VELVET Privacy Policy

VELVET ("we", "our", "us") is committed to protecting your privacy and handling your personal information responsibly. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website https://velvet.community (the "Website") and our mobile and web application (the "App").

If you have any questions, please contact our Privacy Contact:

By using VELVET, you acknowledge that you have read and understood this Privacy Policy.

1. Information We Collect

We may collect the following personal information from you when you use VELVET:

• Name
• Email address
• Date of birth or age (to verify eligibility to use the platform)
• Artist/band name, profile information, social media links, and content you upload (such as event submissions or promotional materials)
• Account login details
• Payment information (if applicable, for subscriptions or fees)
• Usage data (such as log-in times, interactions, analytics)

If you have an artist profile, we may also collect your upcoming gigs that are publicly listed on ticketing sites (such as Moshtix and Ticketmaster) and show them on your profile and in our Gig Guide. You can hide a gig on your profile or tell us it isn't yours, and you can ask us to remove any listing by emailing info@velvet.community.

We do not intentionally collect sensitive personal information (such as health data, racial or ethnic origin, political opinions, or criminal history).

If you provide us with information about another person, you confirm that you have their consent to do so.

2. How We Use Your Information

We use your personal information for the following purposes:

• To create and manage your account
• To connect artists, venues, event organisers, and other users on the platform
• To display artist/band profiles publicly on VELVET
• To communicate with you about your account, services, and updates
• To notify you of opportunities, events, and promotional offers
• To improve our Website, App, and services through analytics and feedback
• To comply with legal obligations

Announcements from VELVET are news and offers we email to members who haven't turned them off. A marketing agency helps us write them, but it never sees your name or email address: announcements are sent from VELVET's own email account, and replies come to us. Every announcement has an unsubscribe link, and you can turn them off in Settings, under Notifications.

We will only process your personal data where we have a lawful basis under applicable laws (e.g. your consent, to perform a contract, to comply with legal obligations, or for our legitimate business interests).

3. Disclosure of Personal Information

We may disclose your personal information to:

• Service providers and contractors who help us deliver the Website, App, hosting, analytics, error reporting, communications, and payment processing
• Third parties such as venues, event organisers, or booking agents when you submit to events or connect through VELVET
• Regulatory authorities, law enforcement agencies, or courts where required by law
• A purchaser or successor in the event of a merger, acquisition, or change of control

Some of these parties may be located outside your home country, including in Australia, the United States, the United Kingdom, or the European Union. Where we transfer personal information internationally, we will take reasonable steps to ensure appropriate safeguards are in place (such as the EU Standard Contractual Clauses).

We do not sell your personal information.

4. Data Storage and Security

Your information is securely stored on Supabase/AWS cloud servers. While we take reasonable steps (including encryption, access controls, and secure hosting) to protect your data, no method of transmission or storage is completely secure. You use VELVET at your own risk.

5. Your Rights

Under the Australian Privacy Act:

You have the right to access and correct your personal information.

Under the GDPR (EU/UK):

You have the following rights:

• Access to your personal data
• Correction of inaccurate or incomplete data
• Erasure ("right to be forgotten")
• Restriction of processing
• Data portability
• To object to processing, including marketing
• To withdraw consent (where consent is the legal basis)

Under the CCPA (California, USA):

You have the right to:

• Know what personal information we collect and how it is used
• Request deletion of your personal information
• Opt out of the "sale" of personal data (we do not sell personal data)
• Not be discriminated against for exercising your rights

To exercise your rights, please email info@velvet.community. We may need to verify your identity before fulfilling requests.

6. Cookies, Analytics and Error Reports

VELVET uses cookies, web beacons, and analytics tools (such as Google Analytics) to understand usage patterns and improve services. You can manage cookies through your browser settings. More information about how Google uses data can be found at: www.google.com/policies/privacy/partners.

We also use the Meta Pixel and Meta's Conversions API, from Meta Platforms (the company behind Facebook and Instagram), to measure how our ads perform. The Pixel records the pages you visit on VELVET. When you sign up, we send Meta a scrambled (hashed) copy of your email address and account ID, your IP address and browser details, Meta's own cookie IDs, and whether you joined as an artist or an event organiser, so Meta can count the sign-ups that came from its ads. Meta handles this information under its own privacy policy: www.facebook.com/privacy/policy. You can manage how Meta uses it for ads in your Facebook or Instagram ad settings.

Photos of Ticketmaster gigs in our Gig Guide, including the gig listings on our home page, load straight from Ticketmaster's servers. When a page showing them loads, your browser sends Ticketmaster your IP address and browser details, which Ticketmaster handles under its own privacy policy.

When something on VELVET breaks, a report of the error is sent to Sentry (Functional Software, Inc.) so we can fix it. A report describes the error, the page it happened on, the steps just before it (such as the pages you opened and what you clicked), and the type of browser and device you were using. Reports are stored in the European Union and kept for up to 90 days. We set Sentry up to leave out cookies, sign-in tokens and email addresses, and not to store IP addresses.

7. Children's Privacy

VELVET is not intended for use by individuals under the age of 16. If you are under 16, you must not create an account or use our services. If we discover we have collected data from a child under 16 without parental consent, we will delete it.

8. Third-Party Links

VELVET may include links to third-party websites or services. We are not responsible for the privacy practices of third parties.

9. Retention

We will only retain your personal information for as long as necessary to provide our services and meet legal obligations. When no longer needed, we will securely delete or anonymise your data.

10. Updates to this Policy

We may update this Privacy Policy from time to time. Changes will be effective once posted on our Website. Your continued use of VELVET means you accept the updated policy.

11. Complaints

If you have a concern about how we handle your personal information, please contact us at info@velvet.community. We aim to respond within 10 business days.

If you are not satisfied, you may contact:

• The Office of the Australian Information Commissioner (OAIC) if in Australia
• Your local data protection authority in the EU/UK
• The relevant privacy regulator in your jurisdiction