Privacy policy

This notice explains how we handle the personal data of the people who join the Velvet Frames waitlist on this site or write to us, as required by Article 13 of Regulation (EU) 2016/679 (the "GDPR").

Who is responsible for your data

The data controller is Fabio Bocci, Via del Giglio 61, 55049 Viareggio (LU).

For any question about your data, or to exercise your rights, write to info@velvetframes.com.

What we collect

• What you type in the form: your email address, whether you join as a creator or as a fan, the optional message (for example a link to a channel of yours) and whether you want news and updates. Please leave special categories of data, such as information about your health or sex life, out of the message: we don't need them.
• What we record when you sign up and when you confirm: the date and time, your IP address and your browser (user agent).
• The language of the page you used to sign up, so we can write to you in it.
• Where your visit came from, if you sign up: the campaign parameters of the link you opened (UTM parameters, such as "instagram") and the domain of the referring site (such as google.com), which the form sends along with your data. Of the referring site we record only the domain, never the full address of the page.
• Visit counts: for each visit to the home page we only increase a daily counter for its source (for example "15 visits from instagram today"), with no cookie, no IP address and nothing that could lead back to you or to your signup.
• Browsing data: like any website, the server logs the requests it receives (IP address, page requested, date and time, browser). They keep the site running and protect it.
• If you write to us: your email address and what you write, for example a question or a request about your data.

Joining requires an email address, the choice between creator and fan and the explicit consent described below: without them we can't add you to the list. The message and the consent to news are optional.

Velvet Frames is a platform for adults: the fact that you are on its waitlist could say something about your sex life, which the GDPR protects as a special category of data (Art. 9). That's why we ask for your explicit consent, in the form and again when you confirm your signup.

Why we use it

• To manage your signup: sending you the confirmation email, telling you when the platform opens and, if you join as a creator, contacting you about early access. Legal basis: your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR), which you give in the form and confirm through the link in the email.
• To send you news and updates about the project, only if you ticked the box. Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 130 of the Italian Privacy Code, Legislative Decree 196/2003). Without it, you stay on the list all the same.
• To prove that you signed up and confirmed yourself, and to protect the form from abuse, such as automated signups or signups in someone else's name. That's why we keep the date, IP address and browser of the signup and of the confirmation, also for a while after your signup is deleted, and limit the number of attempts. Legal basis: the obligation to be able to demonstrate consent (Art. 7(1) GDPR), our legitimate interest in protecting the site (Art. 6(1)(f) GDPR) and the defence of our rights in case of disputes (Art. 9(2)(f) GDPR).
• To understand which channels bring signups: the source stored with your signup, under your explicit consent as above, and the visit counts, which hold no personal data, based on our legitimate interest (Art. 6(1)(f) GDPR). We don't build profiles or combine this data with other sources.
• To answer you when you write to us. Legal basis: the obligation to answer requests about your rights (Art. 6(1)(c) and Articles 12 to 22 GDPR) and, for other questions, our legitimate interest in answering you (Art. 6(1)(f) GDPR).

We make no automated decisions about you.

How long we keep it

• Unconfirmed signups: deleted after 30 days.
• Confirmed signups: until the platform launches, and in any case for no longer than 24 months from your signup, or until you ask us to delete them. When the time is up, we delete them automatically.
• When you leave the list, we delete your signup straight away. If you had confirmed it, only the proof of your consent stays, as described below.
• Proof of consent of a deleted signup: when we delete a confirmed signup, because you leave the list, because you ask us or because its time is up, we keep for 5 years only what proves your consent: the date, IP address and browser of the signup and of the confirmation, whether you wanted news, and a hash of your email address computed with a secret key. The hash doesn't reveal the address: it only lets us recognize it if it is given to us again, for example in a complaint. We keep this proof only to defend ourselves in case of disputes (Art. 17(3)(e) and Art. 9(2)(f) GDPR).
• Emails you send us: 12 months from when your request is closed, so we can show that we answered.
• Database backups: those made by Aruba's backup service and the encrypted ones we keep stay in the European Union. Deleted data can remain in a backup for up to 30 days, then it is gone from there too.
• Technical logs: the application's, which may contain an IP or email address when something goes wrong, for 14 days; the web server's, for the time set by Aruba's hosting service.
• Anti-abuse counters (tied to IP and email addresses): 24 hours at most.

Who can see it

• The people on the Velvet Frames team who manage the list, from a password-protected admin panel.
• Aruba S.p.A., which hosts the site and our mailbox and sends the emails from its data centers in Italy, as data processor (Art. 28 GDPR).

We don't sell or share the data with anyone, and we don't use it for anyone else's advertising. The data stays in the European Union. We never tell anyone whether an address is on the list: the form answers the same way even when an address is already there.

The Velvet Frames platform will be run by a company that has not been set up yet. The waitlist will pass neither to it nor to the platform: when the platform opens we tell you, then we delete the list. To use Velvet Frames you will need to sign up on the platform, which will have its own privacy notice.

Cookies

The site uses only technical cookies, which the signup form needs: they don't require your consent. We use no analytics, profiling or advertising cookies, and no third-party content: even the fonts are served by this site.

• velvet-frames-session: links your visits to your session on the server, which remembers the language and the outcome of the form. It lasts 2 hours after the last page you opened.
• XSRF-TOKEN: protects the form from forged submissions by other sites. It lasts 2 hours after the last page you opened.

Your rights

At any time you can ask to access your data, correct it, delete it, restrict its use or receive it in a commonly used format, and you can object to the processing based on our legitimate interest (Articles 15 to 21 GDPR). You can also withdraw your consent, without affecting what we did before: the link to leave the list is at the bottom of the confirmation email and will be in every update email, and in any case you can simply write to us.

To exercise your rights, write to info@velvetframes.com: we reply within one month.

If you believe the processing breaches the GDPR, you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali, or with the supervisory authority of the country where you live or work.

Adults only

Velvet Frames is a platform for adults: to join the waitlist you must be at least 18, and you declare it in the form. If we find out that a signup belongs to a minor, we delete it.

Changes to this notice

When we change this notice, we update the date at the top of the page. If the changes affect how we use data we already hold, we will tell you by email first.