1. Introduction
Welcome to Veyro.
Veyro (“Veyro”, “we”, “our”, or “us”) is a developer-first payment orchestration and payment operations platform designed to help businesses integrate, manage, route, and monitor payment operations through a unified API and infrastructure.
Our platform enables businesses to connect their own payment service provider accounts, manage payment integrations, coordinate transaction workflows, and access payment-related operational information through a unified environment.
We recognize that privacy, data protection, and information security are essential to the businesses and individuals who interact with our platform.
This Privacy Policy explains how we collect, receive, use, store, disclose, transfer, and protect personal data when you:
- Visit our website.
- Create or manage a Veyro account.
- Use our dashboard, APIs, SDKs, or other platform services.
- Connect third-party payment service providers.
- Communicate with our support or business teams.
- Subscribe to our products, services, or updates.
- Participate in our developer community or developer projects.
This Privacy Policy is intended to provide information relevant to individuals and businesses across the jurisdictions in which Veyro operates or makes its services available.
Our processing of personal data is governed by applicable data protection and privacy laws, including, where applicable, the General Data Protection Regulation (GDPR), UK GDPR, Digital Personal Data Protection Act, 2023 (India), applicable United States state privacy laws, Canada's applicable privacy legislation, Singapore's Personal Data Protection Act, Australia's Privacy Act, Brazil's General Data Protection Law, and other relevant regional legislation.
By accessing or using Veyro, you acknowledge that you have had the opportunity to review this Privacy Policy. Where consent is legally required, we will request it separately and will not treat mere use of the platform as consent.
2. About Veyro
Veyro operates as a payment orchestration and payment operations software provider.
Our platform is designed to provide a unified technology layer through which businesses can connect their independently maintained payment service provider accounts. Veyro's intended business model is based on providing software infrastructure and does not involve independently acquiring, holding, pooling, or settling merchant funds.
- Businesses maintain their own relationships and agreements with payment service providers.
- Payment service providers remain responsible for the payment processing services they provide under their respective agreements.
- Veyro provides software infrastructure for payment routing, integration management, transaction visibility, and related operational functions.
- Payment authorisation, processing, and settlement are governed by the applicable payment provider and merchant arrangements.
Veyro does not collect or store full payment card numbers, CVV/CVC security codes, PINs, banking passwords, or other sensitive payment authentication credentials as part of its standard orchestration model. However, certain integrations may involve payment tokens, provider references, transaction identifiers, or other payment-related metadata. The actual categories of information processed depend on the integration, configuration, and services used.
3. Scope of This Privacy Policy
This Privacy Policy applies to personal data processed in connection with:
3.1 Website
Information collected when you visit our website, browse public pages, read documentation, or interact with website features.
3.2 Platform and Dashboard
Information processed when you register, authenticate, manage an organisation, configure integrations, or use Veyro's dashboard.
3.3 APIs and SDKs
Information received or generated when developers and businesses interact with Veyro APIs, SDKs, webhooks, and related technical infrastructure.
3.4 Payment Integrations
Information associated with connecting and managing third-party payment service provider accounts and processing permitted payment-related metadata.
3.5 Customer Support
Information provided when you contact our support team, submit inquiries, report issues, or request assistance.
3.6 Developer Community
Information associated with participation in public developer repositories, issue trackers, discussions, contribution processes, and technical communities.
3.7 Business Relationships
Information processed when you communicate with us as a prospective customer, existing customer, partner, vendor, or business representative.
This Privacy Policy does not automatically govern third-party websites, payment providers, or other services that operate under their own privacy policies.
4. Personal Data We Collect
We collect only the information reasonably necessary to operate, maintain, secure, and improve our services, subject to applicable law. The categories of personal data we may process include the following.
4.1 Account and Identity Information
When you register or manage an account, we may collect:
- Full name
- Business email address
- Contact number, where provided
- Username
- Account identifiers
- Organisation or company name
- Job title or professional role
- Country and region
- Account registration details
- Account preferences
4.2 Authentication and Security Information
To authenticate users and protect accounts, we may process:
- Authentication identifiers
- Password hashes (we do not store plaintext passwords)
- Authentication tokens
- Multi-factor authentication information
- Login timestamps & session information
- IP addresses & device identifiers
- Security and access logs
- Failed authentication attempts
4.3 Business and Organisation Information
For customers using Veyro's business features, we may collect:
- Registered business name & address
- Business contact details & website
- Country of incorporation
- Organisation identifiers
- Account ownership information & team details
- Billing contact information
- Information voluntarily provided during onboarding
4.4 Payment and Transaction Metadata
As a payment orchestration platform, Veyro may process limited payment-related metadata required to deliver routing services:
- Transaction identifiers & timestamps
- Payment provider identifiers & merchant account references
- Payment method type (cards, UPI, netbanking)
- Transaction amount and currency
- Transaction status & routing information
- Provider response codes & error strings
- Payment references & PSP-generated tokens
- Refund status, references & webhook events
Customers must not transmit prohibited payment credentials—such as full credit card numbers, CVVs, UPI PINs, or online banking passwords—through Veyro APIs, custom metadata fields, error payloads, or customer support channels.
4.5 API and Technical Information
When using our APIs, SDKs, or platform infrastructure, we process:
- API request metadata & endpoint info
- Request timestamps & status codes
- Request identifiers & webhook delivery records
- Integration configuration & API key IDs
- Rate-limit counters & error logs
- Performance metrics & diagnostic telemetry
4.6 Device and Usage Information
Technical diagnostic data collected automatically: IP address, browser type and version, operating system, device type, referring URL, session duration, and approximate geographic location derived from IP addresses.
4.7 Billing and Subscription Information
Billing name, billing address, business tax ID (e.g. GSTIN), subscription plan, invoice numbers, payment status, renewal dates, and invoice history.
4.8 Communications and Support Information
Email correspondence, support tickets, contact submissions, feedback, bug reports, and attached diagnostic logs shared voluntarily.
4.9 Developer Community Information
Public identifiers, issue reports, pull requests, repository feedback, and discussion records submitted in connection with Veyro developer tools.
5. How We Collect Personal Data
5.1 Directly From You
When you register for an account, complete onboarding, update your profile, connect a payment gateway, purchase a subscription, submit support inquiries, or interact with our business team.
5.2 Automatically Through Our Services
We automatically record technical, usage, security, and operational metrics when you interact with our website, merchant portal, and routing endpoints.
5.3 From Connected Payment Providers
When a merchant connects an authorized payment gateway account, Veyro receives authorized transaction references and webhook events according to the merchant's integration settings. Customers are responsible for ensuring appropriate customer notice and authorization.
5.4 From Business Partners and Other Third Parties
Where permitted by applicable law, we may verify business details through public corporate registries, fraud screening services, infrastructure vendors, and authentication partners.
6. How We Use Personal Data
We process personal data for specific, legitimate, and transparent business purposes:
Account provisioning, API request routing, dashboard access, and maintaining infrastructure availability.
Identity verification, session handling, access token rotation, and preventing credential misuse.
Processing routing instructions, verifying webhook events, monitoring provider latency, and generating transaction reporting.
Investigating failed transactions, resolving technical issues, and communicating maintenance updates.
Subscription management, invoice generation, payment processing for SaaS fees, and tax compliance.
Detecting unauthorized API spikes, identifying credential stuffing, and enforcing the Acceptable Use Policy.
Measuring gateway latency benchmarks, improving developer documentation, and optimizing router execution times.
Maintaining statutory records, responding to court orders, and meeting global tax recordkeeping duties.
Where permitted by applicable law, we may send product announcements, feature releases, and technical updates. You can opt out of promotional emails at any time using the unsubscribe link. Essential transactional communications (e.g. security notices, service disruptions, billing alerts) cannot be opted out of.
7. Legal Bases for Processing
Where required by applicable data protection law (such as the GDPR, UK GDPR, and regional privacy frameworks), we rely on one or more recognised legal bases:
- Contractual Necessity (Art. 6(1)(b) GDPR): Processing required to establish accounts, deliver routing APIs, and manage customer subscriptions.
- Consent (Art. 6(1)(a) GDPR): Relying on explicit consent for optional marketing communications and non-essential analytical cookies. Consent may be withdrawn at any time.
- Legitimate Interests (Art. 6(1)(f) GDPR): Preventing infrastructure abuse, maintaining network security, and improving platform reliability.
- Legal Obligations (Art. 6(1)(c) GDPR): Maintaining audit trails and financial records as mandated by tax, corporate, or financial regulations.
- India DPDP Act (2023): Identifying and relying on lawful grounds including verifiable consent or legitimate uses recognized under the Digital Personal Data Protection Act, 2023.
8. Our Role as Data Controller and Data Processor
Veyro acts as an independent Data Controller (or Data Fiduciary under the Indian DPDP Act) for information relating to our direct user accounts, website visitors, commercial billing records, customer support interactions, and internal security audit logs.
When business merchants use Veyro to route end-customer transaction payloads, Veyro acts as a Data Processor on behalf of the merchant. The merchant determines the purpose and lawful basis, and Veyro processes data strictly in accordance with documented merchant instructions and our Data Processing Agreement (DPA).
9. Disclosure and Sharing of Personal Data
We disclose information strictly to authorized categories of recipients as necessary to deliver the services:
- Payment Service Providers: Transmitting necessary transaction instructions to merchant-configured gateways (e.g. Stripe, Razorpay, Cashfree).
- Cloud & Hosting Infrastructure: Cloud hosting, database clusters, encrypted backups, and global content delivery networks.
- Authentication & Security Providers: Token verification, session identity providers, and multi-factor authentication services.
- Communications Services: Transactional email dispatchers and support ticket systems.
- Professional Advisers: Legal, tax, accounting, audit, and insurance counsel under strict confidentiality obligations.
- Government & Regulatory Authorities: Where legally mandated in response to valid court orders, subpoenas, or statutory obligations.
- Corporate Transactions: In connection with any merger, corporate reorganization, asset sale, or acquisition, subject to confidentiality agreements.
10. Subprocessors and Third-Party Services
Veyro engages third-party subprocessors to support cloud compute, data persistence, and monitoring operations. All subprocessors undergo rigorous security review and enter into binding Data Processing Agreements containing equivalent data protection obligations.
Review our complete list of approved subprocessors, entities, and data storage locations.
11. International Data Transfers
Veyro is established in India and operates cloud infrastructure distributed globally. As a consequence, personal data may be transferred, stored, or accessed across international borders.
Where cross-border transfers occur, Veyro implements recognized legal safeguards, including the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Agreement (IDTA), and comparable regional statutory mechanisms to ensure an adequate level of data protection.
12. Data Retention
Veyro retains personal data only for as long as strictly necessary to fulfill the business purposes outlined in this policy, unless a longer retention period is mandated by law.
13. Data Security
Protecting personal data and payment transaction integrity is our core architectural focus. We deploy multi-layered technical and organizational safeguards:
For additional technical details on our security posture, review our dedicated Security Policy.
14. Personal Data Breaches and Security Incidents
If Veyro confirms a personal data breach affecting information handled by its platform, we execute structured incident response protocols:
- Containing, isolating, and mitigating the security impact.
- Preserving forensic evidence and assessing risk to data subjects.
- Notifying affected merchant customers without undue delay (within 72 hours where applicable under GDPR/UK GDPR).
- Reporting to relevant regulatory supervisory authorities as required by governing legislation.
15. Your Privacy Rights
Subject to jurisdiction-specific conditions, exemptions, and verification requirements, you may exercise:
16. How to Exercise Your Privacy Rights
To submit a data subject privacy request, contact our Data Protection and Legal team:
Please specify your full name, registered account email, your organisation (if applicable), and the specific nature of your request. Where data relates to transactions initiated through a merchant store, please contact that merchant directly.
17. Regional Privacy Disclosures
Compliance with GDPR Articles 12-23. Inquiries and supervisory escalation rights through your local DPA.
Governed by the UK GDPR and Data Protection Act 2018 with supervisory oversight via the Information Commissioner's Office (ICO).
Honoring state privacy protections (CCPA/CPRA, VCDPA, CPA). Veyro does not sell personal information or share it for cross-context behavioral advertising.
Compliance with the Digital Personal Data Protection Act, 2023. Grievances may be escalated directly to our Grievance Officer at grievance@veyro.com.
Compliant with PIPEDA and provincial privacy standards including Quebec Law 25.
Adherence to Singapore PDPA 2012 and Australia Privacy Act 1988 (Australian Privacy Principles).
18. Cookies and Similar Technologies
We use strictly necessary cookies to maintain session states and security authentication. Optional functional or analytical cookies are governed by explicit consent preferences. For complete details, consult our Cookie Policy.
19. Third-Party Websites and Services
Our platform interfaces with third-party payment gateways, merchant storefronts, and cloud utilities. These independent services maintain separate privacy terms. Veyro is not responsible for the independent data handling practices of third-party platforms.
20. Children's Privacy
Veyro is an enterprise business-to-business platform and is not directed at children. We do not knowingly collect personal data from individuals under 18 years of age.
21. Automated Processing and Decision-Making
Veyro employs automated routing rules to balance transaction traffic across gateways and monitor latency. Veyro does not perform solely automated decision-making producing legal or similarly significant effects regarding individual cardholders. Payment authorization decisions reside exclusively with the respective banking institution and gateway provider.
22. Data Protection Responsibilities of Customers
Merchants deploying Veyro must ensure their checkout flows satisfy statutory disclosure, transparency, and consent mandates. Merchants must maintain appropriate security practices over their API keys and ensure that unauthorized sensitive payment data is never transmitted into metadata parameters.
23. Changes to This Privacy Policy
We may revise this Privacy Policy periodically to accommodate infrastructure advancements, new connector capabilities, or regulatory directives. Material updates will be highlighted via merchant dashboard alerts and updated effective dates.
24. Contact Information and Grievance Redressal
25. Governing Law and Regional Rights
This Privacy Policy is construed in alignment with mandatory data protection statutes in applicable operating territories. Broader commercial dispute resolution provisions are governed by the Veyro Terms of Service.
26. Final Statement
At Veyro, we believe that privacy and security should be fundamental parts of payment infrastructure. We are committed to handling personal data responsibly, maintaining appropriate safeguards, limiting unnecessary data collection, and improving our privacy practices as our platform and international operations evolve.