Privacy Policy

1. Who we are

Veyra is booking software with an AI assistant for beauty and wellness businesses. It's provided by Samuel Walton, a sole trader in England trading as Veyra(“we”, “us”). You can contact us at info@try-veyra.com. Our postal address is available on request from info@try-veyra.com.

This policy explains how we handle personal data for three groups of people:

• businesses that use Veyra, and the people who work for them;
• clients of those businesses;
• visitors to our website, try-veyra.com.

2. Businesses using Veyra, and their teams

If you own or work at a business that uses Veyra, we're the “controller” of the personal data we need to run your account. That means we decide how it's used and we're responsible for it.

What we collect

• Account details: your name, email address, role, and the business you belong to. Your password is stored only in a scrambled (hashed) form that we can't read.
• Team details the business adds, like your working hours and the treatments you offer.
• Billing details: the business's plan, subscription status, invoices and a Stripe customer reference. Card details go straight to Stripe — we never see your full card number.
• A record of when an owner agreed to our Terms and Data Processing Agreement, which version, and which login did it.
• What you tell us when you get in touch, like support emails.
• If you switch on booking alerts, a technical address for your device's push service, so alerts can reach it.
• How the business uses Veyra — for example the AI use counted against its plan's allowance — and technical details like IP addresses, used to keep Veyra secure.

Why we use it, and our lawful basis

Running Veyra

To provide your account, sign-in, booking alerts and service emails like password resets and team invites. Lawful basis: our contract with the business; for team members, our legitimate interest in providing the service the business has asked for.

Billing

To bill the business and keep accounting records. Lawful basis: contract, and our legal obligations.

Security

To keep Veyra secure, prevent misuse and limit repeated sign-in attempts. Lawful basis: legitimate interests.

Support and updates

To answer questions and tell you about important changes, like updates to our terms. Lawful basis: contract and legitimate interests.

Improving Veyra

Using anonymous, combined statistics about how Veyra is used. Lawful basis: legitimate interests.

News about Veyra

If we email you news about Veyra, every email lets you opt out. Lawful basis: legitimate interests.

How long we keep it

We keep account details while the business uses Veyra. When a business closes its account, we delete them from Veyra within 30 days of its written request; copies in our providers' own logs are deleted under their retention periods. If an account stays lapsed for more than 12 months, we may delete it after giving the owner 30 days' notice. We keep billing and accounting records for six years, because UK tax law requires it.

3. Clients of businesses that use Veyra

If you book with, message or fill in a form for a salon, studio or clinic that uses Veyra, that business is the controller of your personal data. It decides what to collect and why, and its own privacy notice applies. We're its “processor”: we store and handle your data on its behalf, only to run Veyra for it, under our Data Processing Agreement with it.

What a business may keep about you in Veyra

• your name, mobile number, email address, home address and date of birth;
• your bookings and visit history, deposits and payment records — for example an amount and a payment reference, never your full card number, which only Stripe sees;
• notes the team makes, your preferences, and photos (for example before-and-after photos, or photos you send);
• consultation, patch-test and health questionnaire answers. These can include health information, which the law treats as especially sensitive;
• messages between you and the business — including chats with its AI assistant by web chat, text, WhatsApp or Instagram;
• your marketing choices, packages, gift vouchers and waitlist requests;
• if you create a booking account, your login — your password is stored only in hashed form.

The AI assistant

Businesses can use Veyra's AI assistant to reply to your messages, help you book and brief the team before your visit. To do this, what each task needs is sent to our AI provider, Anthropic — for example your messages and booking details or, for a briefing, the notes and visit history in your record. Under Anthropic's commercial terms, data sent through its API isn't used to train its AI models. The AI doesn't give medical advice — it passes medical and allergy questions to the team — and businesses can choose to check its replies before they're sent. If you'd rather talk to a person, just say so.

Deposits and no-show fees

Veyra can estimate how likely a booking is to be missed — using things like whether you're a new client, past missed appointments and how far ahead you booked — and, depending on the business's settings, ask for a deposit. It keeps that estimate and a count of your missed appointments. If you think it's got this wrong, contact the business: it can waive a deposit.

If you pay a deposit by card, Stripe saves your card with the business — Veyra only keeps a reference to it, never the card number. If the business then marks a later appointment as missed and no deposit or package covered it, Veyra charges that card a no-show fee straight away, in line with the business's booking policy, and you'll get a message saying so. Questions about a fee go to the business.

Your choices and rights

Because the business is in charge of your data, please contact it first — for example to see, correct or delete your details. You can opt out of marketing messages at any time by replying STOP, or by asking the business. If you contact us instead, we'll pass your request to the business promptly and help it respond.

How long it's kept

The business decides how long to keep your details. If it erases your record (or asks us to), your name, contact details, booking account, notes, photos and messages are removed from Veyra. Some records may be kept where the business needs them — anonymised booking and payment records for its accounts, and signed consultation forms and patch-test records it must keep for its insurance. Signed forms stay as you signed them, with the details you gave on them.

4. Visitors to our website

• We don't use analytics, advertising or tracking cookies, or third-party trackers. Our fonts are served from our own site.
• If you send us an enquiry, for example through “Start free” or “Talk to us”, we receive your name, business, email address, phone number and message, keep a copy in our own system and use them to reply. Lawful basis: our legitimate interest in answering you, and taking steps you've asked for before signing up. We keep enquiries for up to two years unless you become a customer.
• We count page visits — on our website, on the booking, account and form pages we host for businesses, and inside Veyra for signed-in teams (counted against the business, not the person) — to see how Veyra is used and improve it, without cookies or anything stored on your device. For each page we record which page it was (never personal links such as form or reset links), the site that sent you, any campaign tag in the link, the type of device and, where available, the country. We don't store your IP address or browser details: they're mixed with a random key that's made fresh each day and then thrown away, into a code that only lets us count unique visitors that day — once the day is over, no one can work out whose it was. Only we see these figures; we never share or sell them, and we delete them after 13 months. Lawful basis: our legitimate interest in running and improving Veyra.
• Messages you type into our live demo are sent to our AI provider to write replies, and stored with the demo business until we next reset it — at most 12 months. Please don't enter real personal details.
• If you build a booking page at try-veyra.com/build, the business details and price list you type in are sent to our AI provider, Anthropic, to draft your page. Your preview, and any test chats with its AI, are kept for 14 days and then deleted. If you keep the page by making an account, the page becomes part of your account and the test chats are deleted. We use your IP address only to stop the tool being misused: we keep it only in a scrambled (hashed) form, to limit how many previews can be made, and we use it briefly, as it is and without storing it, to limit repeated tries. When it's switched on, Cloudflare's Turnstile checks you're a person: it runs in your browser, and Cloudflare receives technical details about your browser and connection, including your IP address, to do it. Please don't type real clients' details into the test chat. Lawful basis: taking steps you've asked for before signing up, and our legitimate interest in preventing misuse.
• Like most websites, our hosting provider may keep technical logs, which can include IP addresses, to run and secure the service. We also use IP addresses briefly to limit repeated sign-in, sign-up and enquiry attempts.

5. Cookies and storage on your device

We only use cookies and device storage that Veyra needs to work. We don't use them to track you, so we don't ask for cookie consent.

veyra_session (cookie)

Keeps team members signed in. Lasts 30 days, or until you sign out.

veyra_client (cookie)

Keeps clients signed in to their booking account with a business. Lasts 180 days, or until you sign out.

Storage on your device

Remembers a web chat so the conversation carries on when you come back, choices like dismissing a prompt, your progress through setting up an account, and — until you close the tab — your booking confirmation and forms you've filled in.

Offline copies

The Veyra app for teams keeps copies of pages you've opened on your device, so the diary stays readable if your internet drops.

6. Who we share data with

We use trusted service providers to run Veyra. They use the data only to provide their service to us, under written terms that protect it. The exception is Meta, which also uses some WhatsApp and Instagram data for its own purposes, under its own terms.

• Railway

  Hosts the Veyra app and its database.

  When: Always.

• Anthropic (Claude)

  The AI behind client replies, briefings, tidied visit notes, campaigns, the Analyst, photo consultations and set-up drafts.

  When: Whenever the AI is used. Switching off “Let the assistant answer clients” in Settings stops AI replies to clients, but briefings, weekly summaries and AI tools the team starts still run.

• Resend

  Sends emails: booking confirmations, forms, deposit details, password resets, team invites and weekly summaries.

  When: Whenever an email is sent.

• Cloudflare

  Runs the domain name and DNS for try-veyra.com, forwards email sent to info@try-veyra.com, and (when it's switched on) checks that someone building a booking page at try-veyra.com/build is a person (Turnstile).

  When: Always.

• Twilio

  Sends and receives text messages (SMS).

  When: Only if the business has texting switched on.

• Meta (WhatsApp and Instagram)

  Sends and receives WhatsApp and Instagram messages. Meta also uses some of this data for its own purposes, under its own terms with the business.

  When: Only if the business connects WhatsApp or Instagram.

Booking alerts to team members who switch them on travel through their phone or browser's own push service — Apple, Google or Mozilla. Alerts are encrypted so the push service can't read them; it only carries them, like a postal service, and isn't one of our sub-processors.

Stripe handles Veyra's own subscription billing. When a business connects its own Stripe account, Stripe also takes card payments for that business, under the business's own agreement with Stripe.

We may also share data if the law requires it, to protect people's safety or our legal rights, or with whoever takes Veyra over if it's ever transferred — and this policy would still apply. We never sell personal data.

7. Data sent outside the UK

Some of our providers are based in, or process data in, the United States or other countries outside the UK. When personal data leaves the UK, we make sure it's protected as UK law requires — for example where the UK has recognised the country as adequate (including the UK Extension to the EU-US Data Privacy Framework, for US companies certified under it), or by using the ICO's International Data Transfer Agreement or the UK Addendum to the EU's Standard Contractual Clauses. Ask us if you'd like to know more.

8. Keeping data safe

We protect data with measures including encrypted (HTTPS) connections; passwords stored only as salted hashes; signed sign-in cookies that scripts on the page can't read; access checks on every request so each business only sees its own data; limits on repeated sign-in attempts; and checking the signatures on messages from Stripe, Twilio and Meta. Our Data Processing Agreement lists our security measures in full.

No system is completely secure. If something goes wrong, we'll tell the businesses affected without undue delay, and the ICO where the law requires it.

9. Your rights

You have the right to:

• get a copy of your personal data;
• have it corrected if it's wrong;
• have it deleted, or its use restricted, in some situations;
• object to how we use it — and to stop marketing at any time;
• receive it in a format you can take elsewhere, in some situations;
• withdraw consent, where we rely on it.

For data we're responsible for, email info@try-veyra.com. We'll reply within one month (we may need longer for a complicated request, and we'll tell you if so), and we may need to check who you are first. If you're a client of a business that uses Veyra, please contact that business — see section 3.

10. Complaints

If you're unhappy with how we've handled your data, please tell us first at info@try-veyra.com. We'll acknowledge your complaint within 30 days and do our best to put things right.

You can also complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

11. Changes to this policy

We'll update this policy when how we handle personal data changes. The version and date are at the top. If the changes are significant, we'll tell businesses using Veyra by email or in Veyra.

Contact us

Veyra is provided by Samuel Walton, a sole trader in England, trading as Veyra. Email info@try-veyra.com or visit try-veyra.com. Our postal address is available on request from info@try-veyra.com.