Privacy Notice

This notice explains how Velyrix, Inc. ("Velyrix", "we", "us") handles personal information of people who visit our website, register for the customer portal, and use our services. For personal information that customers put on our infrastructure, we act as a service provider under the Data Processing Addendum. This notice is written under the laws of the United States and the State of California, including the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA") and the California Online Privacy Protection Act (Cal. Bus. & Prof. Code § 22575 et seq.). Section 9 adds the information that the laws of other countries require for our Facilities and customers outside the United States.

1. What we collect

1.1Account and contact data: names, e-mail addresses, telephone numbers, job titles, company details, billing and shipping addresses, tax identifiers, account log-in credentials, and the authorised contacts and visitors you list for data center access. For individual customers this may include personal contact details and, where the law requires it for tax purposes, a government identification number.

1.2Compliance data: information that we need to screen customers, owners and end users under export-control and sanctions law, such as your declared end use, ownership information, and the results of denied-party screening.

1.3Transaction data: orders, quotations, contracts and signatures (including the date, time, IP address and browser details recorded when you sign), invoices, payments and their reference numbers. We do not store full card numbers; card and PayPal payments are handled by the payment provider.

1.4Technical data: IP addresses, log-in and security events, device and browser information, and usage and billing metrics of the services.

1.5Communications: tickets, e-mails and call records with our support and sales teams.

1.6Physical security data: identification checks, access logs and video surveillance at the facilities, including visitor identification.

2. How and why we use it

2.1To provide and bill for the services, operate the portal, and support you (to perform our contract with you).

2.2To verify identity, prevent fraud and abuse, secure our systems and facilities, and to comply with legal obligations, including export-control, sanctions, tax, accounting and law-enforcement requests (to comply with legal obligations and for our legitimate business purposes).

2.3To communicate with you about your account, orders, invoices, service changes and security. We send marketing messages only where the law allows; every marketing e-mail identifies us, includes our postal address and an unsubscribe link, and we honour opt-outs within ten (10) business days, as the CAN-SPAM Act (15 U.S.C. § 7701 et seq.) requires. Service, billing, security and legal messages are not marketing and are sent even if you opt out of marketing.

2.4To improve the services and develop new ones, using aggregated or de-identified data where we can (for our legitimate business purposes).

3. Sharing

3.1We share information with suppliers who help us run the business, for example data center and facility operators, carriers, payment providers (such as PayPal and our banks), e-mail and document-signing tools, and professional advisers, under contracts that protect the information. We share compliance information with our hardware suppliers, licensors and authorities when we are required to or when this is needed for them to confirm that exports are lawful.

3.2We may disclose information to comply with law or a legal process, to protect rights, property and safety, and in connection with a business transaction such as a merger or sale, subject to appropriate protections. We do not sell personal information.

4. Where it is processed, and how long we keep it

4.1We are based in the United States and process personal information in the United States and in the places where our facilities and suppliers are located. Information about visitors to a Facility outside the United States, and about the services we provide there, is also processed in that country. Information about our website and portal is processed in the United States under United States law, and transfers from other countries are protected as described in section 9.

4.2We keep information as long as needed for the purposes above, normally for the duration of the relationship plus at least seven (7) years for financial, contract and compliance records, and for the periods required by law. Security and access logs are kept for shorter periods.

5. Security

5.1We use technical and organisational measures that are suitable for the risks, including encryption of secrets at rest, access controls, logging and, for staff, mandatory two-factor authentication. No system is perfectly secure.

6. Your choices and rights

6.1California residents have the rights described in the CCPA, including the right to know what personal information we collect, use, disclose and sell or share, to request deletion and correction, to opt out of the sale or sharing of personal information, to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights. We do not sell personal information and do not share it for cross-context behavioural advertising, and we use sensitive personal information only for the purposes the CCPA permits. In the preceding twelve months we collected the categories of information listed in section 1 for the business purposes in section 2 and disclosed them to the categories of recipients in section 3. Residents of other U.S. states may have similar rights under their state law. To exercise your rights write to legal@velyrix.com; you may use an authorised agent. We will verify your identity, will respond within the time the law allows (forty-five (45) days, extendable once), and may keep information that the law requires us to keep. Under California Civil Code section 1798.83 you may ask once a year which categories of personal information we disclosed to third parties for their direct marketing; we make no such disclosures. We honour opt-out preference signals as the CCPA requires.

6.2The Portal is intended for businesses and for adults; you must be at least 18 years old to register. It is not directed at children under 16, we do not knowingly collect personal information from children under 13 (Children's Online Privacy Protection Act, 15 U.S.C. § 6501 et seq.), and we do not sell or share the personal information of consumers under 16.

6.3CCPA disclosures. In the preceding twelve (12) months we collected the following categories of personal information listed in California Civil Code section 1798.140(v): identifiers; customer records described in section 1798.80(e); commercial information; internet or other electronic network activity information; audio, electronic, visual or similar information (security video); professional or employment-related information; and sensitive personal information consisting of account log-in credentials and government identification numbers (for identity checks, tax and compliance). We collect it from you, from your organisation and its authorised users, from our systems and facilities, and from screening, payment and verification providers. We disclose each category for the business purposes in section 2 to the categories of recipients in section 3. We do not use sensitive personal information to infer characteristics about you, and we keep each category for the periods stated in section 4.2.

6.4You may exercise your rights by e-mail to legal@velyrix.com or by calling us toll-free at +1 (888) 835-9749. We do not charge for a request, and we will not deny you services, charge you a different price or give you a different level of service because you exercised your rights.

7. Cookies

7.1The portal uses cookies that are needed for log-in, security and your language and display preferences. We do not use advertising cookies in the portal.

7.2We do not allow third parties to collect personal information about your online activities over time and across different websites through the Portal for advertising. Because there is no common industry standard for "Do Not Track" browser signals, the Portal does not respond to them; we treat a Global Privacy Control signal as a request to opt out of the sale or sharing of personal information, as the CCPA requires (disclosure under California Business and Professions Code section 22575(b)(5) and (6)).

8. Changes and contact

8.1We review this notice at least once every twelve (12) months and will post any new version, with its effective date, in the portal. This version is effective October 1, 2026. Questions: legal@velyrix.com, Velyrix, Inc., 1425 E Holt Ave Suite 201,Pomona CA 91767 USA.

9. Facilities and customers outside the United States

9.1This section applies to personal information that we collect in connection with Facilities outside the United States and with customers, contacts and visitors there. The controller is Velyrix, Inc., 1425 E Holt Ave Suite 201,Pomona CA 91767 USA, legal@velyrix.com. You can reach us on any privacy matter, including requests under local law, at legal@velyrix.com. The legal terms for each country are in our Country Terms.

9.2European Union and United Kingdom. We process personal information under the GDPR and the UK GDPR: to perform our contract with you or your organisation and to take steps before entering into it (Article 6(1)(b)); to meet legal obligations, including tax, accounting, export-control and sanctions duties (Article 6(1)(c)); and for our legitimate interests in running, securing and improving our business and Facilities, preventing fraud and abuse, protecting people and property (including by access control and video surveillance) and establishing or defending legal claims (Article 6(1)(f)). Where we rely on consent, you may withdraw it at any time. The information we ask for at registration or on entry to a Facility is needed for the contract or for access; without it we cannot provide the Services or admit you. We do not use automated decision-making that has legal or similarly significant effects on you. You have the rights of access, rectification, erasure, restriction, data portability and objection, and you may complain to the supervisory authority of the country where you live or work or where the Facility is located. When we transfer personal information to the United States or to other countries without an adequacy decision, we use the Standard Contractual Clauses of the European Commission or the UK International Data Transfer Addendum; you may ask us for a copy at legal@velyrix.com. Video recordings from Facilities are deleted after the period stated at the Facility, unless they are needed for an incident.

9.3Canada. We handle personal information under the Personal Information Protection and Electronic Documents Act and, in Quebec, the Act respecting the protection of personal information in the private sector. You may ask to access or correct your personal information and may withdraw your consent, and you may complain to the Office of the Privacy Commissioner of Canada or to the Commission d'accès à l'information du Québec. The person in charge of the protection of personal information can be reached at legal@velyrix.com.

9.4Mexico. This notice, together with the Spanish version that we provide, is our privacy notice (aviso de privacidad) under the Federal Law on the Protection of Personal Data Held by Private Parties. You may exercise your rights of access, rectification, cancellation and opposition (ARCO rights) and revoke your consent by writing to legal@velyrix.com.

9.5Japan, South Korea and Taiwan. We use personal information only for the purposes stated in section 2, keep it secure under section 5 and give it to third parties only as section 3 describes and as the Japanese Act on the Protection of Personal Information, the Korean Personal Information Protection Act and the Taiwanese Personal Data Protection Act allow. When we provide personal information to a recipient in another country, we do so as those laws allow, including, where they require it, with your consent or under contracts that give an equivalent level of protection. You may ask us at legal@velyrix.com to disclose, correct, stop using or delete your personal information, as those laws provide. Personal information that is no longer needed is destroyed in a way that prevents its recovery.

9.6Australia and New Zealand. We handle personal information under the Australian Privacy Principles in the Privacy Act 1988 (Cth) and the information privacy principles in the Privacy Act 2020 (New Zealand). You may ask to access or correct your personal information at legal@velyrix.com, and if you are not satisfied with our response you may complain to the Office of the Australian Information Commissioner or to the New Zealand Privacy Commissioner. Personal information may be disclosed to recipients in the United States and in the other countries where our Facilities and suppliers are located.