Last updated: October 15, 2026
veledah is run by Veledah, Inc., a Delaware corporation, c/o Northwest Registered Agent, Inc., 2108 N St Ste N, Sacramento, CA 95816 ("we," "us"). This policy covers the veledah website (the "Service"). Questions and requests go to legal@veledah.com.
Your email, @handle, display name, and password (stored only as a hash). If you sign in with Google, we get your Google account id, email, and name. If you connect another account, such as GitHub, we get that account's id and username.
If you check a phone number, Supabase keeps the number and Twilio sends the code. We keep only a keyed one-way code (HMAC) of the number, so one number can't check two accounts. The code can't be turned back into the number.
Stripe runs the check (section 3). Our server reads your date of birth and document number from Stripe once, to work out two things: whether you are 18 or older, and a keyed one-way code (HMAC) of the document's country, type, and number. We keep those two things, the check's status, its reason code if it fails, and Stripe's reference for it. We never store or log your name, date of birth, document number, or any image.
If our team verified you before Stripe checks began, we keep the name on your ID, what you told us about how to check you, and the links you gave. We never asked for ID images that way.
Your photo, display name, ticker, bio, city, the links you add, the accounts you connect, the updates you post, and your design choices (foil, placement, focus). Your card art is made from these. Each time it changes we save a version with the photo, name, ticker, and city it used.
When you pick a city, your browser may offer your precise location to sort the list. That stays on your device: we never receive or store the coordinates.
The Solana wallets you prove are yours, and the signed message that proved each one. Your coin and USDC balances, deposits, withdrawals, drop bids, orders, trades, fees, and, if you are a Listed Person, what you earned from fees. We may ask for tax information, such as your legal name, address, and tax id, before paying you or where the law requires it.
The name, shipping address, and phone number you give for the order, the card art version, the quantity, the price, the order's status, and its tracking. Stripe takes your payment: we get its status and Stripe's reference for it, never your card number.
Reports you file, and emails you send us, with what they contain.
Our host logs IP addresses and requests. We set a first-party cookie (hx_dev) with a random id, and record which accounts use which browser, with a one-way code of the browser's user agent. We record security events, such as refused sign-ups, rate limits hit, and identity-check results. These help a person on our team spot duplicate accounts and abuse; they never block anyone on their own.
The retired play-money game's ledger: every CR trade, balance, and fee, kept as a permanent record.
Our servers record which pages and features are used, under an internal account id, never your email or handle, and send them to PostHog. No analytics script runs in your browser.
Stripe Identity runs our identity checks on Stripe's own page. Before the check starts, we show you this:
Stripe runs the check on its own page. It asks for your consent before it uses your face data, and keeps that data under its own privacy policy. We get the result, never your images or face data.
To run the Service: your account, your Card, sign-in, and the emails it needs.
To run coins: drops, orders, trades, fees, payouts to Listed Persons, deposits, and withdrawals.
To make, ship, and support the printed cards you order.
To keep it one person, one account, and to find and stop fraud and abuse.
To meet our legal duties, such as tax reporting, sanctions screening, and keeping financial records, and to defend legal claims.
To fix problems and improve the Service.
We don't sell personal information, share it for cross-context behavioral advertising, or show ads.
Your Card is public: photo, display name, ticker, bio, city, links, connected accounts, updates, and card art, wherever Cards appear on the Service and in link previews. Your @handle and display name are public when you act on the Service. The name on your ID, your email, your phone number, and your shipping address are never public.
A Card's trades show price, number of coins, and time, never who traded. The one exception: a Listed Person's sales of their own coins are labelled "Creator sale." We don't show what any collector holds.
The Solana blockchain is public. Anyone can see transfers between your proved wallet and the addresses we use, and the coins burned for a printed card. We can't hide or delete what is on the blockchain.
Vendors who run the Service for us, only for that purpose:
We also disclose information to tax authorities and others when the law requires it, to protect someone's safety, or to a buyer if the company is sold or merged. This policy keeps applying to it.
Anyone can ask us to see, correct, delete, or get a copy of their personal information, and to stop a use they object to. We give these rights to everyone, whether or not a law requires it, except where the law requires us to keep the record (section 7). Email legal@veledah.com. We confirm it is you before acting, and answer within 45 days. We never treat you differently for asking.
California residents have the rights to know, delete, and correct, to opt out of sale or sharing, to limit use of sensitive information, and to equal treatment. We don't sell or share personal information, and we use sensitive information (ID checks, phone, tax information, and the face data in section 3) only for the purposes in this policy. We honor Global Privacy Control signals.
Where the GDPR or UK GDPR applies, we rely on: contract (running your account, Card, coins, and orders); legitimate interests (preventing fraud and duplicate accounts, security, and improving the Service); legal obligation (tax and financial records); and consent (publishing your Card, and the face check, which Stripe asks for). You can also complain to your data protection authority. We have not appointed a representative in the EU or UK.
We use only the cookies the Service needs: sign-in session cookies, the hx_dev browser id (section 2.8), and your theme choice. Cloudflare's bot check and Stripe's pages set their own when they run. No advertising or tracking cookies.
Stripe's check is automated. If it flags something, such as an ID already used by another account, a person on our team reviews it before anything final happens. Automated checks also flag possible duplicate accounts and abuse for a person on our team to review. Orders match, and the 10% limit applies, by fixed rules that treat everyone the same.
We don't use your information or content to train AI models. We use AI tools to write the Service's code; they never receive your personal information.
We encrypt data in transit, hash passwords, keep keyed codes instead of ID and phone numbers, and limit who can reach the data. No system is perfectly secure. Keep your password and your wallet keys safe; we never ask for a wallet's secret key.
The Service is for people 18 and older. We don't knowingly collect information from anyone under 18. If we learn we have, we delete it, except records the law requires us to keep, and close the account.
We are in the United States and process data here. Our vendors may process it in other countries under their own safeguards. Our printer may be outside the United States; it receives only what an order needs.
For a material change we tell you by email or on the Service before it takes effect. The date at the top shows the current version.
Veledah, Inc., c/o Northwest Registered Agent, Inc., 2108 N St Ste N, Sacramento, CA 95816. legal@veledah.com. Terms of Service: veledah.com/terms.