Privacy Policy

Effective date: 25 October 2026 · Version 2026-10-25.v1

Introduction

Velzori LLC (“Velzori,” “we,” “us” or “our”), company no. LC014672927, operates velzori.com. This Policy describes information used for our Site, business wholesale orders, certificate review and related support. It does not promise rights beyond those required or provided by applicable law.

Wholesale Orders and Acceptance Records

We collect business name, contact name, email, phone, U.S. business address, and delivery information. Business/contact details are associated with the Stripe Customer and checkout; order references connect payment, shipping and certificate records. We use these records to process and verify orders/payments, prevent abuse, fulfill orders, provide tracking and support, and handle cancellations, claims and refunds. We do not require a wholesale application or approval code.

We record your affirmative checkout acknowledgement, the Terms and Privacy Policy versions/dates, and a server-recorded acceptance timestamp with the Stripe checkout/order reference. We retain dated policy copies to identify what applied to an order. This acceptance record does not add browser fingerprinting.

Resale Certificates and Tax Records

We collect the uploaded resale/exemption certificate, typed purchaser name, resale certification, submission time, business/contact details and review history. Certificates may contain business or tax identification information and other information required by the applicable certificate; some of that information can be sensitive. Submit only what the applicable official certificate lawfully requires. We do not request Social Security numbers in ordinary checkout, optional tax-ID or support fields. Do not add an SSN to a certificate unless that applicable official certificate lawfully requires it.

Certificate files and review records are stored with Supabase in private storage/database services. File viewing through Velzori HQ requires authenticated, authorized staff access; our implementation also requires MFA and serves authorized private downloads through the HQ document endpoint. Files are not published as permanent public links. Authorized personnel with certificate review, documentation or related tax/compliance duties may access the information as permitted by their role.

We use certificates to evaluate resale representations, maintain tax/accounting and compliance records, investigate misuse and support audits or disputes. We associate a certificate with its business and, when created, Stripe Customer/Checkout Session references. Stripe receives the certificate reference with checkout metadata; our checkout does not send the certificate file to Stripe. Uploading or approving a certificate does not automatically change tax treatment.

Cookies and Browser Storage

A secure, HttpOnly checkout cookie lasts up to eight hours and binds checkout access to your browser. Cart contents and cart identity are stored in localStorage so the cart persists between visits. sessionStorage holds temporary checkout/order references, cart snapshots and a random certificate retry identifier with an input commitment to avoid duplicate submissions after reload. These are functional checkout protections, not advertising or device fingerprints. Stripe may use its own cookies/storage under its policies.

Velzori’s storefront does not save raw business details, addresses, phone numbers, tax IDs, certificate bytes, signatures or payment secrets in localStorage/sessionStorage. Form entries remain in memory during checkout. Clearing browser storage may prevent recovery of a checkout; contact support before making another payment if the result is uncertain.

Payments and Service Providers

Card details are entered in Stripe-owned fields. Our merchant application does not store raw card numbers or security codes. Stripe processes payment and the contact, shipping and billing information needed for checkout. Optional business tax IDs, where offered, are entered directly in Stripe and do not automatically grant an exemption. Do not enter an SSN in that optional field.

We may use appropriate professional, communications and other service providers for support, accounting, tax or legal work, with information relevant to their functions and subject to applicable law. We may disclose information when reasonably necessary to comply with law or lawful requests, protect rights or security, investigate fraud, or complete a legitimate merger, acquisition or other business transfer, subject to applicable law. Necessary provider sharing occurs; we do not claim never to share information. Providers may also process information under their own notices and legal obligations.

Security and Logging

We use reasonable administrative, technical and organizational safeguards appropriate to the information, including private certificate storage, authorized HQ access, MFA requirements and server-side payment verification. No internet transmission or storage system can be guaranteed completely secure. We will provide security-breach notifications where legally required.

Customer-facing checkout errors are generic. Our checkout application does not intentionally write raw card details, business/address fields, certificate contents, payment secrets or full provider responses to application logs. Hosting and service-provider systems process their own technical/security records. Authorized business records used for order fulfillment and certificate review are separate from application error logs.

Retention by Record Category

General operational/order records: our documented operational policy uses a 12-month baseline with manual review, subject to longer retention where reasonably needed for accounting, tax, fraud prevention, chargebacks, disputes, contractual or legal obligations. Policy acceptance and order evidence may be retained with the related records for those purposes. The baseline is not a universal deletion deadline.

Resale/exemption certificates and supporting tax records: we retain these for the period required by applicable tax/recordkeeping law, and longer where reasonably necessary for audits, disputes, chargebacks, fraud prevention or legal obligations. Missouri Department of Revenue guidance states sales/use-tax records generally should be kept at least three years and recommends five years, or longer as needed for periods under audit. We account for those rules and guidance when reviewing Missouri-related records; other applicable requirements may differ. See the Missouri tax-audit recordkeeping guidance.

Retention and deletion reviews are manual. We do not promise automatic deletion on an exact date or automatic deletion from provider systems. Providers may retain their own records under their policies and obligations. Records subject to a legal hold are not deleted until the hold and applicable retention requirements allow it.

Privacy Requests

Business contacts and Site users may contact velzori.llc@gmail.com to request access, correction or deletion where required or provided by applicable law, including questions about former wholesale-application records. We may reasonably verify the requester’s identity/authority without requesting unnecessary sensitive information. Applicable law may permit or require us to retain records for tax, accounting, fraud, dispute, contractual or legal obligations or to protect others’ rights. We will explain an applicable limitation when responding as required by law.

Policy Changes and External Links

Revisions apply prospectively after their stated effective date, subject to applicable law and any required notice or additional consent. Posting a revision does not by itself replace the version identified with an already-submitted order. The dated version 2026-10-25.v1 remains available. External sites have their own information practices; links do not extend this Policy to those services.

Contact and Order Information

Contact Velzori LLC at velzori.llc@gmail.com. Do not email card numbers, passwords or SSNs. Our shipping, cancellation, claims/refunds and support terms explain order handling.