Privacy Policy
Last updated: 3 October 2026
1. Data Controller
Velor Commerce Ltd is the data controller for personal data collected through the Velor platform. We are committed to protecting your privacy in accordance with UK GDPR and the Data Protection Act 2018.
2. Data We Collect
We collect: (a) Account data — name, email address, password hash; (b) Transaction data — order details, shipping address, payment confirmation; (c) Seller data — business name and payout account details (Stripe Connect, or Wise where applicable); (d) Usage data — pages visited, device type, browser; (e) Communications — messages sent via the platform.
3. How We Use Your Data
We use your data to: (a) process and fulfil orders; (b) manage your account; (c) communicate order and account updates; (d) operate and improve the platform; (e) comply with legal obligations; (f) detect and prevent fraud.
4. Lawful Basis
We process personal data on the following lawful bases: (a) Contract — necessary to fulfil orders and operate accounts; (b) Legal obligation — tax, fraud prevention, and other legal requirements; (c) Legitimate interests — platform security, analytics, and service improvement; (d) Consent — marketing emails to customers who have opted in (you may withdraw consent at any time); (e) Legitimate interests — a single invitation email to makers at a published business address (see section 11, Makers we contact about selling on Velor).
5. Data Sharing
We share data with: (a) Sellers — order details necessary to fulfil your purchase; (b) Stripe — payment processing and seller payouts; (c) Wise — seller payouts, for sellers in countries where Stripe payouts are not available; (d) Vercel — platform hosting; (e) Resend — transactional email delivery. We do not sell personal data to third parties.
6. International Transfers
Some of our service providers process data outside the UK. Where data is transferred internationally, we ensure appropriate safeguards are in place, including Standard Contractual Clauses where required.
7. Data Retention
We retain account data for as long as your account is active. Order data is retained for 7 years for tax and legal compliance. You may request deletion of your account at any time, subject to legal retention obligations.
8. Your Rights
Under UK GDPR, you have the right to: access your data; rectify inaccurate data; erase your data (where lawful); restrict or object to processing; data portability; withdraw consent. To exercise any right, email privacy@velorhandmade.com.
9. Community & Social Features
The Makers' Circle lets buyers follow sellers, and sellers publish journal posts that are public by their nature. Buyer collections (saved product lists) are private by default; a collection is only visible to anyone else if you explicitly switch it to public from your collections page. If you do, its name, saved items, and your existing pseudonymous display name (e.g. "First L.") may be shown to other users, including on the Makers' Circle homepage — never your full name, email, or other account data. You can switch a collection back to private, or delete it, at any time.
10. Cookies
We use strictly necessary cookies for session management, authentication and fraud prevention (Stripe), and remember preferences you choose, such as language and currency. Our first-party visit counter only runs if you allow it, and you can change that on our Cookies page at any time. We do not use advertising cookies.
11. Makers we contact about selling on Velor
We may email makers once to invite them to sell on Velor. We find them through public business listings, such as an online shop or business website, and collect only what is published there: the shop or business name, its web address and platform, a published business email address, the country, the kind of goods made, and short notes on why the work may suit Velor. Software, including an AI screening step run by Anthropic, checks that the shop sells handmade goods before anyone is contacted. Our lawful basis is legitimate interests (UK GDPR and EU GDPR Article 6(1)(f)): inviting independent makers is how Velor grows, and we keep the intrusion small by sending one email only, with no follow-ups, to a business address the maker has published. Every invitation includes an unsubscribe link and a link to this section. You have the right to object at any time (Article 21): unsubscribe, reply to the email, or write to privacy@velorhandmade.com, and we will not contact you again. We keep a record that you opted out so we can make sure of that. You can also ask us for a copy of what we hold, or ask us to delete everything apart from that opt-out record. Invitations are sent from our Microsoft 365 mailbox; we do not sell or share these details with anyone else. We do not send these invitations to makers in the UK, Ireland, Germany or Canada, where the rules require prior consent.
12. Contact and Complaints
Data protection enquiries: privacy@velorhandmade.com. If you are unhappy with how we handle your data, you may lodge a complaint with the Information Commissioner's Office at ico.org.uk.