Privacy Policy

This Privacy Policy is intended to describe how VEYAH DESIGN LLC doing business as Veyah Studio (“Our,” “We,” “Us,” or “Company”) collects, uses, shares, stores, and otherwise processes your Personal Information when you visit our Website, create an account, purchase products or subscriptions, upload content, use our artificial intelligence (“AI”) features, communicate with us, or otherwise use our Services (collectively, the “Services”).

This Privacy Policy also explains your privacy rights, the choices available to you, and how you may contact us with questions or requests regarding your Personal Information.

This Privacy Policy should be read together with our Terms of Service and any other terms, policies, or product-specific terms that apply to the Services.

Definitions

For purposes of this Privacy Policy, the following terms have the meanings set forth below:

“AI Features” means any artificial intelligence, machine-learning, automated, algorithmic, or AI-assisted features used to generate, edit, analyze, modify, or provide design-related outputs, including mood boards, room edits, product recommendations, style guidance, written feedback, and visualizations.

“Automated Decision-Making Technology” (“ADMT”) means any technology, including artificial intelligence, machine learning, algorithms, computational models, or similar systems, that processes Personal Data and substantially assists, replaces, or materially influences human decision-making by generating predictions, recommendations, classifications, rankings, scores, or similar outputs.

“Consent” means a clear, freely given, specific, informed, and unambiguous affirmative act signifying agreement to the processing of Personal Data, obtained without the use of dark patterns, deception, or coercion.

“Controller” means the person or entity that, alone or jointly with others, determines the purposes and means of processing Personal Data.

“Cross-Context Behavioral Advertising” (also referred to as “Targeted Advertising”) means displaying advertisements to a consumer based on Personal Data obtained from the consumer's activities over time and across non-affiliated websites, applications, or online services to predict consumer preferences or interests.

“Deidentified Data” means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer, provided the Controller takes reasonable measures to ensure the data cannot be associated with a consumer, publicly commits to process the data only in deidentified form, and contractually obligates recipients to comply with these provisions.

“Personal Data” (also referred to as “Personal Information”) means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to a particular consumer or household. Personal Data includes online identifiers, biometric information, geolocation data, inferences, and any other information defined as personal data or personal information under applicable state privacy laws.

“Processor” (also referred to as “Service Provider”) means a person or entity that processes Personal Data on behalf of a Controller pursuant to a written contract.

“Sensitive Data” (also referred to as “Sensitive Personal Information”) means a category of Personal Data that includes: government-issued identification numbers; financial account access credentials; neural data; precise geolocation data (within a radius of 1,750 feet); racial or ethnic origin; religious or philosophical beliefs; mental or physical health diagnosis, condition, treatment, or status; sex life or sexual orientation; citizenship or immigration status; genetic data; biometric data processed for the purpose of uniquely identifying an individual; personal data collected from a known child (under 13 years of age, or under 16 for certain purposes); contents of a consumer's mail, email, or text messages (unless the Company is the intended recipient); union membership; and any additional categories designated as “sensitive” under applicable state law.

“Services” means all websites, applications, platforms, subscriptions, digital products, design tools, AI-powered features, user dashboards, quizzes, mood boards, room edits, Vibe Check, Layout Playbooks, The Veyah Edit, Design Match, product recommendations, and any other services offered by Veyah Studio.

“User,” “you,” or “your” means any person or entity that accesses the Website, creates an account, purchases a product or subscription, uploads content, or uses the Services.

“User Submissions” means any content, information, files, photos, images, floor plans, inspiration images, product photos, text, preferences, quiz responses, comments, messages, prompts, room details, or other materials submitted, uploaded, entered, or provided by you through the Services.

“Website” means https://veyah.studio and any related web pages, applications, dashboards, portals, or digital experiences operated by Veyah Studio.

We collect information you provide directly, information collected automatically when you use the Services, and information from third-party tools or service providers that help us operate the Services, and from publicly available sources.

A. Categories of Personal Information Collected

In the preceding 12 months, depending on how you use the Services, we may have collected the following categories of personal information:

• Identifiers. Real name, alias, postal address, unique personal identifier, online identifier, IP address, email address, account name, or other similar identifiers.
• Personal Information under Contact and Financial Information laws. Name, signature, address, telephone number.
• Commercial Information. Records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. Information provided when signing up for a waitlist, free trial, promotion, newsletter, or subscription.
• Communications and Customer Service Information. Emails, chat messages, support tickets, and call records.
• Internet or Other Electronic Network Activity Information. Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement.
• Geolocation Data. Precise physical location or movements.
• Audio, Electronic, Visual, Thermal, Olfactory, or Similar Information. Photographs, video recordings, call recordings, and security video footage.
• Design Project Information, User Content and Uploaded Materials. Uploaded room photos, floor plans, inspiration images, product images, or other project materials. Design goals, room details, project information, and home-related preferences.
• Preferences and Personalization Information. Quiz responses, style preferences, and other similar information that may lead to inferences.
• Inferences Drawn From Personal Information. Inferences drawn from any of the information identified above to create a profile about a consumer reflecting preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes.
• AI Interaction Data. Prompts submitted to AI Features; uploaded images analyzed by AI; AI-generated outputs saved by you; AI-generated design requests or follow-up instructions; AI conversation history; feedback on AI-generated content and/or recommendations; and user edits to AI-generated recommendations.
• Information You Voluntarily Provide. Any additional personal information that you choose to submit through forms, uploads, account settings, surveys, emails, customer support interactions, or other communications with us.
• Sensitive Personal Information. Account log-in credentials, financial account information, debit card number, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; precise geolocation data (within a radius of 1,750 feet); and children's personal information where required by law.
• Professional Profile Information. Designer profile, portfolio information, business information, professional credentials, and certifications (where applicable).

We do not collect sensitive personal information such as Social Security numbers, physical characteristics or description, passport numbers, driver's license or state identification card numbers, insurance policy numbers, employment history, bank account numbers, medical information, or health insurance information.

We collect personal information from the following categories of sources:

Directly From You. Information you provide when you create an account, make a purchase, contact customer service, subscribe to our newsletter, fill out a form, participate in a survey, or otherwise communicate with us, including User Submissions such as room photos, floor plans, product images, inspiration images, quiz responses, design preferences, style goals, and property-related details.

Automatically Through Your Use of Our Services. We collect certain Personal Data automatically when you interact with our websites or services through cookies, web beacons, pixel tags, and similar tracking technologies; server logs and analytics tools that record IP addresses, device identifiers, browser types, operating systems, referring URLs, and usage patterns; and mobile device sensors (with your permission) such as GPS, cameras, microphones, and accelerometers.

From Third-Party Sources. We collect Personal Data from third parties, including data brokers and analytics providers; social media platforms when you interact with our social media pages or use social login features; marketing partners, advertising networks, and affiliates; and third parties with your consent.

AI Providers. Information generated through AI Features may be processed using third-party AI providers acting on our behalf.

Payment Information. We may receive and store limited payment-related information, such as billing name, billing email, billing address, transaction status, subscription status, payment history, invoice information, last four digits of a payment card, and payment method type. We do not receive or store complete payment card numbers. Payment transactions are processed directly by PCI-compliant payment processors.

Publicly Available Information. Public records and publicly available sources (e.g., property records, business registries, court records).

We may use collected information for the following purposes:

• Providing and Managing Products and Services. To provide, maintain, and improve our products and services, including processing transactions, fulfilling orders, delivering requested products or services, managing accounts, providing customer support, and responding to inquiries.
• Communicating With You. To communicate with you about your account, transactions, services, products, policy changes, and administrative matters, and to respond to your requests and questions.
• Marketing and Advertising. To send you marketing communications, promotional materials, newsletters, and advertisements about our products, services, events, and offers, and to conduct market research and customer satisfaction surveys. You may opt out of marketing communications as described in this Policy.
• Personalization and Customization. To personalize your experience with our services, tailor content and recommendations to your preferences and interests, and remember your settings and preferences.
• Analytics and Research. To conduct analytics, research, and statistical analysis to understand how consumers use our services, identify trends, measure the effectiveness of our marketing campaigns, and improve our products, services, and business operations.
• Product Development and Feature Testing. To develop new products, AI Features, beta functionality, experiments, and future services.
• AI-Assisted Services. To analyze uploaded rooms, generate layouts, produce mood boards, personalize recommendations, improve response quality, detect inappropriate content, and perform quality assurance.
• Security and Fraud Prevention. To detect, prevent, investigate, and respond to security incidents, fraud, malicious or illegal activity, and violations of our terms of service or policies.
• Debugging and Quality Assurance. To identify and repair errors, bugs, and technical issues that impair the functionality of our products and services.
• Legal and Regulatory Compliance. To comply with applicable laws, regulations, legal processes, and governmental requests.
• Contractual Obligations. To perform our contractual obligations to you, including fulfilling the terms of agreements, processing payments, and delivering goods and services.
• Business Transactions. To evaluate, negotiate, and complete mergers, acquisitions, asset sales, reorganizations, and other business transactions.

We may use aggregated or de-identified information for business, analytics, product development, research, reporting, and service improvement purposes. Aggregated or de-identified information does not reasonably identify you.

We process Personal Data only for specified, explicit, and legitimate purposes and do not further process Personal Data in a manner incompatible with those purposes. We collect and process only the Personal Data that is adequate, relevant, and reasonably necessary to accomplish the disclosed purposes.

Before using Personal Data for a new purpose that is materially different from the original purpose, we will update this Privacy Policy to disclose the new purpose, provide you with notice of the new purpose at or before the time of collection or use, and obtain your Consent where required by applicable law.

Accuracy of Personal Information. We take reasonable steps to maintain Personal Information in an accurate, complete, and current form appropriate for the purposes for which it is processed. Where appropriate, we provide mechanisms that allow you to review, update, or correct your Personal Information.

Privacy by Design and Default. We incorporate privacy and security considerations into the design, development, and operation of our products and Services. Where reasonably practicable, we configure our Services to collect and process only the Personal Information necessary for the requested functionality.

Accountability and Governance. We maintain a privacy governance program designed to support compliance with applicable privacy laws, including periodic reviews of our data practices, vendor oversight, employee training, data retention procedures, and ongoing monitoring of legal and regulatory developments.

We may create, use, and disclose information that has been deidentified, aggregated, anonymized, or otherwise processed so that it cannot reasonably be used to identify, relate to, describe, or be linked to you or your household.

We may use deidentified or aggregated information to better understand how our Services are used and to improve the overall user experience, including how users interact with our Services and AI Features; general design preferences, style trends, and feature popularity; platform usage patterns and user engagement; website and application traffic; performance metrics; customer support trends; and aggregate purchasing and subscription activity.

We do not attempt to reidentify deidentified information except where necessary to test our deidentification methods, comply with law, or protect our systems.

We do not sell your personal information for monetary compensation. We may disclose Personal Information for purposes that may constitute “sharing” or “targeted advertising” under certain state privacy laws, subject to your applicable privacy rights.

We may share information only as needed for the purposes described in this Privacy Policy, including with the following categories of recipients:

Service Providers. Entities that perform services on our behalf, including cloud hosting providers, payment processors, customer relationship management platforms, email service providers, marketing automation platforms, analytics providers, IT support vendors, database services, security and fraud prevention, AI processing, image hosting and processing, subscription management, error monitoring, and business operations platforms. These service providers are authorized to use information only as needed to provide services to us.

Payment Processors. Payment information is processed by third-party payment processors such as Stripe. We do not directly store full payment card numbers or bank account details on our own systems.

AI Technology Providers. These providers process information solely to provide the requested Services pursuant to contractual obligations and applicable data processing terms, including providers such as Google Gemini, OpenAI, Anthropic, Google Vertex AI, Microsoft Azure OpenAI, or substantially similar providers.

AI and Image Processing Providers. To provide AI Features, room edits, visualizations, and related Services, we may share User Submissions, uploaded images, prompts, and related information with third-party AI, image processing, cloud storage, or infrastructure providers.

Independent Designers. When a user voluntarily uses Design Match, we may share certain identifiers with the matched designer.

Affiliates and Subsidiaries. Companies within the Veyah corporate family for internal business purposes, including shared services, analytics, and consolidated reporting.

Advertising and Marketing Partners. Advertising networks, social media platforms, marketing agencies, and data analytics firms that assist us in delivering targeted advertising and measuring campaign effectiveness.

Business Transaction Counterparties. Potential or actual buyers, investors, lenders, advisors, and other parties involved in mergers, acquisitions, financings, asset sales, or other business transactions.

Professional Advisors. Attorneys, accountants, auditors, consultants, and other professional advisors who provide legal, tax, accounting, audit, compliance, risk-management, and consulting services.

Government Authorities and Legal Entities. Law enforcement agencies, regulatory authorities, courts, arbitrators, and other governmental or quasi-governmental entities in response to lawful requests, subpoenas, court orders, or legal obligations.

Third Parties With Your Consent. Other third parties to whom you authorize or direct us to disclose your Personal Data.

Third-Party Services and Websites. The Services may contain links to third-party websites, retailers, affiliate partners, social media platforms, vendors, designers, payment processors, or other third-party services. This Privacy Policy applies only to Veyah Studio's Services. We are not responsible for the privacy practices, content, security, or policies of third-party websites or services.

Affiliate Links. Veyah Studio may provide product recommendations, shopping links, affiliate links, retailer links, or third-party vendor information. If you click product links or affiliate links, third-party retailers, affiliate networks, analytics providers, or advertising partners may collect information about your click, device, referral source, purchase activity, or interactions according to their own privacy policies. We may or may not receive a commission for products purchased through these links.

Third-Party Integrations. We may offer you the option to register for, access, or log in to the Services using third-party authentication or single sign-on (“SSO”) providers, such as Google, Meta, Facebook, Instagram, Apple, or other supported identity providers. If you choose to authenticate through a third-party provider, we may receive certain information associated with your account, subject to your privacy settings and permissions with that provider.

A. Definition and Categories. Sensitive Data includes the categories set forth in the Definitions above. We recognize that Sensitive Data requires heightened protections due to the increased risk of harm to consumers if such data is compromised or misused.

B. Consent. We will not collect or process Sensitive Personal Data unless the processing is reasonably necessary and proportionate to provide or maintain a specific product or service requested by the consumer, or otherwise permitted by applicable law. Where required, we obtain the consumer's affirmative, freely given, specific, informed, and unambiguous opt-in consent before processing Sensitive Personal Data.

C. No Sale or Sharing Without Consent. We do not sell or share Sensitive Data without obtaining your affirmative opt-in Consent. We do not use Sensitive Personal Information for targeted advertising except where expressly permitted by law or with any required consent.

D. Sensitive Data Security. We implement reasonable administrative, technical, and organizational safeguards appropriate to the sensitivity of the information.

E. Retention and Deletion. We retain Sensitive Data only for as long as necessary to fulfill the purposes for which it was collected or as required by law. Upon expiration of the retention period or upon your verified request for deletion, we securely delete or deidentify Sensitive Data.

Veyah Studio may use artificial intelligence tools, machine-learning systems, automated features, generative AI, foundation models, and third-party AI providers to process User Submissions, uploaded images, prompts, quiz responses, room details, style preferences, and related information in order to provide the Services.

We may use AI and similar technologies to assist in operating our Services, including generating design recommendations, organizing information, customer support, fraud prevention, security, personalization, data analytics, document processing, content moderation, and product improvement.

AI Model Training. Personal information does not train our AI models. Veyah Studio does not use your personal information, uploaded room photos, private project details, prompts, or User Submissions to train our proprietary generative AI models. We do not sell your uploaded room photos, private project information, or personal data to third parties for AI training. We may use de-identified or aggregated data to understand usage patterns, improve platform performance, troubleshoot issues, improve user experience, evaluate feature quality, and support product development.

Third-Party AI. Some Services may rely on third-party AI providers to process information and generate outputs. Where we use third-party AI providers, we configure those services, where available, to limit or prohibit the use of submitted information for model training. Third-party providers may process data according to their own terms, data processing agreements, privacy policies, and security practices.

Human Review. AI-generated content is intended to assist you and should not be considered professional architectural, engineering, construction, legal, or safety advice. Users remain responsible for independently evaluating recommendations before making purchasing, remodeling, or construction decisions.

Profiling. AI may be used for recommendations and personalization of Services. We do not use automated decision-making for legal decisions, credit decisions, employment decisions, or housing decisions.

Opt Out. You may choose not to upload photos, floor plans, write or answer AI prompts, or complete preferences and quiz answers.

Cookies are small text files placed on your device that help websites work properly, remember preferences, analyze traffic, support payments, protect against fraud, and improve user experience. We and our service providers use cookies, pixels, web beacons, tags, software development kits (SDKs), local storage objects, session replay technologies (where used), APIs, and similar technologies (collectively, “Cookies and Similar Technologies”) to operate, secure, improve, personalize, analyze, and support the Services.

Types of Cookies We May Use

Strictly Necessary Cookies. These cookies are required for the Services to function. They support core features such as security, account login, page navigation, checkout, and form submissions.

Analytics Cookies. We may use analytics tools, such as Google Analytics or similar providers, to understand how visitors use the Website and Services. This may include pages visited, time spent, traffic sources, device information, and performance data.

Payment and Fraud Prevention Cookies. If you make a purchase or payment, payment processors such as Stripe may use cookies or similar technologies to process transactions, prevent fraud, and secure checkout.

Social Media and Embedded Content Cookies. If the Services include embedded social content, such as Instagram or Meta content, those third parties may use cookies or similar technologies to display content, measure interactions, or collect information if you are logged into their platforms.

Preference Cookies. These cookies may help remember account settings, design preferences, saved choices, or other user preferences.

Advertising Cookies. These cookies may be used to deliver advertisements that are more relevant to your interests, measure advertising effectiveness, prevent repetitive advertisements, and support our marketing activities where permitted by applicable law.

Your Cookie Choices

Where required by applicable law, we recognize browser-based universal opt-out preference signals, such as Global Privacy Control (GPC), with respect to applicable processing activities.

You can control cookies through your browser settings, including deleting cookies or blocking certain types of cookies. If we use a cookie consent banner, you may also manage preferences through the available cookie settings.

Blocking certain cookies may affect how the Services function, and blocking payment, security, or account-related cookies may prevent checkout or account features from working properly.

We are committed to protecting the privacy of children.

A. Children Under the Age of 13. The Services are not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13 without verifiable parental consent. If we learn that we have collected personal information from a child under 13 without appropriate consent, we will take reasonable steps to delete that information.

Parents have the right to review the personal information collected from their child, request deletion of their child's personal information, and refuse to permit further collection or use of their child's personal information. We do not condition a child's participation in activities on the child disclosing more personal information than is reasonably necessary for participation.

If you believe a child under the age of 13 has without verifiable parental consent provided us with personal information, please contact us at support@veyah.studio.

B. Known Minors Under 16. We do not sell or share the personal information of consumers we have actual knowledge are between 13 and 15 years of age unless we obtain affirmative opt-in consent from the teen. Teens may withdraw consent at any time.

C. General Protections for Minors Under 16. For all consumers we have actual knowledge are under 16 years of age: we treat personal information of minors under 16 as sensitive personal information requiring opt-in consent; we do not engage in profiling or automated decision-making with legal or similarly significant effects concerning minors under 16 without appropriate parental or teen consent; we do not knowingly use Personal Information collected from children to develop, improve, fine-tune, or evaluate generative artificial intelligence systems unless expressly permitted by applicable law; and we do not engage in targeted advertising directed to minors under 16 without opt-in consent.

You may receive communications from Veyah Studio when you create an account, make a purchase, subscribe to a service, sign up for a waitlist, request a free trial, enter your email address, opt into a promotion, or otherwise interact with us.

We may send:

• Transactional emails
• Account notices
• Billing and subscription notices
• Security alerts
• Customer support messages
• Product updates
• Marketing emails, where permitted by law
• SMS messages, where permitted by law and with consent where required

Marketing emails will include an unsubscribe option. You may opt out of marketing communications at any time by using the unsubscribe link or contacting support@veyah.studio.

Opting out of marketing communications does not prevent us from sending transactional, legal, billing, security, account, or service-related communications.

We do not intend to send marketing SMS messages unless permitted by law and, where required, with your consent. Message and data rates may apply if SMS is used.

A. Retention Principles. We retain personal information for as long as reasonably necessary to fulfill the purposes for which it was collected, including to provide the Services, maintain your account, complete transactions, comply with legal obligations, resolve disputes, enforce agreements, prevent fraud, maintain security, support business operations, and improve the Services.

We determine retention periods based on: the length of our ongoing relationship with you; the nature of the Personal Data and sensitivity level; applicable legal, regulatory, tax, accounting, or reporting requirements; applicable statutes of limitations for legal claims; the purposes for which the Personal Data was collected; and whether you have requested deletion (subject to applicable exceptions).

B. Deletion and Deidentification. Upon expiration of the applicable retention period, or upon receipt of a verified deletion request (subject to applicable exceptions), we securely delete Personal Data using industry-standard data destruction methods, or deidentify Personal Data so that it can no longer reasonably be used to identify you. We direct our Service Providers and Processors to delete or deidentify Personal Data in accordance with the same standards.

C. Legal Holds and Exceptions. We may retain Personal Data for longer periods where required by law, regulation, or legal process; necessary to comply with a legal hold, litigation, investigation, audit, or governmental request; necessary to establish, exercise, or defend legal claims; you have provided Consent to longer retention; or retention is necessary to protect the vital interests of you or another person.

We may retain aggregated or de-identified information for analytics, reporting, product improvement, and business purposes.

We use reasonable technical, administrative, and organizational measures designed to protect personal information from unauthorized access, loss, misuse, alteration, disclosure, or destruction.

These measures may include secure servers, access controls, encryption where appropriate, third-party security practices, password protection, and other safeguards appropriate to the sensitivity of the information and the nature of our business.

However, no method of transmission over the Internet or method of electronic storage is completely secure. We cannot guarantee absolute security of information transmitted to or stored through the Services. You are responsible for keeping your account credentials confidential and for using secure devices, networks, and passwords.

Incident Response. We maintain procedures designed to identify, investigate, respond to, and mitigate suspected security incidents and will provide notifications where required by applicable law.

Depending on where you live and applicable law, you may have certain rights regarding your personal information.

Right to Know and Access. You have the right to request that we disclose to you: the categories of Personal Data we have collected about you; the categories of sources from which the Personal Data was collected; the business or commercial purpose for collecting, selling, or sharing Personal Data; the categories of third parties to whom we disclose Personal Data; the specific pieces of Personal Data we have collected about you; and any meaningful information regarding our use of Automated Decision-Making Technology. You may make up to two (2) verifiable requests for access in a twelve (12)-month period. We will respond to your request within forty-five (45) days of receipt, with one additional forty-five (45)-day extension if reasonably necessary.

Right to Correct. You may request correction of inaccurate personal information that we maintain about you.

Right to Delete. You have the right to request that we delete Personal Data that we have collected from you, subject to certain exceptions. We may deny your deletion request if retaining the Personal Data is reasonably necessary to complete a transaction, detect security incidents, debug the Services, comply with a legal obligation, or otherwise as permitted by applicable law.

Right to Data Portability. You have the right to request that we provide your Personal Data to you in a portable, structured, commonly used, and machine-readable format that allows you to transmit the data to another entity without hindrance.

Right to Opt Out. You have the right to opt out of the sale of your Personal Data and the sharing of your Personal Data for cross-context behavioral advertising purposes. You may exercise this right by:

• Clicking the “Privacy Choices” link on our Website;
• Enabling a universal opt-out preference signal recognized by our systems (e.g., Global Privacy Control); or
• Contacting us at privacy@veyah.studio

Right to Limit Sensitive Data. You have the right to limit our use and disclosure of your Sensitive Personal Information to uses necessary to provide the goods or services you requested and certain business purposes permitted under applicable law. You may exercise this right by clicking the “Privacy Choices” link on our Website or contacting us at privacy@veyah.studio.

Right to Withdraw Consent. Where processing is based on consent, you may withdraw consent at any time.

Right to Appeal. If we deny your privacy rights request, in whole or in part, we will notify you of the reason for our decision and, where required by applicable law, inform you of your right to appeal. To submit an appeal, please contact us at privacy@veyah.studio within the time period permitted by applicable law after receiving notice of our decision.

Right Against Discrimination. We will not discriminate against you for exercising any of your privacy rights under this Policy or applicable law. We will not deny you goods or services, charge you different prices, or provide you a different level or quality of goods or services as a result of exercising your privacy rights.

A. Submitting Requests. You may exercise your rights by contacting us at:

Email: privacy@veyah.studio
Postal Mail:
Veyah Studio
Attn: Privacy Officer
3835 N Ashland Ave, Apt 4N
Chicago, IL 60613
Online Request Form: https://veyah.studio/privacy-request

B. Verification of Identity. To protect your privacy and security, we verify your identity before processing your request using a risk-based approach. For requests for categories of Personal Data, we verify your identity to a reasonable degree of certainty by matching at least two data points. For requests for specific pieces of Personal Data or deletion, we verify your identity to a reasonably high degree of certainty by matching at least three data points or by requiring a signed declaration under penalty of perjury. For account holders, we verify your identity through your existing account credentials.

C. Authorized Agent Requests. You may designate an authorized agent to submit requests on your behalf. We require the authorized agent to provide proof of written authorization signed by you, or a valid power of attorney under applicable state law.

D. Response Timing. We will respond within the timeframes required by applicable law. If we require additional time (up to an additional forty-five (45) days), we will notify you of the extension and the reason for it.

E. Exceptions. We may deny or limit requests where permitted by law, including where retention is required for legal, billing, security, fraud prevention, dispute resolution, tax, accounting, backup, or operational purposes.

We recognize and honor user-enabled global privacy controls and universal opt-out preference signals as valid consumer requests to opt out of: the sale of Personal Data; the sharing of Personal Data for cross-context behavioral advertising; processing of Personal Data for targeted advertising purposes; and processing of Personal Data for profiling in furtherance of decisions that produce legal or similarly significant effects.

We recognize the following opt-out preference signals:

• Global Privacy Control (GPC) signals transmitted by browsers, browser extensions, or privacy-focused applications;
• Browser-based “Do Not Track” signals where recognized under applicable state law;
• Operating system-level privacy settings that express opt-out preferences; and
• Other industry-standard opt-out signals that achieve technical interoperability and consumer adoption.

Do Not Track. Because there is not currently an industry-wide consensus regarding “Do Not Track” browser signals, our Services do not respond to such signals except to the extent required by applicable law. Where required, we recognize browser-based universal opt-out preference signals, such as Global Privacy Control.

Veyah Studio's site and Services are operated from the United States. If you are located outside the United States or access our Services from outside the United States, please be aware that your Personal Information may be transferred to, stored, and processed in the United States or other jurisdictions where our service providers operate. By using the Services, you acknowledge that your Personal Information may be transferred to countries that may have different data protection laws than your country of residence.

Where required by applicable law, we implement appropriate safeguards for international transfers.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by updating the “Last Updated” date at the top of this Privacy Policy. We may also provide notice by posting a conspicuous notice on our Website homepage, sending an email to the email address associated with your account, or providing in-app notifications.

For questions, privacy requests, complaints, or concerns about this Privacy Policy or how we handle personal information, contact our Privacy Office at:

Email: privacy@veyah.studio
Mailing Address:
Veyah Studio
Attn: Privacy Officer
3835 N Ashland Ave, Apt 4N
Chicago, IL 60613

You have the right to lodge a complaint with the relevant data protection or privacy regulatory authority if you believe we have violated your privacy rights or applicable law. Regulatory authorities include: California Privacy Protection Agency; Colorado Attorney General's Office; Maryland Attorney General's Office; Texas Attorney General's Office; Oregon Department of Justice; and other applicable authorities.

Residents of certain states may have additional privacy rights or disclosures under applicable state privacy laws. This section supplements the remainder of this Privacy Policy and applies only where the identified state law applies to our processing activities and to you.

California

If you are a California resident, you may have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CPRA”), including:

• The right to know the categories and specific pieces of Personal Information we collect, use, disclose, sell, or share.
• The right to request correction of inaccurate Personal Information.
• The right to request deletion of Personal Information, subject to applicable exceptions.
• The right to opt out of the sale or sharing of Personal Information.
• The right to limit the use and disclosure of Sensitive Personal Information, where applicable.
• The right not to receive discriminatory treatment for exercising your privacy rights.

California's “Shine the Light” law (California Civil Code § 1798.83) permits California residents to request certain information regarding our disclosure of Personal Information to third parties for their direct marketing purposes. To submit such a request, please contact us using the information provided in the Contact Us section.

Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Vermont, and Virginia

Residents of these states may have rights under applicable state privacy laws, including the rights described in the “Your Privacy Choices and Rights” section of this Privacy Policy. Where applicable, you may also have the right to appeal our decision if we deny your privacy rights request, opt out of targeted advertising, opt out of certain profiling in furtherance of decisions that produce legal or similarly significant effects, opt out of the sale of Personal Information where applicable, and withdraw consent for processing Sensitive Personal Information where processing is based on consent.

If we deny your appeal, we will provide information regarding any additional complaint mechanism or regulatory authority available under applicable law. Certain states provide additional protections regarding sensitive data, profiling, children's data, biometric information, or universal opt-out mechanisms. Where applicable, Veyah Studio honors those rights in accordance with applicable law.

Nevada

Nevada law permits certain Nevada residents to opt out of the future sale of certain covered information. Although we do not currently sell Personal Information for monetary consideration as defined under Nevada law, Nevada residents may submit an opt-out request by contacting us at support@veyah.studio.