Privacy Policy

This Privacy Policy describes how Velvet(SIREN 978 665 412), operating under the brand Velvet, collects, uses, shares, and protects your personal data when you use our platform at velvet.fans.

We are committed to protecting your privacy and processing your data in accordance with the General Data Protection Regulation (GDPR)(EU Regulation 2016/679) and applicable French data protection laws.

1. Data Controller

Velvet
9 rue des Colonnes, 75002 Paris, France
SIREN 978 665 412
Email: contact@velvet.fans

2. Data We Collect

2.1 Account Data (All Users)

• Email address
• Password (stored as a secure bcrypt hash; we never access your plain-text password)
• Display name / username
• Avatar / profile photo (optional)
• Account type (Creator or Fan)
• Theme preference (light/dark mode)

2.2 Creator-Specific Data

• Bio, location, social media links
• Country of residence (for payout purposes)
• Bank account details: IBAN, account holder name, BIC/SWIFT (for withdrawal processing)
• Subscription status (Free or Premium, Monthly or Annual) and any fan-to-creator subscriptions you hold or receive, including the billing country used to route payments through the correct card network
• Wallet balance and transaction history
• Profile analytics (view counts, sales counts)
• Content metadata (titles, descriptions, pricing)

2.3 Fan-Specific Data

• Purchase and transaction history
• Tips sent (amount, message, anonymity preference)
• Custom request submissions
• Favorite creators list
• Messages exchanged with creators

2.4 Payment Data

Payment card details are processed directly by our third-party payment processor (Fungies) and are never stored on our servers. We only receive transaction confirmation data (transaction ID, amount, status).

2.5 Technical Data

• IP address (for security and fraud prevention)
• Browser type and version
• Device information
• Pages visited and actions taken on the Platform

3. How We Use Your Data

• Account management: To create and maintain your account, authenticate your identity, and provide customer support.
• Platform operation: To display creator profiles, process purchases, deliver content, and facilitate communication between users.
• Payment processing: To process payments, calculate commissions, manage creator wallets, and facilitate withdrawals.
• Transactional notifications: To send emails related to your account and transactions (purchase confirmations, tip notifications, custom request updates, account verification, payout notifications, security alerts). These are necessary for the operation of your account.
• Marketing communications: To send product updates, new feature announcements, creator tips, promotional offers, and the Velvet newsletter to users who have either created an account (accepting our Terms of Service) or completed a paid transaction on the Platform. You may opt out at any time via the "Communications" toggle in your account Settings or the unsubscribe link in any marketing email.
• Security: To detect and prevent fraud, abuse, and unauthorized access.
• Legal compliance: To comply with applicable laws, regulations, and legal processes.

4. Legal Basis for Processing (GDPR)

• Contract performance (Art. 6(1)(b)): Processing necessary to provide the services you requested, including transactional emails tied to purchases, tips, custom requests, and payouts.
• Legitimate interests (Art. 6(1)(f)): Processing necessary for fraud prevention, security, Platform improvement, and, pursuant to Article 13(2) of the ePrivacy Directive, sending marketing communications to our existing customers and registered users regarding similar services, subject to a clear and free opt-out right exercisable at any time.
• Legal obligation (Art. 6(1)(c)): Processing required by law (tax reporting, financial regulations, record-keeping).
• Consent (Art. 6(1)(a)): Where required, we obtain your explicit consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

AutoI18n.views_Privacy_5_third_party_service_providers

5.1 Payment Processing

Fungies: Acts as merchant of record. Processes credit card payments, subscription billing, fraud screening, and chargebacks. Their processing is governed by their own privacy policy.

5.2 Infrastructure

Velvet self-hosted infrastructure: Database, authentication, API, and file storage. Data is encrypted in transit and protected by server-side access controls.

Hosting, CDN, and infrastructureAutoI18n.views_Privacy_frontend_hosting_cdn_or_infrastructure_providers

5.3 Email

Brevo: Transactional email delivery. GDPR-compliant, processes data within the EU.

5.4 Analytics

We use Umami, a self-hosted, privacy-respecting analytics tool running on our own infrastructure. Umami collects anonymised data only (page URL, referrer, browser, OS, device type, and country). It does not use cookies, does not fingerprint visitors, and data never leaves our servers. We do not use third-party advertising networks or tracking pixels. We do not sell your data.

6. Cookies and Local Storage

Velvet uses only strictly necessary cookies and browser local storage to operate the Platform:

• Authentication session token: A secure JWT token stored in your browser's localStorage to maintain your login session.
• Theme preference: Your light/dark mode selection stored locally on your device.
• Session state: Temporary UI state (e.g., dismissed modals) stored in sessionStorage.

We do not use marketing cookies, analytics cookies, or any third-party tracking technologies. Our self-hosted Umami analytics does not set cookies. For full details, please see our Cookie Policy.

7. Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy:

• Account data: Retained for the duration of your active account plus 30 days after deletion request.
• Transaction records: Retained for up to 10 years to comply with French commercial and tax law (Code de commerce, art. L123-22).
• Communication logs: Messages are kept while either party's account exists, and are not erased when an account is deleted: a message is a record for both people in the conversation, and it also evidences paid content sold in chat. A deleted account's profile and identity stop being shown anywhere on Velvet. You can export the messages you sent at any time, and you may ask us to erase specific messages at privacy@velvet.fans.
• Server logs: Automatically purged after 90 days.
• Payment card data: Not stored by Velvet; handled entirely by Fungies.
• Bank details (IBAN): Retained while the creator account is active. Deleted within 30 days of account deletion, except as required by financial regulations.

8. Your Rights Under GDPR

As a data subject under the General Data Protection Regulation, you have the following rights:

• Right of access (Art. 15): You may request a copy of your personal data in a structured, commonly used format.
• Right to rectification (Art. 16): You may request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17): You may request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations.
• Right to restriction (Art. 18): You may request that we limit the processing of your data in certain circumstances.
• Right to data portability (Art. 20): You may obtain a machine-readable copy (JSON) of the data Velvet holds about you: a signed-in account can fetch it from Velvet's data-export endpoint, and you can always request a copy at privacy@velvet.fans. It contains the messages you sent; messages other people sent you are their personal data and appear as conversation metadata only.
• Right to object (Art. 21): You may object to processing based on our legitimate interests.
• Right to withdraw consent (Art. 7): Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right not to be subject to automated decision-making (Art. 22): We do not make decisions based solely on automated processing that produce legal effects concerning you.

To exercise any of these rights, contact us at contact@velvet.fans. We will respond within 30 days. If the request is complex, we may extend this period by an additional 60 days, with prior notification.

9. Data Security

We implement appropriate technical and organizational measures pursuant to Article 32 of the GDPR:

• SSL/TLS encryption for all data in transit (HTTPS enforced)
• Encryption at rest for stored data where supported by the hosting environment
• Secure password hashing using Argon2id with appropriate parameters
• Server-side authentication and authorization policies enforced by the API
• API authentication and authorization on all endpoints
• Rate limiting to prevent brute-force and denial-of-service attacks
• Regular dependency updates and security patches

10. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the CNIL within 72 hours of becoming aware of the breach, as required by Article 33 of the GDPR.
• Notify affected users without undue delay if the breach is likely to result in a high risk to their rights and freedoms (Article 34 GDPR).
• Document the breach, its effects, and the remedial actions taken.

11. Automated Decision-Making and Profiling

Velvet does not engage in automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you. Commission calculations and payment processing are deterministic operations based on published rates, not individual profiling.

12. International Data Transfers

Your data may be processed outside the European Economic Area (EEA), specifically:

• United States:AutoI18n.views_Privacy_frontend_hosting_cdn_or_infrastructure_providers
• Fungies (payment processing): Refer to Fungies' privacy policy for their data processing jurisdiction and safeguards.

For transfers to the United States, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914). You may request a copy of the applicable safeguards by contacting us.

13. Children's Privacy

AutoI18n.views_Privacy_velvet_is_not_intended_for_use_by_anyone_under_th

AutoI18n.views_Privacy_14_periodic_age_verification

AutoI18n.views_Privacy_creators_earning_revenue_may_be_prompted_to_re_ve

15. Changes to This Policy

AutoI18n.views_Privacy_we_may_update_this_privacy_policy_from_time_to_t

AutoI18n.views_Privacy_16_contact_us

AutoI18n.views_Privacy_if_you_have_any_questions_about_this_privacy_poli

Velvet
9 rue des Colonnes, 75002 Paris, France
SIREN 978 665 412
Email: contact@velvet.fans