Privacy Policy
1. Who we are and what this policy covers
VEYRO FORCE operates VEYRO FORCE at https://veyroforce.com and https://app.veyroforce.com. This Privacy Policy applies to personal information we handle through the website, the app, trainer websites and booking pages created with the Service, and our emails. It forms part of our Terms & Conditions.
You can contact us about privacy using the contact details published on veyroforce.com or in the Settings page of the app.
2. Our role: responsible party and operator
- For information about you as our customer (your account, login, subscription, billing and how you use the Service) we decide why and how it is used. We are the "responsible party" (POPIA) or "controller" (GDPR).
- For information about your clients, leads and website visitors that you enter or collect through the Service ("Client Data"), you decide why and how it is used and we process it for you as your "operator" or "processor". You are responsible for having a lawful basis and giving your clients any required notices. If you are a client or a website visitor of a trainer and want to see, correct or delete your information, please contact that trainer first; we will help them respond.
3. Information we collect
- Account information: your name, email address, password (stored only in scrambled form by our authentication provider), and your workspace name and web address.
- Workspace content you or your team enter: business and profile details, website content and images, services, availability, leads and clients (names, contact details, notes, status), appointments, messages and emails sent through the Service, notes and photographs you attach, automation settings, and files you upload.
- Information from your website visitors that you receive through the Service: what someone types into your contact or booking form (for example name, email, phone, message, answers to your questions, the time they book).
- Subscription and billing information: our payment provider (Stripe) collects and holds your card details. We keep only your Stripe customer and subscription identifiers, plan, status, trial and renewal dates, cancellation dates, and a non-reversible "fingerprint" of your card, which we use to make sure a card is only used for one free trial. We do not store your card number.
- Agreement records: the version of the Terms and Privacy Policy you accepted, a cryptographic fingerprint of the text, the date and time, your IP address, your browser details, and your account and workspace identifiers. We keep these as evidence of your agreement.
- Technical and usage information: IP address, device and browser type, pages and actions in the app, error and security logs, and approximate location derived from your IP address.
- Communications: messages you send us and our replies, and system emails we send you (for example account, security and billing emails).
4. How we use information, and our legal bases
We use personal information to:
- provide, operate, secure and support the Service and your workspace, including sending the emails and running the automations you set up (performance of our contract with you);
- create and manage your account, take and manage payments, apply the free-trial rules and suspend accounts with unpaid subscriptions (contract and our legitimate interest in preventing abuse and fraud);
- keep records of your agreement to our Terms and to recurring billing (legal obligation and our legitimate interest in proving what was agreed);
- protect the Service, investigate misuse, enforce our Terms and comply with the law (legitimate interests and legal obligation);
- communicate with you about your account, security, billing, support and important changes (contract and legitimate interest);
- understand and improve the Service, fix errors and plan capacity (legitimate interest);
- send you news or offers about the Service, only where you have chosen to receive them or the law allows, and you can opt out at any time (consent or legitimate interest).
We do not sell personal information. We do not use Client Data for our own marketing, and we do not use it to profile individuals or to train advertising systems.
6. Who we share information with
We share information only where needed to run the Service, to comply with the law, or with your instruction. Our service providers ("sub-processors") currently include:
- Supabase — database, authentication and file storage;
- Cloudflare — hosting, content delivery, network security and DNS;
- Resend — sending transactional email, including automations and system emails;
- Stripe — payment processing and subscription management.
These providers may only use information to provide their service to us and must protect it. We may change providers and will update this policy when we do. We may also disclose information: to comply with a law, court order or lawful request; to protect our rights, safety, property or the security of the Service; to enforce our Terms; and in connection with a merger, acquisition or sale of the business, in which case the recipient must respect this policy. We may share information with your permission, for example when you ask us to.
7. International transfers
Our providers operate globally, so your information, and Client Data, may be processed in countries other than the one where you or your clients live. Where the law requires, we use appropriate safeguards for such transfers, such as contractual protections, and we ask providers to protect information to a standard comparable to the law that applies to you.
8. How long we keep information
- Account and workspace data: while your account exists. If your subscription ends or is suspended we keep your data for a limited period so you can come back; if a workspace stays suspended, unpaid or cancelled for more than 90 days we may, after notice to your email, permanently delete it.
- Deletion requests: you can ask us to delete your account and data. We will do so within a reasonable time, apart from information we must or may lawfully keep.
- Billing and tax records: as long as the law requires.
- Agreement and security records: acceptance records and fraud/abuse prevention records (including card fingerprints) are kept for as long as needed to prove agreement, defend legal claims and prevent abuse, even after your account is closed; they do not include your card number.
- Backups and logs: deleted information may remain in backups and logs for a limited period before it is overwritten.
9. How we protect information
We use reasonable technical and organisational measures, including encrypted connections, access controls, separation between workspaces so one customer cannot see another's data, restricted internal access, and use of reputable infrastructure providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please keep your password private and tell us straight away if you suspect unauthorised access.
If a security incident affects personal information we hold, we will notify the affected customers, and regulators where required, without undue delay.
10. Your rights
Depending on where you live (including under POPIA in South Africa and the GDPR in the EU and UK), you may have the right to: ask what personal information we hold about you and get a copy; correct or complete it; ask us to delete it; object to or restrict certain uses; withdraw consent you have given; receive your information in a portable format; and not be subject to decisions based solely on automated processing that significantly affect you (we do not make such decisions).
To exercise a right, contact us using the contact details published on veyroforce.com or in the Settings page of the app. We may need to verify your identity, and we may not be able to grant a request in full where the law allows or requires us to keep the information or where it would affect others' rights. If you are unhappy with how we handle your information you can complain to us, and you also have the right to complain to the data-protection authority in your country, for example the Information Regulator (South Africa) or your local EU/UK authority.
If you are a client or visitor of a trainer who uses the Service, please contact the trainer about your information first.
11. Children
The Service is for business use by adults (18 and over) and is not directed at children. We do not knowingly collect information from children for our own purposes. If a trainer records information about a minor, the trainer is responsible for having the consent of a parent or guardian and for complying with the law. If you believe a child has given us information, contact us and we will take appropriate steps.
12. Emails from us and from trainers
We send service and account emails (such as confirmation, password reset, billing and security notices) that you cannot opt out of while you have an account. Marketing emails from us, if any, include an opt-out. Emails that a trainer sends through the Service, including automated follow-up, are sent by that trainer; the trainer is responsible for them and for honouring your opt-out. Contact the trainer to stop their messages.
13. Third-party links and services
Trainer websites, our website and our emails may link to other sites. We are not responsible for their content or privacy practices. When you go to Stripe to pay, Stripe's own privacy policy applies to what it collects.
14. Changes to this policy
We may update this policy from time to time. The current version is always at https://veyroforce.com/privacy and in the app. When we make a material change we will ask you to accept the new version before you continue, and may notify you by email.
15. Contact
For privacy questions, requests or complaints, contact us using the contact details published on veyroforce.com or in the Settings page of the app.