Privacy Policy

Vepra is operated by ATEDA. This policy explains what we collect, why, and who else processes it. It covers the Vepra product — not the websites our customers build with it, which are controlled by those customers.

What we collect about you as a customer

• Account details — your name and email address. Passwords are stored only as a one-way hash; we cannot read them.
• Sign-in with Google — if you choose Continue with Google, Google tells us your name, email address, profile photo and your Google account ID, and confirms the address is yours. We use them only to create your account and sign you in. We never see your Google password; the access tokens Google issues are stored encrypted and not used for anything else.
• The human check on our forms — our sign-in, sign-up and code forms use Cloudflare Turnstile to tell people from automated abuse. It looks at signals from your browser, such as your IP address and browser characteristics, only to make that check. Cloudflare processes them on our behalf under its Turnstile Privacy Addendum and does not use them for advertising.
• Sign-in and activity records — each time you sign in we record the time and a scrambled code made from your IP address (a keyed one-way hash, never the address itself), and keep it for 90 days to spot abuse, such as one person opening many accounts. While you use the dashboard, the editor or our Claude connection, we also note when you were last active, where, and which site you had open.
• Content you create — the pages, text, images and settings that make up your sites.
• Billing details — handled entirely by Stripe. We store a Stripe customer reference and your subscription status. We never see or store your card number.

What we collect about visitors to sites built with Vepra

Our analytics are cookieless and do not track people across sites. No cookie is set, and no visitor IP address is ever written to our database.

To count a visitor once per day without identifying them, we combine the site ID, the IP address, the browser user-agent and the current date, and store only a one-way hash of that combination. Because the date is part of it, the value changes every day and cannot be used to follow anyone over time or between sites. We also record the page path, referrer, screen width, UTM parameters and country.

Raw page views are aggregated into daily totals and the raw rows are then deleted. If you are a Vepra customer, you are the controller of your own visitors' data and we process it on your behalf.

AI features

When you use the AI chat or describe your business during onboarding, that text is sent to Anthropic to generate a response. Do not paste anything into the AI features you would not want processed by a third party.

What you type in the box on our homepage is also kept by us for 12 months, so we can see what people are asking for, improve Vepra, and stop misuse. It is stored with the same kind of scrambled code made from your IP address, never the address itself. Someone who misuses the box can be blocked from it for 30 days.

Who else processes your data

• Vercel — hosting and content delivery
• Neon — database hosting
• Anthropic — AI generation
• Stripe — payments
• Resend — transactional email, such as password resets
• UploadThing — image and file storage
• Google — sign-in with Google, only if you choose it
• Cloudflare — the human check on our sign-in and sign-up forms (Turnstile)

We do not sell personal data, and we do not share it for advertising. Some of these providers operate in the United States; where required, transfers rely on the providers' own standard contractual clauses.

How long we keep it

Account and site data is kept while your account is open. Raw analytics rows are deleted after aggregation into daily totals. What you type in the homepage box is kept for 12 months, and sign-in records for 90 days. If you close your account we delete your data, except where we must keep records for tax or legal reasons.

Your rights

You can request a copy of your data, ask us to correct it, or ask us to delete it. If you are in the UK, EU or a similar jurisdiction you also have the right to object to processing and to complain to your data protection authority. Email hello@convey.studio and we will respond within 30 days.

Security

Traffic is encrypted in transit. Passwords are hashed. Access to production data is limited to people who need it. No system is perfectly secure, and we will tell affected users promptly if a breach puts their data at risk.

Changes

If we change this policy materially we will update the date above and, for significant changes, email you.

Contact

ATEDA — hello@convey.studio