VeyraOps LLC runs Cadenspot. We do not sell personal information, we do not share it for targeted advertising, and our pages carry no third-party trackers. Effective date: [EFFECTIVE DATE]. Version: privacy-2026-10.
1. Who we are and what this covers
This Privacy Policy explains how VeyraOps LLC ("VeyraOps", "we", "us"), an Illinois company, handles personal information when you use Cadenspot: our websites, Business pages, booking and management pages, emails, reminders and dashboards (the "Service"). Cadenspot is a VeyraOps product, and VeyraOps answers for it.
We have two roles:
| Who you are | Our role | Who decides how your information is used |
|---|---|---|
| A Business that has a Cadenspot account, and its staff | We are responsible for your account information | VeyraOps, as this policy describes |
| A Client who books or manages an appointment with a Business | We are the Business's service provider (processor) for your booking information | The Business. Its own privacy notice also applies |
| A visitor to our own websites or a Business page | We are responsible for the measurement of our pages (section 4) | VeyraOps |
This policy does not cover the Business's own practices, its website, or third-party services you reach through links on a Business page, such as Instagram or WhatsApp.
2. Information we collect
| Category | Examples | Source |
|---|---|---|
| Account information | Name, business name, email, phone, language, time zone. We do not use passwords: you sign in with Google, Microsoft or a link sent to your email | The Business |
| Business page content | Logo, banner photo, bio, service area, links, services, prices, offers, policies | The Business, or its website when it asks us to read it |
| Booking information | Client name, email, phone, appointment, service, answers to booking questions, notes, booking history | The Client or the Business |
| Payment information | Plan, billing history and payment status. Card details go directly to our payment provider (Stripe) and never reach us | The Business or Client, via the payment provider |
| Messages | Emails, SMS or WhatsApp reminders we send, delivery status, STOP replies | The Service |
| Page measurement | Page views, traffic source (such as a UTM tag or referring site), clicks on links and on the VeyraOps Notice, booking steps, device type (phone, tablet, desktop), language, approximate country or region | Your browser, through our own first-party code (section 4) |
| Technical and security data | IP address (used briefly for security and rate limits, not stored with page measurement), browser type, error logs, sign-in times | Your device |
| Integrations | Calendar busy times, events and identifiers from services a Business connects, such as Google Calendar or Microsoft Outlook | The connected service, with the Business's permission |
| Support | What you tell our support team | You |
We do not ask for government ID numbers, and Businesses may not use booking questions to collect them, full card numbers, passwords or health records. We do not collect biometric information, and we do not use device fingerprinting.
3. How we use information
| Purpose | Information used |
|---|---|
| Run the Service: show Business pages, take and manage bookings, send confirmations and reminders, process payments | Account, page content, booking, payment, messages |
| Show each Business statistics about its own page and clients | Page measurement, booking |
| Suggest improvements and offers to a Business (recommendations) | That Business's own statistics and bookings |
| Improve the Service and decide on features, plans and pricing | Aggregated and de-identified data across Businesses |
| Measure the VeyraOps Notice shown on Business pages | Views, clicks and closes of the notice (section 4) |
| Communicate with Businesses about their account, changes, and VeyraOps products. You can unsubscribe from marketing emails at any time | Account |
| Keep the Service secure, prevent fraud and abuse, fix errors | Technical and security data |
| Meet legal obligations and enforce our Terms | As needed |
We use a Client's booking information only to provide the Service to the Business they booked with, under its instructions, plus security and legal compliance. We do not use it to market VeyraOps to the Client, and we do not combine it across Businesses to build profiles.
AI features. Some features use AI providers to suggest text, offers, colors and recommendations, or to read a website a Business asks us to read. We send them only what the feature needs. Our agreements with them prohibit using that data to train their models. A Business reviews AI suggestions before anything is published. We do not make decisions with legal or similarly significant effects about people based solely on automated processing.
4. How we measure our pages
We measure how Business pages and our own websites are used, with our own tools and nothing else.
- No third-party trackers. No advertising pixels, no social media trackers, no third-party analytics, and no tracking cookies.
- What we record. Page views, where the visit came from, clicks on each link (such as WhatsApp, call, website or directions), each step of booking and where people stop, offer views and clicks, and views, clicks and closes of the VeyraOps Notice.
- Anonymous by design. A visitor is counted with a random identifier that changes every day and is specific to the Business page visited. We do not follow visitors from one Business to another, or across days. We derive an approximate country or region from the IP address and then discard the address.
- When it links to a person. Only when a visitor books: the booking steps are then linked to that booking so the Business can see which source led to it.
- Emails. Links in booking emails go directly to the right page. We do not use hidden tracking pixels to detect email opens, and we do not count clicks in emails. If we start counting clicks, we will update this policy first.
- Your browser's privacy signals. If your browser sends Global Privacy Control or Do Not Track, we keep only aggregate counts for your visit, with no identifier.
- Closing the VeyraOps Notice. If you close it, your browser remembers that choice locally. It is not a tracking cookie and is not sent to us except as a count of closes.
The VeyraOps Notice promotes VeyraOps services. It is contextual: it is the same for every visitor and is not based on your activity or profile.
5. How we share information
We do not sell personal information, and we do not share it for cross-context behavioral (targeted) advertising. We have not done so in the past 12 months.
We share information only:
- With the Business you book with. Your booking details, and the statistics described in section 4, go to that Business.
- With service providers who help us run the Service, under contracts that limit their use to our instructions: hosting (Contabo, with servers in the European Union and, as we move them, the United States), network delivery and security (Cloudflare), database hosting (our own PostgreSQL server, on the same Contabo servers), email delivery (Resend), payments (Stripe), AI features (OpenAI), and sign-in and calendar connections (Google and Microsoft). If we add a provider, such as for text messages, we will update this list.
- With services a Business connects, such as Google Calendar or Microsoft Outlook, when that Business turns on the connection.
- For legal reasons: to comply with law, a subpoena or court order, to protect rights, safety and property, or to investigate fraud or abuse.
- In a business transfer, such as a merger, acquisition or sale of assets, with this policy continuing to apply to the information transferred.
- With your consent or at your direction.
De-identified and aggregated data. We may use and share information that no longer identifies a person or a Business, such as "booking pages with a WhatsApp link get more bookings". We keep it de-identified, we commit publicly not to re-identify it, and we require anyone who receives it to do the same.
Google data. Information from Google APIs is used and transferred in line with the Google API Services User Data Policy, including its Limited Use requirements.
6. How long we keep information
| Information | How long |
|---|---|
| Business account and page content | While the account is open, then 30 days for export, then deleted or de-identified |
| Booking information | While the Business's account is open, unless the Business deletes it sooner. Then as above |
| Raw page measurement events | 13 months, then kept only as aggregate counts |
| Security logs | Up to 90 days |
| Billing and tax records | As long as tax and accounting law requires, generally 7 years |
| Records of your acceptance of our Terms and this policy | While the account is open and for 7 years after, to prove the agreement |
| Backups | Deleted data leaves our backups within 35 days |
| SMS opt-outs | As long as needed to honor them |
7. Your rights and choices
Businesses can see and correct most account information in their settings. To export your data or close your account, write to [SUPPORT EMAIL] and we will do it promptly.
Clients. Because the Business decides how your booking information is used, please send requests about it to the Business first. If you contact us, we will forward your request to the Business and help it respond. You can always opt out of SMS reminders by replying STOP, and use the unsubscribe link in emails where offered.
US state privacy rights. Depending on where you live (for example California, Colorado, Connecticut, Virginia, Texas, Oregon and other states with privacy laws), you may have the right to:
- know what personal information we hold about you and get a copy;
- correct it;
- delete it;
- opt out of sale, sharing for targeted advertising, and profiling. We do not do these, so there is nothing to opt out of, and we honor Global Privacy Control as a valid opt-out signal anyway;
- limit the use of sensitive personal information. We do not use it beyond what the law permits without a request;
- appeal our decision on your request, and complain to your state attorney general if your appeal is denied.
We will not discriminate against you for using these rights.
How to make a request. Email [PRIVACY EMAIL] or use [REQUEST FORM URL]. We verify requests by confirming control of the email or phone number on file. An authorized agent may act for you with your signed permission. We answer within 45 days, and may extend once by 45 days when we tell you why.
California notice at collection. The categories of personal information we collect, their sources, purposes and retention are in sections 2, 3 and 6. Under the California Consumer Privacy Act, these include identifiers, commercial information, internet activity, approximate geolocation, and professional information about Businesses. We do not sell or share them.
Visitors from outside the US. If European, UK or similar data protection laws apply to you, you also have rights of access, correction, deletion, restriction, portability and objection, and you may complain to your local data protection authority. Our legal bases are: performing our contract with the Business, our legitimate interests in measuring and improving the Service and promoting VeyraOps (balanced by the privacy design in section 4), legal obligations, and consent where we ask for it.
8. Security, children and international visitors
Security. We protect information with encryption in transit (HTTPS), sign-in without passwords, access limited to people who need it, signed links, and rate limits. No system is perfectly secure. If a breach affects your personal information, we will notify you and the authorities as required by law, including the Illinois Personal Information Protection Act, and help affected Businesses notify their clients.
Children. The Service is not directed to children under 13, and we do not knowingly collect their personal information. A parent or guardian should book for anyone under 18. If you believe a child under 13 gave us information, contact [PRIVACY EMAIL] and we will delete it.
International visitors. We are based in the United States. Our servers are in the European Union (France), and we are moving them to the United States. Some service providers process information in the United States. Your information may therefore be stored and processed outside your state or country. Where the law requires, we use appropriate safeguards, such as standard contractual clauses.
9. Changes and contact
We date and number each version of this policy. For material changes, such as a new purpose or a new kind of sharing, we notify Businesses by email and in the Service at least 30 days before they take effect, and ask them to accept the new version. We never apply a material change to information collected before it without the consent the law requires.
Contact: VeyraOps LLC, [MAILING ADDRESS] · Privacy requests: [PRIVACY EMAIL] · Support: [SUPPORT EMAIL]