Legal
Privacy Policy
This page describes what Veyra actually collects, why, where it goes and how to have it removed. It is written from the software as it is built today, not from a template, if Veyra starts doing something new, this page changes first.
Who operates Veyra
Veyra is an independent, early-stage software product operated by Drew Weber. No company registration, corporate entity or business address is claimed on this page, because none has been established. The operator is the person responsible for the data described below, and the contact address in section 16 reaches them directly.
What this covers
This policy applies to three things: the Veyra marketing website, the Veyra application you reach after signing in (dashboard, inventory, product details, orders, suppliers and settings), and the Veyra API that serves them.
Veyra is early-stage software. Parts of it are still being built, and the site says so where that matters. Figures shown on the marketing pages are example data, not the records of real businesses.
What Veyra collects
Account information you give us
When you create an account, Veyra stores your first and last name (joined into a single name field), your email address, and a password. The password is never stored in a readable form: it is hashed with scrypt by the authentication library before it reaches the database, and neither the operator nor anyone else can read it back. Veyra also records when the account was created and last updated, and whether the email address has been verified.
Session and device information
While you are signed in, Veyra stores a session record containing a session token, its expiry, the IP address the session was created from, your browser's user-agent string, and which workspace you were last working in. This is what keeps you signed in and what lets a session be ended.
Your workspace and its records
Almost everything in Veyra is business data you enter or import, held against your workspace:
- Products, name, SKU, category, cost per unit, selling price, minimum stock level, reorder quantity and an optional image.
- Stock, stock levels per location, and an immutable ledger of every movement, each with a quantity, a reason, a timestamp and the account that recorded it.
- Suppliers, business name, contact name, email address, phone number, website and free-text notes, plus the prices you record against them.
- Purchasing, purchase orders and their lines, including quantities, costs, expected dates and notes.
- Sales, sales and sale lines used as demand history: the external order reference, when it happened, currency, totals, and the item, quantity and price on each line.
Supplier contact details are personal information about other people. You decide what to enter there, and you are responsible for having a proper basis to record it, see your responsibilities in the Terms of Service.
Integration records
If you connect a point-of-sale system, Veyra stores which provider it is, the connection's status, the merchant identifier that provider gave us, when it last synced and the text of the last error if one occurred. For the Clover integration, the access token Clover issues is encrypted before it is stored, and a short-lived row is written while the authorisation is in progress so the response can be matched to the request that started it. Veyra never receives or stores your Clover password.
Server logs
The API writes an operational log line for requests it handles: a request
identifier, the method and path, the response status, the calling IP address and
a timestamp. Cookies, authorisation headers and any password field are replaced
with [redacted] before the line is written. These logs exist to
diagnose faults and to spot abuse; they are not used to build a profile of you.
What Veyra does not collect
Stated explicitly, because most products of this kind do collect these things:
- No analytics or tracking. There is no analytics package, no tag manager, no advertising pixel, no session recorder and no third-party tracking script anywhere on the website or in the application.
- No payment details. Veyra does not charge for access and has no payment processor connected, so no card or bank details are collected or stored.
- No marketing email. Veyra has no mail transport connected. It cannot send you newsletters, and there is no mailing list to be added to.
- No customer personal data from your point of sale. The Clover import reads only an order's identifier, time, state, currency, total and line items. It does not request or store your customers' names, email addresses, phone numbers or card data.
- No selling or sharing. Your data is not sold, rented, or shared with advertisers or data brokers, and it is not used to train machine learning models.
Why it is used
- To run your account, creating it, signing you in, keeping you signed in, and letting you change your password.
- To keep businesses apart, every request verifies your membership of the workspace named in the URL before any record is read, and the database enforces the same separation independently.
- To provide the features themselves, stock levels, the movement ledger, low-stock flags and reorder recommendations are all computed from the records above. The recommendations use your own sales history, lead times and open purchase orders; nothing about other businesses is involved.
- To import what you ask us to import, running a point-of-sale sync when you press the button for it.
- To keep the service working and secure, diagnosing errors from logs, and limiting how many requests one account or address can make.
- To answer you, if you email us, we use your message and address to reply.
Service providers
Veyra is run on infrastructure operated by other companies, and the integration you choose to connect necessarily exchanges data with that provider. This is the complete list as the software stands today.
| Provider | What it does for Veyra | What reaches it |
|---|---|---|
| Vercel | Hosts the website and runs the API as a serverless function. | Every request you make to Veyra passes through it, including its IP address, headers and body. |
| Neon | Hosts the PostgreSQL database. | Everything Veyra stores: accounts, sessions, and all workspace records described above. |
| Google Fonts | Serves the two IBM Plex web fonts the site is set in. | Your IP address, browser user-agent and the page that requested the font. No cookie is set and no account data is involved. |
| Clover | Optional point-of-sale integration, used only if you connect it yourself. | The authorisation Veyra was granted, and the requests it makes to read your merchant details, catalogue and orders. |
Authentication is handled by Better Auth, which is a library running on Veyra's own server rather than an outside service; no account data is sent anywhere by it. Each provider above handles data under its own privacy terms, and Veyra does not control what they do with the operational records of running their own platforms.
Veyra staff access
Accounts marked as platform administrators can see an operational view of the service: account names, email addresses, whether an address is verified, when an account was created, the names of workspaces and who belongs to them, the status of connected integrations, and totals across the platform. That role is granted deliberately and to nobody by default; every administrator request re-checks the role in the database, and an attempt by a non-administrator is logged.
Beyond that view, the operator has direct access to the database, as anyone running a service must in order to fix it. It is used for operating and repairing Veyra, not for reading your business records out of interest.
How long it is kept
- Account and workspace records are kept for as long as the account exists, and removed when it is deleted.
- Sessions expire seven days after they are created, and are deleted when you log out or change your password.
- Workspace invitations expire forty-eight hours after they are sent.
- In-progress integration authorisations are short-lived rows that expire on their own.
- Server logs are held by the hosting platform under its own retention period rather than one Veyra sets.
Deleting data removes it from the live database immediately. Copies can persist for a time in the database provider's automatic backups until those backups age out and are overwritten.
How it is protected
These are the measures actually implemented, described plainly:
- Passwords are hashed with scrypt and never stored or logged in readable form.
-
Sessions travel in an
httpOnly,SameSite=Laxcookie that no script on the page can read, marked Secure when the site is served over HTTPS. - Every request for workspace data verifies your membership against the database first, and PostgreSQL row-level security enforces the same boundary underneath as a second, independent check.
- The API connects to the database as a restricted role rather than the schema owner, so a flaw in the application has less reach than the application itself.
- Point-of-sale access tokens are encrypted before being stored.
- Requests are rate limited per account or address, standard security headers are set, and request bodies are size-capped.
- Secrets live only in the server's environment. None are present in the website, the application code, or the public repository.
What Veyra does not claim. No system is completely secure, and Veyra makes no guarantee that it cannot be breached. Veyra holds no security or privacy certification: it has not been audited against SOC 2, ISO 27001, PCI DSS or any comparable standard, and nothing on this site should be read as saying otherwise.
Deleting your data
You can delete your own account from inside the application: open Settings → Data and danger zone → Delete account, confirm with your password, and type the confirmation phrase. It takes effect immediately and cannot be undone.
Deleting your account removes:
- your account record, name and email address;
- your stored password hash and every active session;
- your membership of every workspace;
- every workspace where you are the only member, together with all of its products, stock levels, movement history, suppliers, purchase orders, sales records and integration connections.
Workspaces that other people also belong to are not deleted, those records belong to that business as well as to you, and the remaining members keep them. Your membership is removed, and ledger entries you recorded stop being attributed to you.
If you cannot reach the application, email drew.weber2028@gmail.com from the address on the account and ask for deletion. There is no self-service export yet; if you want a copy of your workspace records before deleting, ask in the same message and it will be sent to you.
Your choices
- See what is held. Almost all of it is visible in the application already; for anything else, ask.
- Correct it. Your name, email and password are editable in Settings, and your business records are editable wherever they appear.
- Delete it. See section 11.
- Object or complain. Write to the contact address and say what you want done.
Veyra is operated from the United States by one person and does not claim to be certified under, or fully compliant with, the GDPR, the UK GDPR, the CCPA or any other particular privacy statute. Where a law of that kind does apply to a request you make, the route is the same contact address, and requests Veyra is required to honour will be honoured.
Children
Veyra is a tool for running a business and is not directed at children. Do not create an account if you are under 16. If you believe a child has created one, write to the contact address and it will be removed.
Where data is processed
Veyra is operated from the United States, and its hosting and database providers are United States companies. Assume your data is stored and processed in the United States. If you are outside the United States, using Veyra means your data is transferred there.
Changes
When this policy changes, the date at the top of the page changes with it. Veyra has no mail transport connected, so it cannot email you about a revision; until that exists, that date is the only notice, and the previous wording is available on request. Continuing to use Veyra after a change means the current version applies to you.
Contact
Privacy questions, data requests and deletion requests all go to the same place.
Veyra; operated by Drew Weber