Privacy Policy
Last updated: 30 September 2026
1. Data controller
The controller of your data is Oscar Mandado, owner of the Velvet application ("the App"), Spain.
Contact and exercise of rights: soporte@myvelvetai.com
This policy explains what data we collect, what for, who we share it with and what rights you have. It complies with the General Data Protection Regulation (GDPR) of the EU.
2. Data we collect
Depending on how you use the App, we may process:
- Account data: email address, name or nickname, and sign-in method (Apple, Google or email).
- Date of birth: to verify that you are over 18.
- Content you generate: messages and conversations with the Companions, descriptions, photos you upload and photos or voices generated by the App.
- Usage data: interactions inside the App, preferences, settings, usage statistics and technical device data (model, operating system, identifiers).
- Purchase data: a record of heartbeat purchases and subscriptions (payment is processed by Apple and Google; we neither receive nor store your card details).
3. What we use your data for (purposes and legal basis)
- Providing the service (creating Companions, chatting, generating images and voice): legal basis, performance of the contract.
- Verifying your age and safety (preventing use by minors, moderating content): legal obligation and legitimate interest.
- Managing purchases and subscriptions: performance of the contract.
- Improving and maintaining the App (performance, errors): legitimate interest.
- Showing rewarded ads: only when you choose to watch an ad in order to get heartbeats. The App does not show ads automatically or intrusively. Legal basis: your consent. Where the law requires it (the EEA, the United Kingdom, Switzerland and some US states), the App asks for your choice through Google's consent message, and you can change it at any time in Settings → Privacy → Ad privacy.
4. Sharing with third parties (providers that process your data)
For the App to work, some data is sent to external providers acting as data processors. Each one only processes what is necessary for its function:
| Provider | What for | What it receives |
|---|---|---|
| Anthropic (Claude) | Generating the chat replies | The text of your messages and the context of the conversation |
| Replicate | Generating the images of the Companions | The image descriptions and parameters and, where applicable, reference images |
| OpenAI (Whisper) | Transcribing your voice notes into text | The audio you record |
| ElevenLabs | Generating the voice of the Companions | The text to be converted into speech |
| Google (Firebase) | Accounts, database and storage | Account data, content and usage data |
| RevenueCat | Managing purchases and subscriptions | User identifier and transaction data |
| Apple / Google Play | Processing payments | The payment data (handled by the store) |
| Google AdMob | Showing rewarded ads only when you tap "watch ad", and confirming to our server that the ad was watched to the end, so that your heartbeats are credited | The device advertising identifiers and, to confirm the reward, your account's internal identifier (never your email or your name) |
Some of these providers are located outside the European Economic Area (for example, in the USA). In those cases, the transfers are covered by the appropriate legal safeguards (such as the European Commission's Standard Contractual Clauses).
We do not sell your personal data to third parties.
5. Data retention
We keep your data for as long as your account remains active. If you delete your account or ask us to, we will erase it within a reasonable period, except for data we are required to keep by law (for example, transaction records).
6. Your rights (GDPR)
You have the right to access, rectify, erase, restrict or object to the processing of your data, as well as the right to data portability and to withdraw your consent at any time.
To exercise them, write to us at soporte@myvelvetai.com. You can also delete your account from inside the App. If you believe we have not dealt with your request properly, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) — www.aepd.es.
7. Security
We apply reasonable technical and organisational measures to protect your data (encryption in transit, access control). No system is 100% secure, but we work to keep the risks to a minimum.
8. Minors
Velvet is for adults 18 and over only. We do not knowingly collect data from minors. If we detect an account belonging to a minor, we will delete it together with its data.
9. This website (myvelvetai.com)
This website does NOT use cookies, neither its own nor third party ones, and it uses no analytics, advertising or tracking tools. It does not store anything in your browser and does not build visitor profiles. That is why you will not see a cookie notice: there is nothing to accept or reject.
All the resources of the site (images, styles and fonts) are served from this same domain, so your visit generates no requests to third party servers.
As with any web hosting, our provider (Hostinger) may record technical connection data, such as the IP address, in its server logs, for the sole purpose of maintaining the service and its security. This processing is based on our legitimate interest (art. 6.1.f GDPR).
If you write to us at soporte@myvelvetai.com, we will process the data you provide (your email address and the content of the message) solely in order to answer your enquiry.
If we ever add analytics or advertising, we will ask you beforehand through a consent system, and you will be able to refuse as easily as you accept.
10. Changes to this policy
We may update this Privacy Policy. We will publish the version in force on this page together with its update date.
11. Contact
For any question about privacy or your data: soporte@myvelvetai.com