transmit malware, or attempt to circumvent access controls or usage limits.
Paid plans begin with a 7-day free trial. After the trial, subscriptions renew monthly at the plan price until cancelled. Cancellation takes effect at the end of the current paid billing cycle, and you keep access until then.
Our order process is conducted by our online reseller Paddle.com. Paddle.com is the Merchant of Record for all our orders. Paddle provides all customer service inquiries and handles returns.
Payment, billing, tax, cancellation and refund mechanics are governed by Paddle's Buyer Terms. Refunds are handled as described in our Refund Policy below.
We reserve the right to reclassify a workspace's plan tier and to adjust billing retroactively where usage patterns materially misrepresent the plan selected — for example, where multiple individuals share a single Solo-plan login, or where a workspace is operated in a manner that circumvents the seat, client, branding, or automation limits of its plan. Where practicable we will contact the account owner before making such an adjustment.
These Terms address the public-facing relationship between Vellum and its customers. Any trade-secret or confidentiality protections that apply to your internal use of Vellum (for example, information shared under a separately signed NDA) are governed by those separate agreements. These Terms are not, and should not be read as, a mutual non-disclosure agreement.
The service is provided "as is." To the maximum extent permitted by law, Vellum disclaims implied warranties and limits its aggregate liability to the amounts you paid in the twelve months preceding the claim.
THIMAR GENERAL TRADING. CO. SPC retains all right, title and interest in and to the Vellum service, including its software, documentation, design and branding. You receive a limited, non-exclusive, non-transferable right to use the service within your selected plan. You may not copy, resell, redistribute, reverse engineer, or circumvent technical limits of the service. You retain ownership of your own content and grant us a limited licence to host and process it solely to provide the service.
We may suspend or terminate access for material breach of these Terms, non-payment, security or fraud risk, or repeated or serious policy violations. On termination you may export your workspace metadata for 30 days, after which it is deleted.
We may update these Terms. Material changes will be announced by email or in-product.
We offer a 14-day money-back guarantee. If you are not satisfied with your purchase, you can request a full refund within 14 days of your order date.
Payments and refunds are processed by our Merchant of Record, Paddle.com. To request a refund, visit paddle.net with your order details, or contact us at hello@vellum.host and we will help you through the process.
Subscriptions can be cancelled at any time; cancellation stops future renewals and you keep access until the end of the paid period. See also Paddle's Refund Policy.
This Privacy Policy explains what personal data we collect, why we collect it, and the rights you have under the EU General Data Protection Regulation (GDPR) and the UK GDPR. THIMAR GENERAL TRADING. CO. SPC, trading as "Vellum", is the data controller for the account and workspace data described here.
We apply appropriate technical and organisational measures, including encryption in transit, encryption at rest, access controls and audit logging.
We process your data on the following lawful bases: (a) performance of a contract with you (Article 6(1)(b)), (b) our legitimate interest in operating and securing the service (Article 6(1)(f)), and (c) compliance with legal obligations (Article 6(1)(c)).
You have the right to access, correct, port, restrict, or delete your personal data, and to object to processing. Contact hello@vellum.host to exercise these rights. If you believe we have not addressed your request, you can lodge a complaint with your local supervisory authority (in the UK, the ICO).
Where we transfer personal data outside the EEA or UK, we rely on appropriate safeguards including the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum.
Business customers may request a Data Processing Agreement (DPA) under Article 28 of the GDPR. Email hello@vellum.host to receive our standard DPA.
Account and workspace metadata are retained while your account is active. File Exchange uploads follow your workspace-configured retention window (7 to 30 days) and are deleted by an automated job at expiry.
This overview describes controls that are enabled on the Vellum service today. It is maintained by Vellum to answer common security and privacy questions. It is not a certification.
All traffic to and from Vellum is encrypted in transit using TLS. Data at rest — including account records and workspace/client routing metadata — is encrypted at rest by our infrastructure provider.
Vellum is not end-to-end encrypted. Because the service relays live previews of content held by your third-party providers, the server does see that content in transit while the preview is being rendered. Marketing that describes Vellum as "E2EE" would be inaccurate.
Client Hubs are protected by magic-link tokens that are stored server-side as one-way hashes. Tokens can be revoked or regenerated at any time. Provider staff sign in with email/password (and, for supported providers, single sign-on).
Login attempts, magic-link accesses, and administrative actions (including any "view as workspace" impersonation session used by Vellum staff for support) are recorded to an append-only audit log.
Vellum is responsible for the security of the overlay service itself. You are responsible for the security of the connected provider accounts (Drive, Dropbox, Slack, WhatsApp, Stripe, PayPal), for keeping team credentials safe, and for issuing or revoking client magic links appropriately.
Please email hello@vellum.host with the subject line "Security". We acknowledge reports within two business days.
Email us directly at hello@vellum.host, or use the form below.