Privacy Policy
What Veyro holds, what it is built never to receive, and how data about people under 18 is handled.
Last updated 16 September 2026.
This document was drafted with an AI assistant and has not been reviewed by a qualified lawyer. It describes how Veyro actually works, accurately and in good faith, but it is not a substitute for legal advice and should not be relied on as one.
Veyro is not yet incorporated, so the governing jurisdiction below is a placeholder and will be replaced once that is settled. If you are relying on any of this for a decision that matters, say so at withveyro@gmail.com.
- Name, email, countryTo sign you in and decide which rules apply.
- Date of birthThe age rules turn on the exact date. Never shown publicly.
- Password hashargon2id. The password itself is never stored.
- Products, payments, payoutsThe ledger your wallet is folded from.
- Guardian invitationsWho agreed to what, and when.
- An audit logSignificant actions, with timestamps.
- Identity documentsPassports, licences, national ID numbers. Entered on Stripe’s own form.
- Bank detailsPayout accounts go to Stripe, not to us.
- Card numbersEntered into Stripe’s payment element. They never touch our servers.
Architecture, not a promise about our intentions. We store a reference to the Stripe account and nothing that would let anyone impersonate you.
1.What we collect
When you create an account: your name, email address, date of birth, country, and a hash of your password. The password itself is never stored, only an argon2id hash of it, which cannot be reversed.
When you use it: the products you list (name, description, price), payments recorded against your account, payout requests, guardian invitations and their outcome, and an audit log of significant actions with timestamps.
Date of birth is collected because the age rules turn on the exact date. A year alone cannot prove the 13 floor, and a guardian must be 18 or over. It is never shown publicly.
2.What we are built never to receive
Veyro does not collect or store:
- Identity documents. Passports, driving licences, national ID numbers, Social Security numbers. These are entered on Stripe’s own hosted form, which we link you to and do not sit in front of.
- Bank account or card details. Payout bank details go to Stripe. A customer’s card details are entered into Stripe’s payment element and never touch our servers.
This is a deliberate architectural choice, not a promise about our intentions. We store a reference to the Stripe account and nothing that would let anyone impersonate you.
3.Why we hold it
To run the service you asked for: to sign you in, to decide which age and country rules apply to you, to link a founder to a consenting guardian, to show a wallet folded from your own records, and to keep an audit trail of who agreed to what and when. That last one matters most where a minor is involved, and it is the reason the log exists.
4.Who can see what
A guardian who has consented for a founder can see that founder’s products, balances, transactions and payout requests. That visibility is the point of the arrangement, and the founder agrees to it by sending the invitation.
A founder can see who their guardian is and when they consented. A guardian’s identity documents are not visible to the founder, because Veyro does not have them.
Nobody else can see either. Access is checked against the database on every request, not taken from anything the browser claims.
5.Who we share it with
Three processors, each for one purpose:
- Stripe, to open and operate the payment account, and to process payments. Stripe is a separate data controller for what you give it directly, under its own privacy policy.
- Vercel, which hosts and serves the application, and which also provides the aggregate page-view analytics described in section 6.
- Neon, which hosts the PostgreSQL database, running on AWS infrastructure.
We do not sell personal data, we do not share it with advertisers, and there is no advertising or tracking network embedded in this site.
6.Cookies
Veyro sets one cookie: a session cookie that keeps you signed in. It is httpOnly, so page scripts cannot read it; Secure in production, so it is only sent over HTTPS; and SameSite=Lax, which blocks most cross-site request forgery. It holds a random token, not your identity, and only a hash of that token is stored on our side.
That cookie is strictly necessary to provide a service you have asked for, so no consent banner is required for it and none is shown. There are still no analytics cookies, no advertising cookies and no third-party trackers. If that ever changes, a real consent banner will appear before the cookie is set, not after.
We do measure how the site is used, with Vercel Web Analytics. It is cookieless and stores nothing in your browser, which we checked against the package itself rather than taking on trust. It records which page was viewed, the referring site, the country the request came from, and the general device type. Vercel derives the country from your IP address and does not keep the address itself, and the identifier it uses to count a visit is rotated daily, so it cannot follow you across days or onto other sites.
What it is not: there is no session recording, no heatmap, no profile of you, and nothing is shared with an advertising network. We chose it over the tools that do those things because most of the people here are under 18, and behavioural tracking of children sits badly next to everything else on this page.
7.How long we keep it
Account data is kept while your account is open. Sessions expire on their own and are revoked when you sign out or change your password.
Transaction and audit records are kept after an account closes, because financial records and a record of guardian consent are exactly the things that need to survive a dispute. Where a retention period is set by law, that period governs.
8.Your rights
You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete your account. A guardian may make a request on behalf of a founder they consent for, and a founder may ask what their guardian can see.
Name and country can be changed yourself in settings. Email cannot be changed there yet, because Veyro cannot send mail and therefore cannot verify a new address, and an unverified email change is the easiest route to an account takeover. Email us and we will do it.
Requests go to withveyro@gmail.com. Depending on where you live you may also have the right to complain to a data protection regulator.
9.People under 18
Veyro is used by people aged 13 and over by design. We collect the minimum needed to apply the age rules and to link a founder to a verified adult, and we deliberately do not receive the sensitive identity material that the payment provider requires, precisely so that it is not sitting in a startup’s database.
If you believe a child under 13 has created an account, tell us and we will remove it.
10.Changes to this policy
If this changes materially, the date at the top changes with it. We will not backdate it or describe it as recently updated when it has not been.