Privacy Policy

1. Controller and contact details

The controller responsible for the processing of personal data described in this Privacy Policy is:

Bitsilk, Lda.
Rua das Pretas N 43, 2.º Andar, Sala 5
9000-049 Funchal, Portugal
Email: hello@velvet-people.com
Website: https://velvet-people.com

In this Privacy Policy, "Bitsilk", "Velvet People", "we", "us" and "our" refer to Bitsilk, Lda. You may use the email address above for privacy requests and questions.

2. Scope and applicable law

This Privacy Policy applies to the website velvet-people.com and to personal data collected through its contact form, creator application form, photo and video upload functions, cookie-consent interface, and direct interactions with social-media profiles linked from the website.

It is intended to provide the information required by Articles 12 to 14 of Regulation (EU) 2016/679 (the "GDPR"), together with applicable Portuguese data-protection and electronic-communications law, including Law No. 58/2019 of 8 August and Law No. 41/2004 of 18 August, as amended.

This policy does not replace a separate privacy notice that may be provided in connection with a creator management agreement, contractual onboarding, identity or age verification, payment processing, or another service introduced after the effective date. Where a more specific notice applies, that notice will supplement this policy.

3. Personal data we process

"Personal data" means information relating to an identified or identifiable natural person. Depending on how you use the website, we may process the following categories:

• Technical and connection data, such as IP address, date and time of access, requested URL, referrer URL, browser type and version, operating system, device information, language settings, response status, and similar server-log information.
• Contact data and communications, such as your name, email address, telephone number if provided, company or professional details, the subject of your request, message content, and subsequent correspondence.
• Creator application data, including contact details, age confirmation, location, professional background, social-media profile names or links, audience or performance information, availability, interests, and application responses.
• Uploaded media and related metadata, including photographs, videos, filenames, file type, file size, upload time, and any personal data visible or audible in the files.
• Consent and preference data, such as the categories accepted or rejected in the cookie banner, the time of the choice, and technical information required to record or demonstrate the choice.
• Security and anti-abuse data generated through Google reCAPTCHA, which may include IP address, browser and device information, interaction and risk signals, and the verification result.
• Social-media interaction data, such as your platform username, public profile information, comments, messages, reactions, and any content you send to or mention in connection with Velvet People.

We do not intentionally collect more personal data than is reasonably necessary for the relevant purpose.

4. Purposes and legal bases

We process personal data only where a lawful basis applies. The principal purposes and legal bases are summarised below.

Where we rely on legitimate interests, we consider the purpose, necessity, and impact on your rights and freedoms. You may object to processing based on legitimate interests as explained below.

5. Website hosting and technical operation

5.1 Hosting by Render

The website is hosted using services provided by Render Services, Inc. The relevant web services and data stores are configured in Render's Frankfurt, Germany region. When the website is accessed, Render and the website application may process technical log data required to deliver content, diagnose errors, detect attacks, and maintain security. Application-level server logs are normally retained for up to 30 days, unless a security incident, operational investigation, legal duty, or legal claim requires a longer period.

5.2 Next.js and React

The website is built with Next.js and React. These are software frameworks used to generate and display the website. Their use does not, by itself, cause visitor personal data to be transmitted to the framework authors.

5.3 Local Google Fonts

Font files are hosted locally on the website infrastructure. The website does not load fonts from the Google Fonts API when a page is displayed. As a result, merely viewing the website does not transmit your IP address or browser data to Google for font delivery.

5.4 GitHub source-code and deployment integration

GitHub is used for source-code hosting, version control, and deployment integration. Website visitor submissions and uploaded creator media are not intended to be stored in the GitHub source-code repository. GitHub may receive account, repository, deployment, build, and technical metadata connected with the operation of the website.

5.5 Resend (transactional email delivery)

When a creator application is submitted through the website form, the application data entered by the applicant — including name, email address, telephone number if provided, social-media handle, location, audience size, and stated goals — is transmitted to Resend, Inc. for delivery to an internal Velvet People inbox. Resend acts as a data processor on behalf of Bitsilk under a data processing agreement.

Resend, Inc. is headquartered in San Francisco, California, United States. Transfers of personal data to Resend are subject to the European Commission's Standard Contractual Clauses or another applicable transfer mechanism. Resend's privacy information is available at resend.com/legal/privacy-policy.

Resend is used solely for transactional delivery of creator application submissions. It is not used for newsletters, marketing campaigns, tracking pixels, or unsolicited communications.

6. Contact form

You may contact us through the website contact form. We process the information entered into the form, together with technical submission data, to receive, assess, answer, and document your enquiry.

If your enquiry concerns a potential contract or asks us to take steps before entering into a contract, the legal basis is Article 6(1)(b) GDPR. For general questions, communications, and relationship management, the legal basis is Article 6(1)(f) GDPR.

Contact enquiries are generally retained for up to three years after the last substantive communication. You may also contact us directly by email if you prefer not to use the form or cannot complete reCAPTCHA.

7. Creator application form and photo/video uploads

7.1 Purpose of the application process

The creator application form enables prospective creators to express interest in working with Velvet People. We process the application information and uploaded materials to assess suitability, communicate with you, organise interviews or follow-up questions, prevent fraudulent applications, and decide whether to enter into a contractual relationship. The legal basis is Article 6(1)(b) GDPR.

7.2 Uploaded photographs, videos and metadata

Photographs and videos are personal data when they identify or can identify a person. We process uploaded media only for the application and related pre-contractual assessment, unless you separately agree to another use. We do not use facial recognition, voice recognition, or other biometric-identification technology on application media.

Media may nevertheless reveal information that qualifies as special-category personal data under Article 9 GDPR. Please avoid including such information unless it is genuinely necessary.

Only upload media that you are legally entitled to share. Do not upload material depicting another person without the necessary permission, unlawful content, identity documents, payment-card information, passwords, or other information that has not been specifically requested.

7.3 Application decisions and retention

Applications are reviewed by authorised personnel. We do not use artificial intelligence to rank applicants or make application decisions, and we do not make decisions producing legal or similarly significant effects solely by automated means.

If an application is unsuccessful or does not proceed, we normally delete or anonymise the application and uploaded media within six months after the process ends. With separate consent, we may retain selected application details for future opportunities for up to 24 months; such consent can be withdrawn at any time.

7.4 Applicants must be adults

The creator application is intended only for persons aged 18 or over. Persons under 18 must not submit an application or upload photos or videos. If we learn that a minor has submitted personal data through the creator application, we will take reasonable steps to delete the data promptly.

8. Google reCAPTCHA

The contact form and creator application form are protected by Google reCAPTCHA to distinguish legitimate users from automated or abusive activity. The service is provided by Google Ireland Limited for users in the European Economic Area.

When reCAPTCHA is loaded or used, Google may process information such as your IP address, browser and device characteristics, referring page, interaction data, cookies or similar identifiers, and signals used to evaluate whether the request is legitimate.

Our purpose and legitimate interest under Article 6(1)(f) GDPR is to protect the website, forms, applicants, and communications against spam, bots, fraud, attacks, and misuse. Use of reCAPTCHA is subject to Google's Privacy Policy and Terms of Service.

9. Cookies and consent management

The website uses a custom cookie banner and preference interface. Cookies are small text files stored on your device; similar technologies may use browser storage, local storage, pixels, scripts, or identifiers.

Strictly necessary technologies may be used without consent where they are required to transmit a communication, provide a service expressly requested by you, maintain security, or remember your privacy choices. Non-essential technologies are blocked until the required consent has been obtained.

You may change or withdraw your consent at any time through the cookie settings link on the website. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

10. Google Analytics (not currently active)

Google Analytics is not currently active on velvet-people.com. The website does not presently use Google Analytics to measure visitor behaviour, set Analytics cookies, create Analytics user identifiers, or transmit Analytics events to Google.

If Google Analytics or another analytics service is introduced, it will be configured so that it does not operate before the required consent is given. The cookie banner and this Privacy Policy will be updated before activation.

11. Social-media links and profiles

11.1 External links

The website contains ordinary links to Velvet People profiles on Instagram, TikTok, X, Reddit, and Threads. The website does not currently use embedded social-media feeds, "like" buttons, tracking pixels, or platform plug-ins that automatically transmit data to those platforms merely because you view a page. When you click a social-media link, your browser connects to the relevant platform, which then processes data under its own privacy policy.

11.2 Interactions with Velvet People on a platform

If you message, mention, follow, comment on, react to, or otherwise interact with a Velvet People social-media profile, we may process your platform username, public profile information, message or comment content, and interaction metadata. The legal basis is Article 6(1)(f) GDPR, or Article 6(1)(b) GDPR where the interaction concerns steps before or performance of a contract.

12. Recipients and categories of disclosure

We disclose personal data only where necessary for the purposes described in this policy, where required by law, or where you have authorised the disclosure. Recipients may include:

• Authorised directors, employees, contractors, or professional advisers of Bitsilk who require access for website operations, application review, communications, compliance, or security.
• Render Services, Inc. and its authorised subprocessors for hosting, infrastructure, logs, storage, backup, support, and security.
• Resend, Inc. as a data processor for transactional email delivery of creator application submissions to our internal inbox.
• Google group companies for reCAPTCHA and associated security processing.
• GitHub, Inc., GitHub B.V., Microsoft group entities, and authorised subprocessors for source-code hosting and deployment services.
• Social-media platform operators when you choose to click a platform link or interact on the relevant platform.
• Courts, regulators, law-enforcement bodies, tax authorities, or public bodies where disclosure is required by law or necessary to establish, exercise, or defend legal claims.
• Potential purchasers, investors, merger partners, or advisers in connection with a proposed corporate transaction, subject to appropriate confidentiality safeguards.

We do not sell or rent personal data. We do not currently disclose website data to a newsletter provider, CRM platform, payment processor, advertising platform, or AI provider.

13. International data transfers

The website services and data stores are configured in Render's Frankfurt region. Nevertheless, some providers are headquartered outside the EEA or use affiliates, support teams, or subprocessors in other countries, including the United States.

Where a transfer is made to a country not recognised by the European Commission as providing an adequate level of protection, we use or require an appropriate transfer mechanism, such as the European Commission's Standard Contractual Clauses or a valid certification under the EU–U.S. Data Privacy Framework. A copy or summary of relevant safeguards may be requested by contacting us.

14. Retention periods

We retain personal data only for as long as necessary for the purpose for which it was collected. The following periods are normal operational rules and may be adjusted where a legal obligation, dispute, security incident, or other documented necessity applies.

15. Data security

We use technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. Measures may include encrypted transmission using HTTPS/TLS, access controls, least-privilege permissions, secure credential and environment-variable management, software updates, logging and monitoring, backup and recovery measures, confidentiality obligations, and controls for upload handling. No internet service can be guaranteed to be completely secure.

16. Your data-protection rights

Subject to the conditions and exceptions in applicable law, you may have the following rights:

• Access — to obtain confirmation whether we process your personal data and receive a copy together with required information about the processing.
• Rectification — to have inaccurate personal data corrected and incomplete data completed.
• Erasure — to request deletion where the data are no longer necessary, consent has been withdrawn and no other basis applies, or processing is unlawful.
• Restriction — to request that processing be limited in circumstances set out in Article 18 GDPR.
• Data portability — to receive personal data you provided in a structured, commonly used and machine-readable format where processing is based on consent or contract and carried out by automated means.
• Objection — to object, on grounds relating to your particular situation, to processing based on legitimate interests.
• Withdrawal of consent — to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
• Complaint and judicial remedy — to lodge a complaint with a supervisory authority and seek a judicial remedy where applicable.

To exercise a right, email hello@velvet-people.com and describe the request. We normally respond within one month. Requests are generally free of charge.

17. Specific right to object

Where we process personal data under Article 6(1)(f) GDPR on the basis of legitimate interests, you have the right to object at any time on grounds relating to your particular situation. If personal data were ever processed for direct marketing, you would have an unconditional right to object to that marketing at any time. The website currently has no newsletter or direct-marketing subscription function.

18. Withdrawal and cookie choices

Where processing is based on consent, you may withdraw consent at any time with effect for the future. For cookie and similar-technology consent, use the cookie settings control on the website. For other consent, email hello@velvet-people.com. Withdrawal may mean that a consent-dependent feature can no longer be provided, but it does not affect general access to the website.

19. Supervisory authority

You have the right to lodge a complaint with a data-protection supervisory authority, in particular in the Member State of your habitual residence, place of work, or the place of the alleged infringement. The supervisory authority for Bitsilk in Portugal is:

Comissão Nacional de Proteção de Dados (CNPD)
Av. D. Carlos I, 134, 1.º
1200-651 Lisboa, Portugal
Telephone: +351 213 928 400
Email: geral@cnpd.pt
www.cnpd.pt

20. Whether providing personal data is mandatory

You are not legally required to provide personal data merely to browse the public website. Technical data necessary to deliver the website are generated automatically when you connect. Required fields in a form must be completed to submit that form and allow us to assess or respond to the request.

Where consent is requested, you may refuse it, but a feature that technically depends on the relevant service may be unavailable; direct email remains available.

21. Automated decision-making and profiling

Bitsilk does not make decisions producing legal effects or similarly significant effects concerning website visitors or creator applicants solely by automated processing. Creator applications are reviewed by authorised persons.

Google reCAPTCHA uses automated risk analysis to assess whether a website interaction is likely to be legitimate or automated. This security assessment is not used by Bitsilk to evaluate a creator's suitability or make decisions producing legal or similarly significant effects. If a legitimate submission is blocked, you may contact us by email.

22. No artificial-intelligence processing

The website does not currently use artificial-intelligence systems to analyse contact messages, assess photographs or videos, rank or score creator applicants, generate application decisions, create behavioural profiles, or train AI models using submitted personal data. If AI processing is introduced in the future, we will assess the legal basis, risks, transparency requirements, and rights involved, and update this Privacy Policy before the processing begins.

23. Services not currently used

For clarity, the website does not currently use a content management system, newsletter service, customer relationship management platform, Stripe, PayPal, HubSpot, Cloudflare, or an AI-processing service. It also does not currently use Google Analytics.

The website does use Resend, Inc. for transactional email delivery of creator application submissions, as described in section 5.5. Resend is used solely to forward completed application forms to an internal inbox; it is not used for newsletters, marketing, or tracking. If any additional services are introduced, this policy and the cookie settings will be updated as required before relevant processing starts.

24. Minors and general website use

The public informational pages may be viewed by general internet users, but the creator application is restricted to adults aged 18 or over. We do not knowingly use the website to solicit personal data from children. A parent or guardian who believes a child has provided personal data may contact us to request appropriate action.

25. Third-party websites and external content

The website may link to third-party websites or services. We do not control their content, security, or privacy practices. A link does not mean that the third party processes data on our behalf. Before providing personal data to another website or platform, review its privacy information and settings.

26. Changes to this Privacy Policy

We may update this Privacy Policy when the website, processing activities, service providers, legal requirements, or supervisory guidance change. The current version will be published on velvet-people.com with an updated effective date. Where a change materially affects existing processing and additional notice or consent is required, we will provide it through an appropriate channel before the change takes effect.

27. Contact for privacy matters

Questions, requests, objections, or concerns about this Privacy Policy or the processing of personal data may be directed to:

Bitsilk, Lda. – Privacy Enquiries
hello@velvet-people.com
Rua das Pretas N 43, 2.º Andar, Sala 5
9000-049 Funchal, Portugal