Privacy Policy
Last updated 21 July 2026
This policy explains how Purple Pi Marketing handles personal information in Veltorica (the “Service”), consistent with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
Two different roles we play
This distinction matters, because most of the personal information that flows through Veltorica isn't ours:
- Customer data — we are the controller. The account details of businesses who subscribe. We decide how this is handled and this policy governs it.
- Document and signer data — we are a processor. The contracts our customers upload and the details of the people they send them to. Our customer decides what to collect and why; we only hold and process it to deliver the Service on their instructions. If you signed a document and want it corrected or removed, contact the business that sent it to you — we'll help them, but it's their record.
What we collect
From account holders: name, email address, business name, a hashed password, and login timestamps.
From documents and signing: the documents uploaded, the recipient names and email addresses entered by our customer, and — because it's what makes an electronic signature defensible — the signer's typed or drawn signature, their consent to sign electronically, timestamps, IP address, browser user-agent, and how far through the document they scrolled before signing.
Billing: handled by Stripe. We store a customer identifier and subscription status only. We never receive or store full card numbers.
Technical: standard server logs and error reports used to keep the Service running and secure.
Why we collect it
- To provide the Service — hosting documents, delivering signing links, applying signatures.
- To produce audit trails and Certificates of Completion, which exist specifically to evidence that a signature was given.
- To authenticate users and protect accounts.
- To bill subscriptions and handle support.
- To send service messages such as password resets and billing notices.
We do not sell personal information. We do not use your documents to train machine-learning models. We do not use signer data for our own marketing.
Who we share it with
Only the service providers needed to operate: our hosting and database providers, our email delivery provider, and Stripe for payments. Each is bound by its own terms and handles data only as needed to provide their service to us.
Some of these providers store data outside Australia, including in the United States. By using the Service you consent to that disclosure. We may also disclose information where required by law.
Emails sent on your behalf
Where a customer connects their own sending domain, contract emails are sent from their address through our email provider. The recipient's address is used only to deliver that customer's document.
Security
- Data is encrypted in transit (HTTPS).
- Passwords are stored as bcrypt hashes, never in plain text.
- Each customer's data is logically separated, and access is scoped so that no customer can retrieve another customer's documents.
- Signing links are long random tokens; completed documents carry a SHA-256 hash so later alteration is detectable.
No system is perfectly secure. If a data breach occurs that is likely to cause serious harm, we will notify affected parties and the OAIC as required by the Notifiable Data Breaches scheme.
How long we keep it
Documents and audit trails are retained while the account is open, because both may be needed as evidence of an agreement. After an account is closed, data may be deleted 30 days later. Some billing records are kept longer where tax or accounting law requires it.
Your rights
You may ask us to access, correct or delete the personal information we hold about you, and you may withdraw consent to non-essential processing. Account holders can update most details directly in the app. Contact us at support@veltorica.com and we'll respond within a reasonable period, usually 30 days.
If you are a signer rather than an account holder, we will usually direct your request to the business that sent you the document, since the record belongs to them.
Cookies
We use a single essential cookie to keep you signed in. We do not use advertising or third-party tracking cookies.
Children
The Service is intended for business use and is not directed at anyone under 18.
Changes
We may update this policy. Material changes will be notified by email or in the app before they take effect.
Contact and complaints
Purple Pi Marketing, Brisbane, Queensland, Australia — support@veltorica.com · veltorica.com
If you are not satisfied with our response to a privacy complaint, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.