Last updated 8 November 2026
Privacy policy
In short
- Reading Velonary does not require an account, and we do not use tracking cookies or analytics.
- Ads are chosen by the page you are on, never by who you are.
- We do not sell personal data.
- Advertisers and people who contact us give us the data we need to serve them – nothing more.
- You can ask to see, correct or delete your data at any time through the contact form.
Who is responsible
The controller of your personal data is Tupvice Oy (“Velonary”), business ID 3143472-5, Finland. Contact us about privacy through the contact form (choose “Privacy request”) or by email at info@velonary.com. We have not appointed a data protection officer, because the law does not require one for our processing.
What we collect, why and on what legal basis
| Who | Data | Purpose | Legal basis (GDPR) | Kept for |
|---|---|---|---|---|
| All visitors | IP address, browser, requested page and time, in our hosting providers’ server logs | Delivering the site, security and abuse prevention | Legitimate interest (Art. 6(1)(f)) | As set by the hosting provider, typically up to 30 days |
| All visitors | Page address, referring website, country (from our hosting provider, not stored as an IP address), device type and a pseudonymous code calculated from IP address and browser with a secret key that changes every day. No cookies are used and the IP address is not stored. | Counting visits and showing advertisers aggregated audience figures; country targeting of ads | Legitimate interest (Art. 6(1)(f)) | 25 months; the code cannot be linked across days |
| Visitors who see or click an ad | A pseudonymous code calculated from IP address and browser with a secret key that changes every day. The IP address itself is not stored. | Counting impressions and clicks, filtering invalid or repeat clicks, billing advertisers fairly | Legitimate interest (Art. 6(1)(f)) | Up to 25 months for advertiser reports; the code cannot be linked across days |
| Visitors who follow a shop link | The shop, the product, country and the daily-rotating pseudonymous code (no IP address, no cookies) | Counting clicks to shops and reconciling affiliate commissions | Legitimate interest (Art. 6(1)(f)) | 25 months |
| Visitors who choose a colour theme | Your choice (light or dark), stored only in your browser | Remembering your preference | Your request; strictly necessary storage | Until you clear it |
| People who contact us | Name, email address, organisation (optional), message, the page you wrote from | Answering you and handling requests, including privacy and legal notices | Legitimate interest; legal obligation for privacy and legal requests | Up to 24 months after the last message |
| Advertisers | Sign-in email, company name, billing email, country, VAT ID, website, campaigns, balance and invoices. Card details are handled by Stripe; we never see them. | Providing the advertising service, billing, fraud prevention, accounting | Contract (Art. 6(1)(b)); legal obligation for accounting (Art. 6(1)(c)) | While the account is open; accounting records as required by Finnish law (up to 10 years) |
| Authors of reviewed articles | Author name and publication, as published with the original article | Crediting the reviewer and linking to the original review | Legitimate interest | While the article is listed |
We do not use your data for automated decisions with legal or similarly significant effects, and we do not collect special categories of data (such as health data).
Service providers
We use these providers to run Velonary. They process data only on our instructions, under data processing agreements:
- Vercel Inc. – hosting of the website (global network; United States company).
- Render Services, Inc. – hosting of our application servers in Frankfurt, Germany.
- Supabase, Inc. – database (stored in the EU, Paris) and advertiser sign-in emails.
- Stripe Payments Europe, Ltd. – payments for advertisers (Ireland).
Transfers outside the EU
Our data is stored in the EU. Some providers are United States companies and may access data from there. Such transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s Standard Contractual Clauses with additional safeguards.
Your rights (EU, EEA and UK)
You have the right to:
- get a copy of your personal data (access) and receive it in a portable format;
- have inaccurate data corrected and, in many cases, deleted;
- restrict processing or object to processing based on legitimate interest;
- withdraw consent where processing is based on consent.
Send your request through the contact form. We answer within one month (extendable by two months for complex requests) and may ask you to confirm your identity. You may also lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi) or the authority where you live.
Notice for United States residents
This section applies to residents of California (CCPA as amended by the CPRA) and of other states with comprehensive privacy laws, such as Colorado, Connecticut, Virginia, Utah, Texas and Oregon.
Categories of personal information we collect
- Identifiers – name and email address (contact form, advertisers), IP address (server logs).
- Commercial information – advertising purchases and balance (advertisers).
- Internet activity – pages requested; pseudonymous ad impressions and clicks.
- Professional information – company details of advertisers.
We collect it from you directly or automatically when you use the site, for the purposes described above. We disclose it only to the service providers listed above for those business purposes. We do not collect sensitive personal information.
No sale, no sharing, no targeted advertising
We do not sell personal information, do not share it for cross-context behavioural advertising and do not use it for targeted advertising or profiling. We have not done so in the past 12 months. We honour Global Privacy Control signals. See Your privacy choices.
Your rights
You can ask to know, access, correct and delete your personal information, and to receive it in a portable format. We will not discriminate against you for using these rights. Make a request through the contact form; an authorised agent may act for you with your signed permission. We confirm receipt within 10 business days and respond within 45 days (extendable once by 45 days). If we decline your request, you can appeal by replying to our decision; if the appeal is denied, you can contact your state attorney general.
Children
Velonary is not directed to children under 16 and we do not knowingly collect their personal data.
Security
Data is encrypted in transit, databases are not publicly accessible, access is limited to the people who need it and protected with strong authentication. If a breach affects your data and poses a high risk, we will tell you.
Changes
We will update this page when our processing changes and show the date above. Material changes affecting advertisers will also be sent to them by email.