GDPR & Your Data Rights

Effective date: July 14, 2026

The General Data Protection Regulation (GDPR) is a European Union law that came into force in May 2018 and governs how personal data is collected, processed, and stored for individuals located in the European Economic Area (EEA). The UK Data Protection Act 2018 and the UK GDPR provide equivalent protections for individuals located in the United Kingdom.

This page explains how VEYL complies with those regulations and how you can exercise your rights. It complements our Privacy Policy, which describes in detail what data we collect and how we use it.

1. Data Controller

The data controller for VEYL is Two Hungry Bowlers Publishers LLC, registered in the State of Wyoming, United States. All data-rights requests and questions about our processing of your personal data can be sent to support@veylapp.com.

VEYL does not have a designated Data Protection Officer at this time, as we do not meet the size or processing-activity thresholds that require one under Article 37 of the GDPR. Our support address serves as the single point of contact for all data-protection matters.

2. Your Rights Under GDPR

2.1 The Right to Access

You have the right to request a copy of the personal data we hold about you and to be told how it is being used. The data we hold typically includes your account information (name, email, authentication details), consent records, scan-usage counters, and scan-result metadata. We will provide this information in electronic format, free of charge, within 30 days of receiving a verified request.

To request a copy of your data, email support@veylapp.com from the email address associated with your VEYL account.

2.2 The Right to Rectification (Correction)

If any of the personal data we hold about you is inaccurate or incomplete, you have the right to have it corrected. You can update your name and email address directly from your account settings when signed in to VEYL. For any other correction, contact support@veylapp.com and describe what needs to be changed.

2.3 The Right to Erasure ("The Right to Be Forgotten")

You have the right to have your personal data deleted when it is no longer needed for the purpose for which it was collected, when you withdraw consent, or when you object to processing. If you cancel your VEYL subscription or close your account, we will remove your personal information within 30 days, except where retention is required by law (for example, tax and accounting records related to past payments).

If you receive any promotional email from VEYL, you may unsubscribe at any time using the link in the email itself; unsubscription is effective immediately. To request full account deletion, email support@veylapp.com.

Note that VEYL does not permanently store the text of manuscripts or other documents you submit for scanning — document text is discarded once analysis is complete. Only scan-result metadata (scores, module outputs, timestamps) is retained, and that metadata is also deleted when your account is deleted.

2.4 The Right to Restrict Processing

You have the right to request that we stop processing your personal data while a query about its accuracy or use is being resolved. Restricted data remains in our systems but is not actively used. To request a restriction, email support@veylapp.com.

2.5 The Right to Data Portability

You have the right to receive the personal data we hold about you in a structured, commonly used, machine-readable format (such as JSON or CSV) and to transfer it to another service provider. To request a portable export of your data, email support@veylapp.com.

2.6 The Right to Object

You have the right to object to the processing of your personal data for direct marketing purposes. VEYL's default communications are transactional — account confirmations, password resets, scan completion notices, plan and usage notifications — and are necessary for operating your account. Any non-transactional promotional email will always include an unsubscribe link, and you may object at any time by using that link or by emailing support@veylapp.com.

You can cancel a paid VEYL subscription at any time from your account billing page, or by emailing support.

2.7 The Right to Be Informed

You have the right to know what personal data we collect and how it is used. In summary:

Account data — When you register, we collect your name, email address, and either a password or a third-party OAuth token (if you sign in with Google). This is required to operate your account.
Consent records — When you accept our Terms of Service and scan disclaimer, we record the timestamp, your IP address, browser user-agent, and the version of the terms accepted. This is retained as proof of your consent.
Scan usage — We record word counts, timestamps, and scan-result metadata (scores, flagged sections, module outputs) so you can access your scan history and so we can enforce plan limits.
Document text — Documents you submit for scanning are processed in memory and are not permanently stored. Document text is not used for model training and is not shared with any third party outside the specific analysis flow you initiated.
Basic usage analytics — We collect aggregated information about which pages are visited and which features are used, along with browser and general location (country/region) derived from your IP address. This helps us improve the Service and does not personally identify you in isolation.
Payment data — Handled directly by our payment processor (Stripe). We do not store your full credit-card number.

Full details are in our Privacy Policy.

2.8 The Right to Be Notified of a Data Breach

If there is a personal-data breach that is likely to result in a risk to your rights and freedoms, you have the right to be notified without undue delay, and in any event within 72 hours of our becoming aware of the breach, as required by Article 34 of the GDPR. We monitor our infrastructure for security incidents and maintain incident-response procedures with our hosting provider.

2.9 The Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority in your country if you believe we have not handled your personal data lawfully. For EU residents, the relevant authority is the data-protection regulator in your member state (see the European Data Protection Board at edpb.europa.eu for the list). For UK residents, the relevant authority is the Information Commissioner's Office (ico.org.uk).

3. Lawful Basis for Processing

Under the GDPR, we process your personal data on the following lawful bases:

Contract — Processing necessary to provide the VEYL service to you, including scan execution, account management, and subscription billing.
Legitimate interests — Processing necessary for security monitoring, abuse prevention, aggregated usage analytics, and improving the Service. We balance our interests against your rights and freedoms before relying on this basis.
Consent — Any non-transactional promotional email is sent only on the basis of your explicit consent, which you can withdraw at any time.
Legal obligation — Retention of billing and tax records as required by applicable law.

4. International Data Transfers

VEYL is operated from the United States. When you use the Service from within the EEA or the UK, your personal data is transferred to and processed in the United States by our hosting and infrastructure providers. We rely on appropriate safeguards under the GDPR (including Standard Contractual Clauses where relevant) with our sub-processors. By using the Service, you consent to this transfer.

5. Sub-processors

VEYL uses a small number of trusted sub-processors to deliver the Service. These include Stripe (payment processing), Anthropic (Deep Scan semantic analysis, when you invoke it), Resend (transactional email), and Railway (hosting). Each of these providers has its own data-protection commitments and is bound by contract to process your data only for the purposes we specify.

6. How to Exercise Your Rights

To exercise any of the rights described above, email support@veylapp.com from the email address associated with your VEYL account, and describe your request. We may need to verify your identity before acting on requests that involve the release, correction, or deletion of personal data. We will respond within 30 days, or explain the reason for any delay.

There is no charge for a data-subject request in the ordinary course. Where a request is manifestly unfounded or excessive (in particular, if it is repetitive), we may either charge a reasonable fee or refuse to act on the request, as permitted by Article 12 of the GDPR.

Two Hungry Bowlers Publishers LLC, registered in the State of Wyoming. This page is informational and does not constitute legal advice; where you have specific concerns about your rights, you may wish to consult your own legal counsel or contact your local data-protection authority.