Privacy Policy

Velia (“we”, “us”, “our” or the “Company”) operates the Velia platform (the “Service”). This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information.

By accessing or using Velia, you acknowledge that you have read, understood and agree to be bound by this Privacy Policy. If you do not agree, do not use the Service.

2.1 Information you provide directly.

• Account registration: name, email address, password.
• Profile information: if you are a creator, your public page — name, photo, bio, handle and your picks.
• Search queries: products you search for and filters you apply.
• Communications: emails, support tickets, feedback and messages.
• Payment information: we do not store credit card details, and we do not collect or store creator bank account or tax identification details. Creator payouts and the identity checks that go with them are handled by Stripe, who collect that information directly from you and hold it under their own terms. What Velia keeps is the account identifier Stripe hands back, plus the ledger of commission owed and paid.

2.2 Information collected automatically.

• Device information: IP address, browser type, operating system, device ID.
• Usage data: pages visited, time spent, clicks, interactions, search history.
• Cookies & tracking: we use cookies and similar technologies to recognise you and improve the Service.
• Location data: general location inferred from IP address. We do not collect precise location.

2.3 Third-party data. We receive product listings, prices and availability from eBay via their API, and we may collect data from other partners you connect to, such as eBay, other affiliate networks and payment processors.

2.4 Lawful basis for processing. Velia processes your personal information on the following bases:

• Service delivery: your name, email, account credentials and search history, to create and maintain your account and provide the Service — performance of our contract with you.
• Analytics & improvement: aggregated, anonymised usage data, to understand behaviour and improve the Service — our legitimate interest in understanding and improving what we run.
• Communications: your email address, to send transactional messages required to operate the Service (password resets, account and payment notifications) without separate consent, and promotional messages only where you've explicitly opted in.
• Legal compliance: information processed when required by law or to protect our legal rights — legal obligation, or our legitimate interest in defending those rights.
• Affiliate operations: as a creator, your name, email and transaction data, to calculate and pay affiliate commissions — performance of our agreement with you as a creator.

Where consent is the basis for processing, you can withdraw it at any time. Withdrawing consent for promotional email stops those emails immediately. Withdrawing consent for optional processing, like analytics, may reduce features that depend on it, but core functionality of the Service stays available.

2.5 Contractual safeguards with processors. Velia works to put appropriate data-protection terms in place with the processors and service providers listed in clause 4 — including PostHog, Sentry, Upstash, Supabase, Stripe and the affiliate networks we use — covering what they may process data for, the security they must maintain, and how long they may keep it. If you have questions about the safeguards in place with a specific provider, contact support@joinvelia.com.

• Service delivery: creating and maintaining your account, processing searches, fulfilling affiliate commissions.
• Analytics & improvement: understanding user behaviour, improving the Service and testing features, using aggregated or anonymised data.
• Communications: transactional emails (account confirmations, password resets), service updates, and promotional emails with your consent.
• Legal compliance: complying with law enforcement requests, preventing fraud, and enforcing our Terms.
• Affiliate operations: tracking clicks and conversions to calculate creator commissions.
• Third-party sharing: sharing data with the service providers listed in clause 4.

We do not sell your personal data to unaffiliated third parties for their marketing purposes.

3.1 Data breach notification. If a confirmed data breach compromises the security or privacy of your personal data, Velia will:

• Notify affected users by email as soon as practicable and without unreasonable delay.
• Notify the relevant privacy regulator — the Privacy Commissioner of Canada, the applicable provincial authority, the ICO, etc. — within the timeframe that regulator requires (GDPR sets a 72-hour target for notifying the supervisory authority).
• Tell you what happened, what categories of data were involved, and what we're doing about it.
• Point you to resources for monitoring and protecting your information.

We won't delay notifying you except where law enforcement or an active security investigation genuinely requires it.

4.1 Service providers.

• PostHog — analytics. We use PostHog to track aggregated usage patterns and behaviour on the Service. IP addresses are automatically anonymised before reaching PostHog, and we don't send it your name or email — see PostHog's own privacy policy for how they handle what we do send.
• Sentry — error tracking. When something on the Service throws an error, Sentry receives a stack trace and the URL of the page it happened on, with the query string stripped first — some of our URLs carry a one-time sign-in token, and that string is never sent. We don't send Sentry your IP address, cookies or request headers, and it isn't used to record what you clicked or typed.
• Upstash — rate-limiting infrastructure. Upstash Redis stores short-lived counters keyed to your IP address or an anonymous session identifier, used only to detect and block abusive request volume (for example, a script hammering search). It doesn't receive your account, profile or search content, and each counter expires on its own within a day.
• Supabase / PostgreSQL — database hosting and the authentication behind sign-in.
• eBay — to retrieve product data. Your searches may inform our requests.
• Firecrawl — web scraping for price data, anonymised.
• Email service providers — for transactional and marketing emails.

This list covers our current providers and isn't exhaustive — we may add or change providers as the Service evolves, subject to the safeguards in clause 2.5.

4.2 Payment processors & affiliate networks. Velia shares the following with payment processors and affiliate networks to pay creator commissions and track affiliate sales:

• With Stripe: your name, email address, Stripe account identifier, and the commission amounts owed and paid. Stripe collects your bank, card and tax details directly from you — see clause 2.1.
• With affiliate networks: your name, email address, public creator handle, and transaction data — clicks, sales attributed to your links, conversion amounts and commissions earned — so the network can track and confirm sales, calculate commissions, and pay Velia.

Affiliate networks and payment processors retain this data under their own privacy policies and legal obligations — typically 5–7 years for financial records — and Velia does not control their retention.

By becoming a creator, you consent to this sharing; it's a condition of participating in the affiliate programme, and creators who don't want their data shared this way can't use the programme.

You acknowledge that:

• Affiliate networks and payment processors are third-party vendors outside Velia's direct control, with their own privacy policies and data handling practices.
• Velia is not responsible for how they use or protect your data.
• Velia works to put contractual data-protection terms in place with the processors it uses, covering purpose, security and retention — see clause 2.5.
• Data sharing with affiliate networks is a condition of participation in the affiliate programme.

4.3 Legal requirements. We share information with law enforcement, government agencies or in response to court orders requiring disclosure; to protect against fraud, security threats or illegal activity; to enforce our Terms of Service; and to comply with legal obligations and regulations.

4.4 Business transfers. If we are acquired, merged, or sell substantially all assets, your information may be transferred as part of that transaction. We will notify you of any such change by email or prominent notice on the Service if required by law.

We require all third parties to maintain confidentiality and to use your data only for the purposes we specify, though we are not responsible for their compliance.

Velia uses cookies and similar technologies (pixels, local storage) to run the Service and understand how it's used:

• Essential: needed to sign you in, keep you authenticated, and keep the Service secure. This also includes an anonymous id we set for every visitor, signed in or not, which attributes the searches and clicks that lead to a sale to the creator who referred them — this is how creator commissions get calculated correctly — and a small cookie that just remembers your cookie choice itself. These run regardless of your cookie settings, because the Service — including paying creators correctly and remembering what you chose here — can't function without them.
• Analytics: help us understand usage patterns and improve the Service. We use PostHog for this — see clause 4.1. If you accept, PostHog stores both a cookie and local storage entries on your device, and we send it events describing your own use of the Service — searches, clicks, signing up or signing in. Declining means none of that happens: no cookie, no local storage, no events.
• Third-party: service providers — PostHog, eBay, payment processors, affiliate networks — may set their own cookies for analytics, fraud prevention or their own tracking. Their privacy policies govern those, not this one. Sentry and Upstash, described in clause 4.1, don't set any cookie on your device — they receive data from our servers, not from your browser.

Cookie management. The first time you visit, a banner asks you to accept all cookies or essential only — analytics only runs if you choose “accept all.” You can change your mind any time from the “Cookie preferences” link in the footer, which reopens the same choice without reloading the page. You can also control, delete and disable cookies through your browser settings. Disabling essential cookies may stop parts of the Service working; declining analytics won't break anything, but it does mean we lose visibility into how you use the Service.

Third-party cookies. Review the privacy policies of PostHog, eBay, Stripe and the other providers we use for how they handle their own cookies.

Velia keeps personal data only as long as we need it for the purpose it was collected, subject to legal and operational requirements. Specific periods:

• Account data: retained while your account is active. After deletion, your name, email and profile are deleted within 30 days, except where we need to keep it longer for law or fraud prevention (up to 12 months after deletion).
• Search & usage data: retained for 12 months for analytics and service improvement, then anonymised or deleted.
• Creator payment records & ledger: retained for 7 years to meet Canadian tax, accounting and financial regulatory requirements, then securely deleted unless a dispute or investigation needs them longer.
• Communications: support tickets and emails are retained for 3 years to handle follow-up and disputes, then deleted unless legally required or under investigation.
• Dispute or investigation data: retained for the duration of the matter plus 1 year after resolution.
• Security & fraud logs: retained for 13 months to detect and prevent fraud, then securely deleted.
• Error tracking (Sentry): retained under Sentry's default retention period (90 days), then deleted. Rate- limiting counters (Upstash) expire automatically within 24 hours of being set.
• Stripe account identifiers: retained while your creator account is active; deleted on termination.
• Device & location data: retained for up to 12 months for security and troubleshooting.

Where law or an ongoing investigation requires longer retention, we keep data beyond these periods. Email support@joinvelia.com if you want to know the retention period for a specific kind of data.

If you request account deletion, we delete your personal data within 30 days, except where retention is legally required or necessary for fraud prevention, legal defence or financial compliance (as above). Deletion of archived or backed-up copies happens as soon as reasonably practicable, which may take a little longer.

Content we remove. Separately from anything you ask for, Velia may remove individual items you have uploaded — including a look, its photograph and the product it points to — from a creator page at any time, at our discretion and without prior notice. We do this where an item appears to infringe someone else's rights, to advertise counterfeit, recalled or unsafe goods, or otherwise to breach our Terms of Service, and we may do it in response to a complaint from a rights holder, a retailer or another user. Removing an item deletes the image we stored and the record describing it; it does not close your account, remove your page, or affect commission you have already earned. Where a whole page is taken down rather than a single item, we tell the creator why and they can contest it.

7.1 Canadian residents (PIPEDA). Velia is governed by Ontario law, and if you're in Canada you have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation:

• Access: request the personal information Velia holds about you.
• Correction: request correction of inaccurate or incomplete information.
• Deletion: request deletion, subject to the legal and operational limits in clause 6.
• Right to know: ask how Velia collects, uses and discloses your personal information.
• Withdraw consent: where our processing relies on your consent, withdraw it at any time — see clause 2.4.
• Complain: file a complaint with the Privacy Commissioner of Canada if you believe we've violated your privacy rights — see clause 15.

7.2 General rights. Depending on your location, you may also have the right to:

• Access: request a copy of your personal data in a structured, commonly-used format.
• Correction: request correction of inaccurate or incomplete data.
• Deletion: request deletion of your personal data, subject to legal obligations, ongoing disputes or the retention requirements in clause 6.
• Portability: request your data in a portable format, where technically feasible.
• Objection: object to our processing your data for direct marketing or other specified purposes.
• Opt out: opt out of marketing emails by clicking “Unsubscribe”, or withdraw consent for other consent-based processing at any time.

7.3 How to submit a request. Email support@joinvelia.com with your full name and registered email address, which right you want to exercise, and a description of the request. We may ask for proof of identity before acting on a request that involves personal data, so we don't hand it to the wrong person.

7.4 Response timeframe. We aim to respond to valid requests within 30 days. If a request is complex or needs archived data pulled, we may take up to 60 days, and we'll tell you if that's happening. A deletion or portability request that isn't technically feasible will be declined with an explanation.

7.5 Limitations. We may decline or limit a request where the data is under legal hold for litigation or investigation; retention is required by law (tax, financial compliance); the request is manifestly unfounded or excessive; deletion would undermine fraud prevention or security; or the data has already been anonymised and can't be tied back to you.

7.6 No discrimination. We won't penalise you for exercising these rights — no price increase, reduced service quality or denial of service for a legitimate privacy request.

8.1 EU residents & GDPR. If you're in the European Union or another jurisdiction with its own privacy law, your data may be processed and transferred internationally, including to the United States, and by using the Service you consent to that. Velia is the data controller for personal data collected here. You have the usual GDPR rights — access, correction, deletion, portability and objection to processing — contact support@joinvelia.com to exercise them.

8.2 International transfers. Data may be transferred to, stored in and processed in the United States or other countries where Velia or its service providers operate. These countries may have different privacy protections than your jurisdiction. By using the Service, you consent to international data transfers as described in this Privacy Policy.

8.3 Transfer safeguards. Where GDPR requires additional safeguards for moving personal data outside the EU/EEA, we work to put appropriate contractual and technical protections in place with the providers we use — including Standard Contractual Clauses where they apply — so data transferred internationally gets a comparable level of protection. If you have questions about the safeguards covering a specific transfer, contact support@joinvelia.com.

The Service is not intended for users under 18 years old, and we do not knowingly collect data from children under 18. If we discover we have collected data from a child under 18, we will delete it immediately. Parents or guardians who believe Velia has collected data from a child should contact support@joinvelia.com.

We implement reasonable technical and organisational measures to protect your data:

• HTTPS encryption in transit.
• Server-side encryption at rest.
• Role-based access controls and authentication.
• Regular security audits and vulnerability checks.
• Incident response procedures.
• Privacy-aware handling training for the team.

No security measure is perfect, and data sent over the internet or stored on a computer is never completely safe. We can't guarantee absolute security against breaches, hacking or unauthorised access, and you use the Service at your own risk. We're not responsible for security failures caused by your own negligence (shared passwords, phishing), by a breach of a third-party system outside our control (like a payment processor's), or by attacks that standard industry practice couldn't reasonably have prevented.

What we are responsible for is keeping reasonable, industry-standard security measures in place, and telling you promptly if a breach happens because we fell short of that — see clause 3.1 for how we handle breach notification.

The Service may contain links to third-party websites — eBay, affiliate networks, payment processors and others. We are not responsible for the privacy practices, data security or content of these third parties. Review their privacy policies independently before providing your information.

Velia may update this Privacy Policy at any time. Changes to non-material provisions are effective upon posting, and your continued use of the Service constitutes acceptance.

Material changes — those that significantly increase data collection, expand data sharing, reduce privacy protections, or alter your rights — will be announced by email to your registered address at least 30 days before they take effect. If you don't agree with a material change, you'll need to delete your account before it takes effect. Continued use after the effective date of a material change means you accept the updated policy.

The version date at the top of this page tells you when it was last updated. If you'd like to be notified of future changes, email support@joinvelia.com.

If you're a California resident, the CCPA and CPRA give you the right to know what personal information we collect and share; delete it, with limited exceptions (completing a transaction, complying with law, preventing fraud); opt out of any “sale” or “sharing” — Velia doesn't sell data to brokers, but email us if you want to opt out of anything that could count as “sharing”; correct inaccurate information; and limit our use of sensitive personal information. We don't discriminate against you for exercising these rights, and we don't currently do automated profiling.

To submit a request, contact support@joinvelia.com. You may also designate an authorised agent to submit requests on your behalf.

If you're a Nevada resident, you have the right to opt out of the sale of your personal information. Velia doesn't currently sell it, but if that changes, email support@joinvelia.com to opt out.

If you believe Velia has violated your privacy rights, you can file a complaint with the regulator that covers you:

• Canada: the Privacy Commissioner of Canada (priv.gc.ca).
• Ontario: the Office of the Information and Privacy Commissioner of Ontario (ipc.on.ca).
• European Union: your national Data Protection Authority (list at edpb.europa.eu).
• California: the California Attorney General or the California Privacy Protection Agency.
• Elsewhere, your local privacy regulator.

We'll cooperate with any privacy investigation opened as a result.

For privacy inquiries, requests or concerns, email support@joinvelia.com. We will respond as soon as reasonably practicable; response times may vary depending on the nature and complexity of your request.

Our failure to enforce any right or provision of this Privacy Policy does not constitute a waiver of that right or provision.

This Privacy Policy is effective as of August 2026 and applies to all users and data collected from that date forward. The rest of the agreement is in the Terms of Service.