Privacy Policy

VEPR (“VEPR”, “we”, “us”) is a project of Void Walkers, a student-led innovation lab based in India. VEPR is led by Aarav Soni, who serves as the project lead and primary contact. You can reach the team at vepr.support@gmail.com or team.voidwalkers@gmail.com.

For the purposes of India's Digital Personal Data Protection Act, 2023 (the “DPDP Act”), Void Walkers, through its project lead Aarav Soni, acts as the Data Fiduciary for the personal data described below.

• Your document's contents are end-to-end encrypted on your own device. We only ever receive a scrambled blob we cannot read.
• That encrypted blob is automatically deleted from the cloud within about five minutes, whether or not it was printed.
• We keep a small amount of job information so you can see your print history and so the shop can serve you.
• We do not sell your personal data.

Account data (all users)

Authentication is handled by our processor Clerk. Depending on how you sign up, this includes your name, email address and/or phone number, and the account identifiers Clerk issues.

Shop Owner Data

If you set up a shop, we store your shop name, your chosen URL slug, your per-page pricing and print options, your shop's public encryption key, and metadata about the desktop devices you pair. We also store subscription billing records, which include the duration of the plan purchased and payment status. We never receive your shop's private key.

End-User Document Data

When you send a document to a shop, the file is encrypted on your device before upload; we store only the encrypted blob, temporarily. To run the service and show you your history, we also store job information: the page count, number of copies, the selected print option, the amount, the shop, the job status, the document's file name, and the name/contact you signed in with. The file's contents are never readable by us.

Technical data

Our hosting and infrastructure providers process standard technical information (such as IP address and request logs) to deliver and secure the service.

• To provide printing, shop setup, and your print history.
• To secure the service and prevent abuse (e.g. rate limiting).
• To respond to your support and grievance requests.
• To comply with applicable law.

We process this data on the basis of your consent and to perform the service you request. You can withdraw consent at any time by deleting your data or closing your account (see Your rights).

We share data only with:

• The shop you choose — your job information and the name/contact you signed in with, so they can fulfil your print.
• Our processors, who handle data on our instructions: Clerk (authentication), FamGateway (payments and subscription processing), Supabase (database and encrypted-blob storage), and Vercel (hosting).
• Authorities, where we are legally required to do so.

We do not sell your personal data or use it for third-party advertising.

• Encrypted document blobs: automatically deleted within about five minutes of upload, printed or not.
• Live job rows: short-lived; removed shortly after the job settles.
• Print history and account data: kept until you delete it or close your account.

Document contents are protected with strong end-to-end encryption that only the shop's own printer can unlock — we never hold the key. Access to data is restricted per-user with row-level access controls, traffic is served over HTTPS, and device tokens are stored only as hashes. No system is perfectly secure, but VEPR is designed to hold as little readable data as possible.

You have the right to:

• Access a summary of the personal data we hold about you.
• Correct or complete inaccurate or incomplete data.
• Erase your data and close your account.
• Raise a grievance and have it addressed.

To exercise any of these, contact us at vepr.support@gmail.com. This is also our grievance redressal contact; we aim to acknowledge requests promptly.

VEPR is intended for adults operating or using print services. We do not knowingly collect data from children without the verifiable consent of a parent or guardian as required by the DPDP Act. If you believe a minor has used VEPR without such consent, contact us and we will delete the data.

Some of our processors operate infrastructure outside India. Where your data is processed abroad, it remains subject to this policy and to the contractual protections we have with those processors.

We may update this policy as the service evolves. We will revise the “last updated” date above, and for material changes we will make a clearer notice available on vepr.co.in.