This studio names businesses; it does not sell your data to anyone.

This policy takes effect on 7 September 2026 and applies to velabu.com from that date forward. Where an earlier version applied to a visit made before that date, this version replaces it.

Velabu operates this site from 31 River Road, Suite 4, Austin, Texas 61698, United States. Velabu is the controller of the data described below — the party that decides what is collected and why, and the party this policy binds. Reach the studio at office@velabu.com or +1 (648) 555-1724.

The inquiry form on the homepage and on this site's contact page writes down what you type into it: your name, phone number, email address, business address, the format you are asking about, your notes, any specification you add, and the consent tick. Submitting it also records the moment the page rendered and the moment you sent it, your IP address, your browser's user-agent string, and the page that referred you here.

The chat widget keeps the conversation you have with the studio and a token stored in your browser so the same conversation reopens if you come back. It records whatever you type, plus the name, phone, email or consent tick you give it if you choose to give one.

Ordinary technical and log data is generated by every visit regardless of any form: page requests, timestamps, IP address, user-agent, and referring URL, held briefly for security and fault-finding.

Cookie identifiers and advertising click identifiers are covered in full in the cookie statement. In short: a consent-choice cookie, and, where a platform sends the click, gclid from Google Ads, msclkid from Microsoft Advertising, or fbclid from Meta Ads.

Inquiry data is used to answer the brief you sent: to read it, call or email you back, and quote a format once the intake call has happened. Chat data is used to keep answering your questions in the same conversation. Technical and log data is used to keep the site working and to catch abuse, including the two honeypot fields hidden in every form, which exist only to catch automated submissions. Cookie and click-identifier data is used to measure whether an advertisement led to an inquiry, and, once you allow storage, to shape which ad a platform shows you next.

Where the GDPR applies to your visit, Velabu relies on one of three bases for each purpose, stated plainly rather than left implied. Answering an inquiry you submitted rests on contract — taking the steps needed to quote and deliver work you asked about. Keeping logs and running the honeypot fields rests on legitimate interest — running a working site and refusing spam without asking permission for something this ordinary. Advertising cookies, the click identifiers, and any analytics storage rest on consent: nothing in that category is set until you allow storage in the banner, and Consent Mode v2, described in the next section, is how that consent is passed to the ad platforms themselves.

Google Ads and Microsoft Advertising run paid traffic to this site today, and Meta Ads may. When a visitor arrives from a paid link, the platform can attach a click identifier to the URL: gclid from google ads, msclkid from microsoft advertising, or fbclid from Meta Ads. That identifier lets the platform credit the click that led to a visit or an inquiry. No claim is made here that any of these three platforms has reviewed or approved this site — running ads on a platform is not the same as that platform vetting the destination.

This site runs Google's consent mode, the signal framework built for exactly this decision. Until a visitor actively allows storage in the cookie banner, four signals are held denied: ad_storage, ad_user_data, ad_personalization and analytics_storage. Allowing storage sets the ones that apply to on; declining, or later withdrawing consent, sets all four back to denied immediately. Global Privacy Control is honoured the same way — a browser sending that signal is treated as having declined, without a second prompt.

Four named parties can receive some part of the data above. Google Ireland Ltd and Google LLC receive the gclid identifier and the consent signals through Google Ads, where a campaign runs there. Microsoft Ireland Operations Ltd receives the msclkid identifier through Microsoft Advertising; its own handling of that data is described at privacy.microsoft.com. Meta Platforms Ireland Ltd receives the fbclid identifier through Meta Ads, on the campaigns that run there. Beyond the ad platforms, the hosting provider that serves this site and stores the enquiry database, and the mail provider that carries the notification email to the studio's inbox, both process data as instructed by Velabu and do not use it for their own advertising.

Velabu is based in the United States and the data described above is generally handled there. Where a visitor reaches this site from the European Economic Area or the United Kingdom, storing that visitor's data on US infrastructure is a transfer outside the country of collection. The ad platforms named above operate their own transfer mechanisms — standard contractual clauses, in each case — as the lawful basis for moving the relevant identifiers between their European and US entities; Velabu does not separately negotiate those clauses but relies on the platform's published terms for the identifier it receives.

Real periods, not "as long as necessary": an inquiry and its email copy are kept 24 months, so a past client's brief can be found without asking them to resend it. Chat transcripts are kept 18 months. Server and access logs are kept 90 days and then purged. A recorded consent choice is kept 6 months, after which the banner asks again. None of these periods extends automatically — each is a ceiling, and data is deleted at or before it.

The inquiry form and chat widget run over an encrypted connection. Access to the stored enquiries and chat transcripts is limited to the four people who work at this studio; there is no third-party account manager with a login. The two hidden honeypot fields on every form exist to filter automated submissions before a human ever reads them. No payment method is collected anywhere on this site, so there is no card data to protect in the first place.

A visitor covered by the gdpr has the right to access the data Velabu holds about them, to have it corrected, to have it erased, to have its processing restricted, to receive a portable copy of what they gave us, to object to processing based on legitimate interest, and to withdraw consent at any time with no effect on processing that already happened lawfully before the withdrawal. None of these rights costs anything to exercise.

Residents of California have rights under the ccpa, as amended by the CPRA, and residents of several other states now have comparable rights under their own state laws — this section applies to all of them, not California alone. Those rights include knowing what has been collected, deleting it, correcting it, and opting out of the sale or sharing of personal information for cross-context advertising. Velabu does not sell personal information for money. The click identifiers and consent-based advertising storage described above are, under some state definitions, a form of "sharing," and the opt-out for that sharing is the same control as declining or withdrawing consent in the cookie banner.

This site honours global privacy control. A browser or extension sending the Sec-GPC signal is treated as an opt-out of advertising storage and sharing automatically, with the same effect as declining in the cookie banner, and Velabu does not ask that visitor to repeat the choice through a second prompt.

This site is built for business owners commissioning naming work, not for children. Velabu does not knowingly collect data from anyone under thirteen, and any inquiry that appears to come from a minor is deleted rather than answered as a paying brief.

If you think Velabu has mishandled your data, write to office@velabu.com first so we can look at it directly. You may also complain to your state Attorney General, and, if you are a California resident, to the California Privacy Protection Agency. A visitor covered by the gdpr may complain to their own country's data protection authority instead of, or as well as, contacting us.

Write to office@velabu.com, or post to Velabu, 31 River Road, Suite 4, Austin, Texas 61698, and say which of the rights above you are exercising. Tell us the email or phone number you used when you contacted the studio, so we can find the right record — we do not keep a separate account or password system to look one up by. We answer within 7 days, and if a request needs longer because the record is hard to locate, we tell you that within the same 7 days rather than let the deadline pass silently.

This site is built with a single visible heading per page, labelled form fields, a skip link ahead of the header, keyboard-operable navigation and an accordion, and colour contrast set against the letterpress palette rather than left to default grey. Motion is limited to short, purposeful transitions and respects a browser's reduced-motion setting; nothing loops or autoplays. If a control, a page or a document here does not work with your browser, screen reader or keyboard, tell us at office@velabu.com with the page and what happened, and we will fix it or send you the content another way.

If this policy changes in a way that matters — a new category of data, a new platform receiving it, a different retention period — the effective date at the top of this page moves forward and the change is described in this section for the following version. Continuing to use the site after that date means the new version applies to you.

Email office@velabu.com or call +1 (648) 555-1724. Both reach the same four people who write the names — there is no separate privacy department, and no call centre standing between you and an answer.