1. Who is responsible
Usama Nisar trading as VELYREN is the controller. Contact hello@velyren.com or use the correspondence address shown on this page.
2. Personal data collected
The Contact form may collect your name, business, email, telephone number, service interest, approximate budget, contact preference and project message.
The Digital Assessment may collect your name, business, email, website URL, contact preference and answers about your website, enquiry channels, operational problems, goals, requirements, brand direction and timeline. The server calculates directional website and lead-system scores and a recommendation.
Limited technical and security data may include an IP address, request identifier, timestamp and ordinary hosting logs. The public application does not set an account or analytics identifier.
If you choose a supported package deposit, Stripe Checkout collects payment and billing details on Stripe’s hosted page. VELYREN receives or can retrieve the Checkout Session identifier, selected server-owned package, amount, currency, payment status, customer contact and billing details, and business name. VELYREN does not receive the full card number or card security code.
Please do not send passwords, card details, special-category data, confidential third-party information or unnecessary personal data through the forms.
3. How the workflow handles data
- Form data is validated by the VELYREN server and sent through Resend to the approved business mailbox.
- The lean public application does not write Contact or Digital Assessment submissions to a VELYREN database.
- A random submission identifier is used only as a Resend idempotency key to reduce duplicate delivery.
- A short-lived in-memory rate-limit entry derived from the request IP helps reduce abuse and disappears when it expires or the process restarts.
- Public deposit sessions and payment records remain in Stripe, which is the payment source of truth. The lean application does not create a local payment record.
4. Purposes and lawful bases
| Purpose | Likely lawful basis |
|---|---|
| Answer a requested business enquiry and discuss services | Steps requested before a contract; legitimate interests where the person acts for an organisation |
| Calculate and return the Digital Assessment | Requested pre-contract steps; legitimate interests |
| Deliver forms reliably and prevent duplicates | Pre-contract steps; legitimate interests in reliable operation |
| Protect forms and hosting from abuse | Legitimate interests in service and information security |
| Keep correspondence or contract records where an enquiry progresses | Contract, pre-contract steps, legal obligation and/or legitimate interests, depending on the record |
| Create and reconcile a requested package-deposit Checkout Session | Contract and requested pre-contract steps; legitimate interests in secure payment administration |
The assessment is directional and does not make a legal or similarly significant decision. Direct marketing is disabled at launch.
5. Recipients and processors
- Render Services, Inc. provides application hosting, managed HTTPS and runtime logs. The intended service region is Frankfurt. Render documents international-transfer safeguards including Standard Contractual Clauses and UK addendum terms.
- Plus Five Five, Inc. (Resend) delivers Contact and Digital Assessment messages. Resend documents US storage and safeguards including Standard Contractual Clauses and the UK Extension.
- Zoho Corporation Limited / Zoho Corporation B.V. provides the EU-hosted business mailbox. The account’s Data Processing Addendum is recorded as signed.
- Stripe Payments Europe, Limited and, where applicable for UK regulated payment services, Stripe Payments UK Ltd provide hosted Checkout, payment processing, receipts, fraud prevention and payment records.
VELYREN does not sell personal data. Information may also be disclosed where necessary and lawful to professional advisers, insurers, regulators, courts or law enforcement. Neon, Cloudflare R2 and ClamAV are not used by the lean public runtime.
6. International transfers
Render, Resend and Stripe may process or permit support access outside the UK, including in the United States. Their published terms use recognised safeguards including the EU Standard Contractual Clauses, UK addendum or extension mechanisms, and—where applicable—the UK Extension to the EU-US Data Privacy Framework. Zoho operates the mailbox in its European data centre under the signed account agreement. Contact VELYREN for more information about applicable safeguards.
7. Retention
The lean application stores no enquiry or payment database record. Enquiries that do not progress should ordinarily be removed from the approved mailbox and available provider records 12 months after the last meaningful contact. Stripe payment, receipt, accounting, fraud and dispute records are retained according to legal and accounting needs and Stripe’s controls. Contractual, accounting, tax, dispute or legal-claim records may require a different lawful period.
8. Cookies and browser storage
The VELYREN-origin lean runtime sets no cookies and uses no localStorage or sessionStorage. It has no advertising, behavioural analytics or cross-site tracking. Stripe’s separate hosted Checkout may use storage necessary for secure payment, fraud prevention and operation under Stripe’s notice. See the Cookie and Storage Notice.
9. Security
Controls include HTTPS and HSTS assumptions, restrictive security headers, same-origin checks, bounded request bodies, validation and escaping, request identifiers, abuse limiting, provider idempotency, redacted logs, secret validation and fail-closed removal of private portal, upload and administrator systems from the lean runtime. No internet service can guarantee absolute security.
10. Your rights and complaints
Depending on the circumstances, you may have rights to be informed, access data, correct it, request deletion or restriction, object to legitimate-interest processing, receive certain data, and withdraw consent where consent is used. Rights are not absolute and identity may be checked proportionately.
Contact hello@velyren.com. You may also complain to the Information Commissioner’s Office through ico.org.uk/make-a-complaint or by calling 0303 123 1113.
11. Changes
This notice will be updated before accounts, file storage, a database, non-essential analytics, direct marketing or a new processor is enabled in production. Material changes will be identified by a new effective date.