Privacy policy

Who is responsible

Veleryn Shop is a sole proprietorship, an individual trading under a business name rather than a company. That individual is the data controller for everything described here, and is the person who will answer if you write in about your information. Their name is on the about page, and the trading address is below.

What we collect

When you place an order

• Your name, and a business name if you enter one.
• Your email address, and your phone number if you choose to give one.
• The shipping address you enter.
• The items, quantities and totals of your order.
• Which payment method you chose: the label only, either “Direct bank transfer” or “Cash on delivery”.
• Any order notes you write.

When you use the contact form

• Your name, email address, subject, message, and an order number if you give one.

Automatically

• Standard server and hosting logs kept by our host, which include IP address, browser type and the pages requested. These are used to keep the site running and to limit abuse of the order and contact forms.

What we do not collect

No bank account number, card number or other payment credential is entered on this site, so none is received, transmitted or stored here. A bank transfer happens inside your own banking app, and cash on delivery is settled directly with the UPS driver.

We also do not collect:

• Any health, medical or dietary information. Please do not send any.
• Social security numbers, government identifiers or dates of birth.

Veleryn Shop does not sell your personal information for money, and never has. Advertising cookies are a separate question and are covered below.

Why we collect it

Each item above exists for a specific, limited reason:

• To fulfil your order. Pack it, address it, and hand it to UPS.
• To communicate about your order. Confirmation, payment details, dispatch and tracking, and anything that goes wrong.
• To answer your questions when you write in.
• To meet legal and tax obligations, which require sales records to be kept for a period.
• To prevent abuse. Rate limiting on the order and contact forms.

You will not be added to a marketing list by placing an order. No marketing email is sent by Veleryn Shop.

Cookies and tracking

This site loads the Google Ads tag on every page. It is the only third-party script here: there is no Google Analytics, no Meta pixel and no other tracker.

The Google Ads tag sets advertising cookies in your browser and sends Google a pseudonymous identifier along with the page you are on. It is used to measure whether an advertisement led to a visit or an order, and to build remarketing audiences, which is what allows adverts for this shop to be shown to you elsewhere. It does not receive your name, email or address.

What else the site uses:

• Your cart is kept in your own browser’s local storage. It never leaves your device until you place an order, and clearing your browser data clears it.
• An administrator session cookie, set only if the store owner signs in to the dashboard. It is never set for shoppers.

Turning advertising cookies off

You can switch them off at any time, and nothing on this site stops working if you do:

• Turn off ad personalisation in your Google account at myadcenter.google.com.
• Block third-party cookies in your browser settings, or use a private window.
• Install Google’s own opt-out browser add-on.

Blocking the tag has no effect on browsing, ordering, or the support you get. Nothing here is gated behind accepting it.

Who your information is shared with

Your details are shared only with the parties needed to complete your order, and only the parts they need:

• Hosting. The site runs on Vercel, which processes requests and keeps server logs.
• Database. Orders and contact messages are stored with Supabase.
• UPS. Your name, shipping address and phone number if you gave one are passed to UPS so they can deliver the parcel.
• Google. The Google Ads tag sends Google the page you viewed and a pseudonymous advertising identifier, under Google’s own privacy policy. It is not sent your name, email, address or order contents.
• Nobody else. A bank transfer is made by you, from your own bank, and we see only that a payment carrying your order number arrived. Cash on delivery is collected by UPS along with the parcel. No payment processor receives your details from us.

Beyond that, information is disclosed only where the law requires it. It is never sold, rented, or passed to advertisers or data brokers.

How long it is kept

• Order records: kept while needed for tax and accounting purposes, generally seven years from the order date.
• Contact messages: kept up to 24 months after the enquiry is resolved, so a follow-up question has context.
• Server logs: kept for the retention period our host applies, typically 30 days.

You can ask for your information to be deleted sooner. Order records that must be kept for tax purposes will be retained, but personal details not needed for that can be removed.

How it is protected

• The whole site is served over HTTPS.
• Order and message records sit behind row-level security and are reachable only by the store owner through an authenticated dashboard. The public site’s keys cannot read them.
• The dashboard is password protected with a signed, expiring session.
• Only the store owner has access to order data.

No system is perfectly secure, and anyone claiming otherwise is selling something. If a breach affects your information, you will be told promptly and told what to do about it.

Your rights

You can, at any time, ask to:

• Know what information is held about you.
• Get a copy of it.
• Correct anything inaccurate.
• Have it deleted, subject to the tax retention above.
• Object to a particular use of it.

Ask through the contact page or by writing to help@velerynshop.com. Requests are answered within 30 days. You will never be charged for making one, and you will never be treated differently for having made one.

California residents

If you live in California, the CCPA as amended by the CPRA gives you the rights above plus the right to know what categories of personal information have been collected, the purposes, and the categories of third parties they were disclosed to. All of that is set out on this page.

Veleryn Shop does not sell personal information for money. However, the Google Ads tag described above does count as sharing for cross-context behavioural advertising under the CPRA, because it lets adverts for this shop follow you to other sites. Saying otherwise would be inaccurate, so it is stated plainly here.

Do Not Sell or Share My Personal Information

You can stop that sharing in any of these ways, and you do not have to ask us:

• Turn off ad personalisation at myadcenter.google.com, which applies everywhere, not only here.
• Block third-party cookies in your browser, or browse in a private window.
• Send a Global Privacy Control signal. Most privacy-focused browsers and extensions support it.
• Or write to us using the details below and ask, and it will be confirmed to you in writing.

Opting out changes nothing about how the shop treats you. Prices, shipping, support and returns are identical either way, and no part of the site is withheld from anyone who opts out.

You may nominate an authorised agent to make a request on your behalf. We will ask for reasonable proof of that authorisation before acting on it.

Children

This store is intended for adults aged 18 and over. Products are not knowingly sold to children, and information is not knowingly collected from anyone under 13. If you believe a child has given us information, write in and it will be deleted.

Changes to this policy

This policy is updated when practice changes. The date at the top of the page shows when it last changed. Material changes will be described in plain language rather than buried. For example, if analytics were ever added, that would be stated here in a way you could not miss.

Contacting us about privacy

Privacy questions go to the same person who packs the orders. Write to help@velerynshop.com with “Privacy” in the subject line, or use the contact page. Replies usually go out within 1 business day.