Velora

Privacy policy

Last updated: March 2026

1. Who we are

Velora is operated by Äctvli Responsible Consulting (“we”, “our”, “us”). Contact: reachout@actvli.com

We act as a data controller for studio owner accounts, and as a data processor for end-client data held on behalf of studio owners.

2. Data we collect

Studio owners: Email address, password (hashed), studio name, payment information (via Stripe — we do not store card numbers).

Studio clients (end users): First name, last name, email address, phone number (optional), booking history, payment history via Stripe.

Automatically: Log data, IP addresses (stored for security purposes only, purged after 30 days).

3. How we use it

  • To provide the Velora service (scheduling, booking, payments)
  • To send transactional emails (booking confirmations, waitlist notifications)
  • To process payments via Stripe
  • To comply with legal obligations

We do not sell personal data. We do not use personal data for advertising.

4. Legal basis (GDPR)

We process data on the following legal bases:

  • Contract performance — to deliver the service you signed up for
  • Legitimate interest — security logging, fraud prevention
  • Consent — marketing emails (opt-in only)

5. Data retention

Account data is retained for as long as you hold an active account. Upon cancellation, data is retained for 30 days then deleted, unless required by law. You can request immediate deletion.

6. Third-party processors

  • Supabase — database and authentication (EU region)
  • Stripe — payment processing
  • Resend — transactional email delivery
  • Vercel — hosting (EU region)
  • Anthropic — AI column mapping (CSV headers only, no personal data transmitted)

7. Your rights

Under GDPR you have the right to:

  • Access your data (right of access)
  • Correct inaccurate data (right to rectification)
  • Delete your data (right to erasure)
  • Restrict or object to processing
  • Data portability (receive your data in a machine-readable format)
  • Lodge a complaint with a supervisory authority

To exercise any of these rights, contact us at reachout@actvli.com. We will respond within 30 days.

8. Cookies

We use only functional cookies necessary for authentication (session tokens set by Supabase). We do not use tracking or advertising cookies.

9. Data processing agreement

Studio owners who process personal data of their clients through Velora can request a Data Processing Agreement (DPA) by emailing reachout@actvli.com.

10. Changes to this policy

We may update this policy periodically. We will notify account holders by email of material changes. The current version is always available at this URL.