Scope and contact
VELORIA HOLDINGS LTD operates VELORIA Customer, Android package com.veloria.customer. This policy covers the app and services supporting its customer functionality. Our corporate website privacy policy is separate.
General privacy enquiries: info@veloriaholdingsltd.com.
Customer account-deletion requests: support@veloriaholdingsltd.com.
Postal address: VELORIA HOLDINGS LTD, 71–75 Shelton Street, London, England, WC2H 9JQ, United Kingdom.
Accounts and profiles
We process your email address, name, account and customer identifiers, authentication information, verification and account status, and relevant timestamps to establish and maintain your account. You may provide additional profile information, such as a phone number.
Firebase Authentication handles email/password authentication. If you choose Google sign-in, Google and Firebase process your sign-in and provide identity information such as your name, email address, account identifier, and available profile-picture information. The app does not receive your Google password.
Customer records and payments
When you submit an address, we process the recipient’s name, street address, city, region, country, postal code, and any phone number you provide. These are details you enter; the app does not obtain your address using GPS.
Wishlist items are associated with your account and synchronised with our services. Where available for your account, the app retrieves order and invoice information, including items, amounts, payment and order status, shipping information, and invoice identifiers. Selected records may be cached on your device. Invoice-document export is currently unavailable.
Production checkout, wallet top-ups, paid membership checkout, and rewards redemption are currently unavailable. Production cart changes are also unavailable. The app may request wallet, rewards, or membership account information for display where supported; these displays may be unavailable.
The current production app has no active payment-card entry or checkout flow and does not collect full card numbers or card security codes through such a flow. Existing customer records may contain transaction amounts, payment status, and references; these are different from full card credentials. If payment functionality is enabled, we will update the relevant disclosures to explain the applicable processing.
Support and communications
Support requests involve the contact details and content you provide, including ticket subjects, categories, messages, identifiers, and timestamps. Pending support messages may be stored on your device until sent. Do not include passwords, full card details, or unnecessary sensitive information in support messages.
Account emails include verification and password-reset communications. We also process your communication preferences.
If you enable push notifications and grant the necessary Android permission, Firebase Cloud Messaging processes a notification token. Our services process installation information, device model, app version, platform, permission state, and notification preferences to manage registration and notifications. You can change notification preferences in the app and permissions in Android settings. Optional push notifications are separate from essential account and security processing.
Security and device information
Firebase Authentication, Cloud Firestore, Cloud Functions, and App Check with Play Integrity support authentication, account functionality, data storage and retrieval, and protection against abuse. These operations involve account and session identifiers, app or installation identifiers, device/model information, app version, integrity information, timestamps, and technical request information. Providers also process network information, such as IP addresses, to deliver and protect their services.
Where you use biometric or device authentication, Android performs the verification. The app does not receive biometric templates or your device PIN.
We use encrypted network connections and authentication, access, and app-integrity controls to protect information. No system can guarantee absolute security.
Optional analytics and diagnostics
Analytics and diagnostic collection are disabled by default. A device-level setting in the app enables Firebase Analytics, Crashlytics, and Performance Monitoring. The setting can remain saved on the device after sign-out.
When enabled, these services may process app-instance identifiers, app lifecycle and interaction information, crash/error information, device and operating-system details, and available performance measurements. Analytics can derive approximate location from IP information; this is not GPS tracking.
You can disable the setting in the app. Disabling future collection does not itself request deletion of information already transmitted. Essential account, service-operation, and security processing continues separately from this optional setting.
Advertising-ID collection and advertising-personalisation signals are disabled in the app’s configuration.
On-device information
The app stores selected preferences, cached account-related records, and pending support messages on your device. The current search and recommendation features process search history and recommendation signals on-device.
Signing out or uninstalling the app does not request deletion of your server-side account or all associated records.
Purposes and legal bases
We process information to authenticate you, maintain your account, provide requested customer features, display available account records, manage saved items, respond to support requests, deliver permitted communications, and protect services. Optional analytics and diagnostics help us understand app usage and investigate reliability problems.
Where applicable law requires a legal basis, the basis depends on the processing: providing a service you request, legitimate interests in operating and securing the service, compliance with applicable legal obligations, or consent for optional processing. You can withdraw consent for optional telemetry through the app setting without disabling essential account and security processing.
Providers and international processing
Google/Firebase supplies authentication, database, backend, notification, app-integrity, and optional analytics/diagnostic services. Google also processes information when you choose Google sign-in. Resend is used for authentication-email delivery. Relevant information is processed by these providers to supply their services. Google sign-in also involves processing under Google’s own privacy terms.
Information may be disclosed where required by applicable law or where necessary to address fraud, security incidents, disputes, or legal claims, limited to the applicable purpose.
Information may be processed outside your country. Certain app backend Functions are configured in the United States. Google/Firebase and Resend are involved in the processing described above. Applicable safeguards are used where legally required for international processing. Contact us for information about arrangements relevant to your data.
Retention
We retain information according to the purpose for which it is needed. Account and profile information supports account administration; addresses and saved items support requested customer features; support messages support assistance and resolution; and technical records support operation, reliability, and security.
Some records may be retained where required for security, fraud prevention, disputes, financial/accounting, or legal obligations. This can include relevant transaction and invoice records, support correspondence, and security records. Retention depends on the record, the applicable obligation, and whether the purpose still requires it; there is no single retention period for all information.
Account deletion does not necessarily mean immediate deletion of every record. Any retained information is limited to the applicable purpose. Contact us for retention information relevant to your account.
Deletion and your rights
To request deletion of your VELORIA Customer account and associated personal information, email support@veloriaholdingsltd.com from your registered account email address. Use the subject “VELORIA Account Deletion Request”, identify the account, and state that you want it deleted.
We may need to verify that you control the account. Requests are subject to records that must be retained for the purposes described under Retention. Where information must be retained, the applicable categories and reasons will be explained when handling your request. No immediate or automatic erasure is promised.
The current app does not offer immediate self-service account erasure. You can make a request without signing into the app by using the email address above. Public instructions are also available on our account-deletion page.
Depending on applicable law, you may have rights to access, correct, erase, restrict or object to processing, or receive a portable copy of certain information. These rights may be subject to legal conditions and exceptions. Send general privacy and rights enquiries to info@veloriaholdingsltd.com.
You may raise concerns with your relevant data-protection authority, including the UK Information Commissioner’s Office.
Adults only
VELORIA Customer is intended for people aged 18 and over. Its Google Play configuration restricts users whom Google identifies as minors. This does not guarantee that every underage user will be identified.
If you are under 18, do not create or use a Customer account. If you believe a minor has provided personal information, contact us so we can investigate and address the account and information.
Policy changes
We will update this policy when relevant app features or data practices change and identify the policy version on this page.