Privacy Policy

Who this covers

This policy applies to Veyra and to everything you do on this site — browsing the encyclopedia, building a design in the studio, and placing an order. It was last reviewed on 9 August 2026.

What we collect

Only what an order needs to reach you. When you check out we store:

Your name and delivery address — street, optional second line, city, state or region, postcode and country.
Your phone number — carriers ask for one on cross-border parcels.
Your email address — where the order confirmation and the tracking link go.
Any note you add to the order, if you write one.
Your design — the stones you picked, their order, the bead sizes and your wrist measurement. This is the instruction sheet the bracelet is strung from, so we keep it with the order.

Two other things create a record, and neither is part of checkout:

If you write to us through the contact form, we keep the name, email address, order number and message you typed, so we can answer you and find the thread again later.
If you save or share a design, the stones and wrist size behind that link are stored on their own. That record holds no name, address or email — anyone with the link sees only the bracelet.

We never see or store your card number. Card details are entered on Stripe's own payment page and never touch our server — see Who else sees your data.

Why we need it

Each field above exists because a specific step fails without it: we cannot string a bracelet without the design, cannot ship it without the address, cannot confirm it without the email, and cannot pass a customs form without a contact number. We do not collect anything speculatively in case it becomes useful later.

The legal basis, where that framing applies to you, is performance of the contract you enter when you place the order — plus our legitimate interest in keeping records of completed sales for accounting and dispute handling.

Cookies

One cookie. It holds your session so that the design you are building survives a page reload and so your basket is still there when you come back from the payment page. It carries no advertising identifier and cannot be read by JavaScript in your browser.

It expires seven days after your last visit, or immediately when you clear your browser data. Blocking it will not break browsing, but the studio will forget your design between pages.

There is no analytics, advertising or social tracking on this site. No Google Analytics, no Meta pixel, no TikTok pixel. That is why you are not being asked to dismiss a consent banner — there is nothing to consent to.

Who else sees your data

Two companies, each for one job, and neither gets more than that job needs.

Stripe — takes the payment. Stripe receives your email address, the amount, and an internal order reference. Your shipping address is not sent to Stripe. Your card details go directly to Stripe and are governed by their privacy policy.
DeepSeek — writes the optional crystal readings. For a bracelet energy reading it receives the stone names and their traditional associations. For the Lucky Stone tool it receives the name you enter (if any), your birthday month and day, your zodiac sign, and the suggested stones. It receives no address, email, phone number, payment data or order number. The name and birthday used by Lucky Stone are not written to our order database. If the service is unavailable, the reading is written by our own code instead.

Our site and database are hosted on Render, which stores the data on our behalf but does not use it. Beyond these, we do not sell, rent, trade or share your personal data with anyone. There is no data broker in this chain.

Where your data goes

This is a cross-border business, so your data crosses borders: our hosting, our payment processor and our fulfilment are not all in your country. Where your local law requires safeguards for that transfer, we rely on our providers' standard contractual terms. If you would rather not have your data leave your region, the honest answer is that we cannot ship to you without it.

How long we keep it

Session data, including an unfinished design that never reached checkout, expires seven days after your last visit and carries no contact details. Order records we keep for as long as accounting, tax and dispute windows require — a paid order is a financial record, and deleting it the moment it ships would leave us unable to honour a return or answer a chargeback.

Unpaid test and abandoned orders may be removed from our order records.

Your rights

Wherever you are, you can ask us to:

Show you the data we hold on you.
Correct it — a mistyped address is worth fixing fast, before the parcel leaves.
Delete it, once no order is still open and no accounting or dispute window still applies to it.
Export it in a portable form.
Object to a particular use of it.

If you are in the UK, EU, or another region with equivalent law, these are statutory rights and you also have the right to complain to your local data protection authority. We would rather you came to us first.

Ask through the contact form or by email at veyrabeads.support@gmail.com. Include your order number if you have one — it is how we find you without asking for more personal data than we already hold.

How it is protected

The whole site runs over HTTPS, so what you type reaches us encrypted. Your order page is reachable only with the private link in your confirmation email, and those pages are excluded from search engines. Card data never reaches our server, which means it cannot be exposed from it.

No system is beyond reach. If a breach ever affected your data, we would tell you rather than wait for you to find out.

Children

This site is not intended for children under 13, and we do not knowingly collect their data. If a child's details have been submitted, contact us and we will delete them.

Changes to this policy

If our data practices change — a new processor, a new field at checkout — this page changes with them and the review date at the top moves. We will not quietly widen what we collect and leave the old policy standing.