This Privacy Policy explains how Velvet ("we", "the app", "the Service") collects, uses, stores, and shares information when you use the Velvet mobile application.
By creating an account or using the Service, you accept the practices described in this document.
1. What Data We Collect
1.1 Data You Provide Directly
- Identity & contact: name, email address, date of birth (mandatory 18+ age gate), phone number (used for WhatsApp contact between users who have mutually accepted each other).
- Profile: gender, height, body type, habits (smoking/drinking), languages, occupation, self-reported income or net worth range (optional).
- Special categories of data (optional): if you choose to share information about ethnic origin, sexual orientation, or other lifestyle preferences in your profile or bio, it is processed solely for algorithmic matchmaking, with your explicit consent given by voluntarily providing it.
- Photos: images you upload to your public profile.
1.2 Biometric Facial Verification
To prevent fake accounts, Velvet requires an identity verification step through facial comparison ("Selfie Check"), using Google ML Kit.
- The facial geometry analysis is performed locally on your device, comparing your selfie against your profile photo.
- Based on the app's current architecture, this comparison does not upload your selfie to our servers as part of this specific verification process. [This line depends on you confirming that no other flow in the app uploads that same image to Storage for a different reason — see the separate technical note provided alongside this document.]
1.3 Cycle-Tracking Data (Limited Availability)
As part of the product testing described in Section 2.1, a limited number of accounts may have access to an optional feature that lets a user log dates related to her menstrual cycle, which the feature uses to calculate an estimated fertility window. We treat this as sensitive, health-related data, regardless of how the feature is branded within the app.
- This data is only collected if you actively choose to use the feature.
- It is encrypted, and is only decrypted for a specific other user if and when you separately and explicitly authorize that specific person to view it — a distinct action from accepting a general invitation.
- You may withdraw this authorization at any time.
- This data is automatically deleted if not updated within 60 days.
- We do not share this data with advertising or analytics SDKs, and it is not used for any purpose other than displaying it to the people you specifically authorize.
1.4 Private Gallery (Limited Availability)
As part of the product testing described in Section 2.1, a limited number of accounts may have access to an optional "Private Gallery" feature, allowing a user to upload additional photos that are not shown on their public profile.
- Private Gallery photos are automatically scanned using on-device and platform content-safety tools before being made available to view. This scanning is a best-effort safety measure; it does not guarantee that all objectionable content will be detected.
- Access to a specific person's Private Gallery is only granted according to that account's specific configuration at the time (either tied to a paid invitation tier, or through a separate, explicit grant to a specific person) — see Section 4.2 of the Terms and Conditions for what happens once access is granted.
- We apply OS-level anti-screenshot and anti-screen-recording protections within this feature, described further in Section 5.
1.5 Income and Professional Verification (Optional)
Any user, regardless of gender, may optionally verify their professional or income information by connecting a third-party account (such as LinkedIn or Instagram) or submitting other supporting documentation. If you choose to do this:
- We access only the specific information needed to verify the claim you're making (for example, a job title or employer), not your full third-party account.
- This determines your verified status and eligibility within the Service. We do not publish the underlying documents, account details, or any individual user's payment or spending history to other users.
- You may revoke this verification and disconnect the associated account at any time from Settings.
1.6 Automatically Collected Data
- Location: GPS coordinates while the app is in the foreground, to enable proximity-based matching. We do not track background location.
- Technical data: IP address, device identifiers, operating system version, device model — used for security, fraud prevention, and detection of malicious activity.
- Platform activity: history of invitations sent/received and their status, blocks, post-date ratings.
2. Why We Use Your Data
| Purpose |
Data Involved |
Legal Basis (if you are in the EU/UK) |
| Account creation & core functionality |
Identity, contact, photos, location |
Contractual necessity |
| Algorithmic matchmaking |
Profile, preferences, usage |
Legitimate interest / contractual |
| Sensitive data (if voluntarily shared) |
Ethnic origin, sexual orientation |
Explicit consent |
| Cycle-tracking feature (limited accounts) |
Cycle dates, calculated fertility window |
Explicit consent, given separately per authorized recipient |
| Delivering contact between users |
Private vault, WhatsApp number |
Execution of your explicit instruction (accepting an invitation) |
| Fraud prevention & security |
Biometrics (local), device fingerprint, IP |
Legitimate interest / legal obligation |
| Content moderation |
Photos and profile text (automated scanning) |
Legitimate interest (platform safety) |
| Payment processing |
Transaction history |
Contractual necessity / legal obligation |
2.1 Product Testing and Improvement
We may occasionally evaluate different configurations or features of the Service with a limited number of accounts, in order to improve the overall experience. Any feature under evaluation remains subject to this same Privacy Policy.
2.2 Aggregated and De-Identified Data
We may create aggregated or de-identified data derived from your usage of the Service, from which information that could reasonably identify you has been removed. We may use this data for internal analytics, product development, reporting, and business planning without further restriction, since it is no longer personal data about you.
3. Who We Share Data With
We do not sell your personal data. We do not share it for cross-context behavioral advertising.
3.1 Between Users
- Your public information and profile photos are visible according to your matching settings.
- Your WhatsApp number is only decrypted and shared with another user when you explicitly accept their invitation.
3.2 Infrastructure Providers
We share data only with the providers necessary to operate the Service, under appropriate agreements with each:
- Google Cloud / Firebase: database hosting (Firestore), media storage (Storage), authentication.
- Google ML Kit: local, on-device biometric processing.
- Apple App Store / Google Play Billing: processing of in-app purchases. We use no other payment processor — we do not share your financial data with anyone beyond Apple or Google, depending on which platform you use.
3.3 Legal Situations
- Payment disputes (chargebacks): if you initiate a fraudulent chargeback, we may share with Apple/Google the necessary evidence (access logs, timestamps) to validate that the digital service was delivered.
- Authorities: we disclose information when legally required (valid court order or subpoena), or in the presence of indications of child exploitation, human trafficking, or an imminent threat to someone's physical safety.
4. How Long We Keep Your Data
- Active account: for as long as you maintain your account.
- Account deletion: your profile data and media are removed from active servers within 30 days of your request. Residual encrypted backups are overwritten within 90 days.
- Financial records: kept for up to 7 years, per tax/accounting obligations.
- Accounts suspended for violating the Terms: we retain cryptographic hashes of email/phone/device ID indefinitely, to prevent the same person from re-registering after removal for fraud or harassment.
5. Security
- Data in transit: encrypted via TLS.
- Data at rest: encrypted using Google Cloud's standards (AES-256).
- Anti-capture: the app blocks native screenshots and screen recording in the sections that require it. We cannot technically prevent capture via jailbroken/rooted devices, modified apps, or an external camera photographing the screen — you share private content under that inherent risk.
- Servers located in the United States. For users in the European Economic Area or the UK, we apply Standard Contractual Clauses for international transfers.
- Breach notification: if a security incident compromises your personal data in a manner requiring notice under applicable law, we will notify you and, where required, the relevant regulator, without undue delay and consistent with the timelines applicable law requires.
6. Your Rights
Depending on your jurisdiction, this may include rights under the GDPR, the CCPA/CPRA, and other applicable U.S. state privacy laws (including but not limited to Virginia, Colorado, Connecticut, and Nevada). You may have the right to:
- Request a copy of the data we hold about you.
- Request deletion of your account and data (subject to the security exceptions in Section 4).
- Correct inaccurate information.
- Withdraw your consent for sensitive data at any time, from the app's Settings.
- Not be discriminated against for exercising these rights.
Invisible Mode: instead of deleting your account, you can pause it — it is removed from public matching algorithms while your history is retained.
To exercise these rights, write to: support@velvetusclub.com. We will respond within 30 days.
7. Children's Privacy
Velvet is strictly restricted to individuals 18 years of age or older. We deploy age-verification mechanisms to enforce this. If we discover data belonging to a minor, it is deleted immediately and irreversibly.
8. Changes
We may update this Policy. Material changes will be communicated via an in-app notification before they take effect. Continued use of the Service after a modification constitutes your acceptance.
Velvet US LLC
Legal & Compliance Department
Email: support@velvetusclub.com