Privacy Policy

This policy explains what Velivow collects, why we collect it, how long we keep it, and the choices available to you. It applies to the Velivow website and related services. It does not cover third-party sites linked from the service.

Where Velivow is available

Velivow is offered only in the service regions shown at registration and in the service-region settings. The current list is the United States, United Kingdom, Canada, Australia, New Zealand and Singapore. The service region is self-declared, checked by the server, and is separate from the country shown on your public profile. Your profile country is a display and discovery field; it does not grant access to a service region. Public information pages may be accessible from other countries, but registration, matching, chat and payments are limited to open service regions.

1. Data we collect

Account data

Email address, password hash, email verification status, birth date, gender category, preferences, country and city (subject to your visibility setting), and account timestamps. Passwords are stored as salted scrypt hashes, never in plain text.

Profile and content data

Name or nickname, photos, occupation, education, interests, relationship goals, optional lifestyle fields, written introduction, languages, private impressions, chat messages, voice recordings, reactions and reports.

Payment and order data

When you buy a membership or bundle, our merchant of record processes the payment. We receive an order record, payment status, amount and currency, product or tier, country/region metadata supplied for pricing, refund status and limited provider identifiers. We do not receive or store full card numbers, CVV codes or bank credentials. All prices are in USD and fixed-term; there is no automatic renewal.

Usage and safety data

Session records, IP address and user-agent for security, rate-limit counters, profile visits in aggregate, moderation records, audit logs, order and credit ledgers, and email delivery records. Photo metadata is stripped when images are processed. Original filenames are not stored.

Cookies

We set one cookie for the service itself, which keeps you signed in, plus a gateway cookie while the service runs as a private preview. We do not use analytics, advertising, or third-party tracking cookies, so nothing non-essential is loaded and no consent banner is shown. Each cookie, its lifetime, and how to remove it are listed on the Cookies page.

2. Why we use it

• To create and secure accounts, verify email, and authenticate sessions.
• To operate discovery, preferences, matching, private impressions, chat, masked chat and reveals.
• To calculate privacy-thresholded aggregate statistics, never to publish individual ratings.
• To administer memberships, points, orders and entitlements, to process payments/refunds and to prevent fraud or duplicate awards.
• To meet tax, accounting, consumer-protection and lawful-request obligations.
• To investigate reports, enforce community rules, and maintain audit trails.
• To send transactional email and, where permitted, important service notices.
• To understand basic operational performance without building advertising profiles.

3. Legal bases (where GDPR-style rules apply)

We rely on performance of a contract for account and core service functionality; legitimate interests for security, fraud prevention and service improvement; consent for optional features where required; and legal obligation for financial, safety and lawful-request records. Refusing optional marketing does not affect dating access. Withdrawing dating preference processing pauses dating interactions; account, billing and privacy support remain available.

You can review separate choices for dating preferences and optional marketing in Privacy choices. Pausing matching hides your profile and stops new dating interactions. It does not automatically cancel a membership or erase existing shared messages. Choice versions and changes are recorded. Requests for access, correction or deletion can be submitted through support, including when you cannot sign in.

4. What other users can see

Your public profile, photos, approximate location according to your setting, interests and aggregate statistics that meet minimum thresholds. Your email is never shown to other users. Individual numeric scores become visible only through the documented chat unlock or an approved viewing request. Tags, written reasons and anonymous rater identities are never included in those reveals. Special Likes reveal the sender's identity but never their scores.

If you use masked chat, other participants see only a temporary alias until both of you agree to reveal. Public aggregate statistics may be shown at thresholds described in the product.

5. Sharing and processors

We do not sell personal data. We use service providers acting on our instructions, including:

• Cloudflare for hosting, network security, private object storage and access control.
• Waffo as merchant of record for checkout, payment status, refunds and related tax administration.
• Our configured email provider for verification, password-reset, receipt and support email.
• Human moderators and support staff who access only what is needed to review a report or request.
• Authorities where required by law or necessary to protect users.

We do not use advertising, analytics or data-broker providers. Some providers process data outside your country. Before commercial launch, we will publish the current subprocessor register and the transfer safeguards used for each provider. Copies of the relevant safeguards can be requested through the privacy contact. The current list is on the Subprocessors page.

6. Retention

Account and profile data is kept while your account is active. After deletion, profile fields and media are removed, received ratings are deleted, and ratings you gave may remain de-identified in aggregate statistics. Messages remain in the other participant's history attributed to "Deleted User". Order and tax records, moderation records and report evidence may be retained for the period required by law or legitimate safety needs. Unresolved support, billing, privacy and safety cases are not deleted merely because an account closes. Ordinary resolved support cases can be removed under the configured retention schedule; holds prevent automatic removal. Failed file deletions are queued for retry. Sessions expire after 30 days or on logout. Verification tokens expire after 24 hours; password reset tokens after one hour.

7. Your choices and rights

You can edit your profile, hide your gender label, control location display, hide your member badge, enable incognito (Plus/Pro), disable your invite link and disable public sharing. You can block users and submit reports. Depending on your region, you may request access, correction, deletion, restriction, portability, or object to processing. Use the support page; we may need to verify your identity. You can complain to your local data-protection authority.

8. Security

We use server-side authorization, hashed session tokens in HTTP-only cookies, scrypt password hashing, rate limiting, origin checks, upload validation and private media routes. No system is perfectly secure. If you discover a vulnerability, report it privately through support rather than exploiting it.

9. Children

Velivow is strictly for people aged 18 and over. We do not knowingly collect data from minors. If we learn that a minor has created an account, we will remove it and associated data, subject to legal retention requirements.

10. International transfers and changes

Velivow uses global infrastructure and a merchant of record, so personal data may be processed outside your country. Where required, transfers rely on approved contractual safeguards or another lawful mechanism, and the current provider list is maintained in our subprocessor register. We will post material policy changes in the service and update the date above. If a change materially affects your rights, we will provide additional notice where required.

11. Contact and complaints

Privacy questions and deletion requests can be sent through the support page or the privacy contact shown with the operator details above. We may need to verify your identity before acting. If you are not satisfied with our response, you can complain to your local data-protection authority or the consumer authority in your region.