Privacy notice

Who operates Velvet List

Velvet Media and Analytics is the sole-trader business operating the Velvet List website. Geographic establishment and complaints address: 7 Cherry Tree Place, Bradford, BD2 3FB, United Kingdom.

Privacy contact: privacy@velvetlist.co.uk.

Information we use

• Account identity and contact details supplied through sign-in, plus the local account and provider references needed to operate the account.
• Creators you follow, private lists, reviews, ratings, creator suggestions, creator profile ownership checks, corrections, safety reports and feedback.
• Messages and account preferences, including service notices, alerts for creators you follow and the separate permission you may give to each named creator for in-app promotional offers.
• Creator profile information supplied or approved by the creator, such as platform accounts and links, categories, broad location labels, prices and stated offers, together with verification records and moderation notes.
• Creator suggestions you make (platform, handle, an optional profile link, your account and the dates), and, for suggested creators, outreach and do-not-contact records and any private concierge draft prepared for them.
• Subscription and billing status and the local references needed to manage your paid plan.
• Security, audit and moderation records needed to protect accounts, review reports and maintain the integrity of the service.
• Search filters and query text are processed to return the results you asked for. For reporting, query text is matched against a fixed list of recognised search terms; the words you typed are not stored.

Why we use it

We use account and service information to provide sign-in, lists of creators you follow, search, creator profiles, account support, billing, safety reporting, moderation and audit history. Every public profile is created or approved by the creator. We do not build public profiles from public sources or from another person’s submission. If you are a creator or rights-holder and want a profile fact or image corrected or reviewed, include the profile URL when you contact us.

A creator profile owner’s replies to reviews remain with that public profile and lose their author reference if the account is deleted. Approved profile and review content is visible to site visitors; private account, message, report and moderation information is access-controlled. Creators can see permitted reports for their own profiles, and authorized staff can access moderation and site-wide operational reports.

Creator offers and alerts for creators you follow

Following a creator does not give that creator permission to send you promotional offers. You choose separately for each named creator whether their written promotional messages may appear in your Velvet List inbox. A new creator is not opted in because you follow another creator. You can change each choice in the Following section of your account; these messages are in-app and do not enable email or push messages. We keep the current choice with your account, including the wording version and update time.

Alerts for creators you follow are a separate setting. If you enable them, we may send in-app alerts about changes to creators you follow, such as a price reduction, a free trial or offer, or new gallery photos. Messages and alerts are kept for 12 months unless deleted earlier. A deleted alert may retain only its type, creator and date for up to 7 days to prevent a duplicate; alerts are removed with the account.

Creator suggestions

Signed-in members can suggest a creator by giving a platform, a handle and, optionally, a profile link. We store those details with the account that made the suggestion and the dates. We use them to gauge demand, to contact the creator (see below) and to tell the requesting member if the creator joins. A suggestion never creates a profile. A suggestion that has not led to a creator joining is deleted after 12 months, a suggestion that led to a creator joining is deleted 12 months after that match, suggestions are deleted when you delete your account, and they are included in your account-data export. We rely on legitimate interests (Article 6(1)(f) UK GDPR) for this: we want to invite the creators members ask for, and we keep only what that needs.

Creator outreach and do-not-contact

Once 10 or more members have suggested the same creator, our team may contact that creator manually, by a message on the platform account or at a business email address they have published. The application sends no such message itself. Our message tells the creator how many members asked, not who, and we record whether and when we made contact, with staff notes. We record that we have made contact only once 10 or more members have suggested the creator. An outreach record with no open suggestion left is deleted 12 months after its last update. If a creator asks us not to contact them, we delete the suggestions and the outreach record for them and keep only a hashed platform and handle, so that we do not accept new suggestions for them or contact them again. We rely on legitimate interests for this, and a creator can object by contacting us.

Concierge drafts and invites

Our team may prepare a private concierge draft profile for a creator and send them a one-use invite link, which expires after 30 days. The draft is private and is not public unless the creator accepts it, proves control of a listed platform account, passes the ID check and publishes it. If the creator declines, we delete the draft and its media immediately. A draft whose invite link expires without being accepted is deleted 30 days after the link expires. If the creator accepts and then withdraws the profile before it is published, we delete the draft and its media 30 days after the withdrawal.

Aggregated usage counts

To run and improve the directory and to give creators reports about their profiles and promotions, we keep daily aggregated counts for every visitor: page views by site area, searches and searches with no results, search-result appearances and clicks, profile views (with a mobile or desktop label), outbound link clicks (including which listed link), promotion and featured-placement appearances and clicks, in-app offer opens and link follows (by campaign reference), and the website or shared link that brought a visit to a creator profile. Each count holds only the date, the metric, the relevant public profile, campaign or placement where applicable, and the label being counted. These counts do not use cookies and contain no visitor, account, browser, session, IP address or device identifier. Automated traffic is filtered and request rates are limited; a Cloudflare-provided IP address may be used transiently in memory for that purpose and is not stored with the counts.

Search text is handled the same way. When you search, the query is compared with a fixed list of recognised search terms, such as content categories, common styles and platform names, and only the matching list entries (at most five per search) are counted. The words you typed are not stored. If nothing matches, we only count that a search did not match. Searches containing words that suggest minors, non-consent or image abuse are not counted at all. Free-text search terms collected before this change have been deleted.

Aggregated counts are not linked back to any person, but some daily totals can be small. We do not use them to identify or profile visitors. You can stop this browser being included at any time in Cookie preferences; we also treat a Global Privacy Control signal from your browser as that objection. If your browser sends Global Privacy Control we exclude it unless you choose to include it, which you can change at any time in Cookie preferences.

Optional analytics cookie

With your consent, an optional first-party analytics cookie adds a random browser identifier (kept up to 30 days) and a session identifier (up to 30 minutes). These let us count unique and returning browsers, group activity within a visit, and credit a promotion for profile views and link clicks later in the same visit. The events may include the page area, a mobile or desktop label and the referring website’s host. They are never linked to your account, sold or shared, and are not used for advertising. Site access is the same whether or not you allow it.

You can allow or withdraw this at any time on the entry screen, in your account or in Cookie preferences, including while signed out. Withdrawing deletes this browser’s identified event detail; totals already aggregated remain until their retention period ends.

Providers and external services

Cloudflare hosts the application and provides its database and object-storage services. Clerk provides sign-in. Stripe processes hosted paid-plan checkout and subscription billing. Resend delivers configured account and service emails. Each provider handles information for its role under its own terms and privacy information; this notice does not make claims about provider-side retention or use beyond those roles. Links from creator profiles lead to external platforms whose terms and privacy practices Velvet List does not control.

Public profile and approved review content is available to site visitors. Account, inbox, report and moderation records are restricted to the access needed for the service, profile management, safety and support.

Age assurance for current access gates

Didit is used for the current age gate for unblurred galleries and the age and identity checks required to claim a creator profile. A provider decision may include a date of birth, which the application reads transiently when needed to calculate an age result or evaluate creator-document eligibility. Our local verification records do not store a date of birth, selfie, document image or document number. They do store the account and check purpose, Didit session reference and status, outcome, method and timestamps. Creator document checks may also store the issuing country, document class, eligibility outcome and reason, and the associated workflow and policy version. These records are kept with the account until it is deleted. Didit’s role is limited here to these current gallery and claim gates.

Retention

Identified analytics events (optional cookie only), search impressions and offer engagement are rolled up and deleted after 90 days. Aggregated usage counts are deleted after 25 months. Didit webhook replay-deduplication receipts, containing the session reference, event type, event timestamp and status, are deleted 35 days after receipt. Analytics-choice records and account-free policy acceptance records linked to a random identifier are deleted 13 months after their last update, acceptance or withdrawal. Account-free safety-report details, references, reply addresses and decision details are redacted after 25 months; abuse-prevention report hashes are erased after 24 hours. Age-verification and creator-document records are removed with the account. Creator suggestions, concierge drafts and do-not-contact records follow the periods set out above. If our team declines a creator profile as final, we keep the draft for 30 days so the creator can appeal, then delete the draft, its images and its links; the decision record we keep for moderation does not include the profile content. Optional paid-plan cancellation or founding-period feedback (a reason you pick and an optional comment) is shown to our staff, passed to our payment provider with a cancellation, and has its comment text deleted after 25 months. Account deletion removes follows and account data, revokes claims and requests deletion of the Clerk identity; if Clerk is unavailable, the disabled local account is retried daily. Some trust and moderation integrity records remain on a non-public tombstone, with free text and URLs redacted after 25 months.

Lawful basis and your rights

For data needed to provide an account feature or paid subscription you request, we rely on Article 6(1)(b) UK GDPR (contract), limited to what is necessary for that feature. For specific tax, accounting and data-protection duties, we rely on Article 6(1)(c) (legal obligation). We rely on Article 6(1)(f) (legitimate interests) to operate and secure the directory, prevent abuse, review creator information, invite creators that members ask for, moderate content and safety reports, apply proportionate age and eligibility checks, and keep the aggregated usage counts described above, including recognised search terms. Our interests are to run a useful, safe and reliable creator directory, improve search, give creators accurate reports about their profiles and promotions, and protect users and listed creators. We limit these uses to the information and retention described here and have assessed them against your interests. The optional analytics cookie relies on your consent (Article 6(1)(a) and the Privacy and Electronic Communications Regulations), and you can withdraw it at any time. In-app offers from a named creator rely on the permission you give for that creator. You can object to processing based on legitimate interests by contacting us. You can object to the aggregated usage counts for this browser directly in Cookie preferences.

Some creator material or search text could reveal special-category information, such as sexual orientation or sex life. We do not infer those characteristics about visitors. Search text is never stored: only entries from our fixed list of recognised terms are counted, as daily totals with no visitor, account or browser identifier, so the counts are not linked to anyone. We publish special-category information only where a separate UK GDPR condition applies, such as your explicit consent or information you manifestly made public yourself. We do not rely on your consent for information about another identifiable person, and we do not publish information about a person that they have not created or approved. Safety reports may also contain allegations of offences; we restrict those details to safety and moderation staff and use them only where an applicable UK GDPR Article 10 and Data Protection Act 2018 condition is recorded.

Depending on the law that applies to you, you may have rights to access, correct, erase, restrict or object to the use of your personal information. You can request an account-data export, correct creator-profile information through the relevant workflow, or request account deletion from your account page.

For privacy questions or rights requests, contact the privacy email shown above. For safety, privacy, takedown or appeal concerns about public content, use the account-free safety, takedown and appeal form. Include the profile URL where relevant. You may also complain to the UK Information Commissioner if you believe your data-protection rights have been infringed.