Privacy notice

Who handles the data

Data controller for the site veylyn.com and for creator accounts: —, —, email —. For any question or request about data, write to this address.

For the statistics of a creator’s page (entries and taps), Veylyn and the creator are joint controllers: what this means is below.

For the emails fans leave on a creator’s page, the controller is the creator; Veylyn keeps them on her behalf as a processor.

Creators’ data

Account: email and password (stored only as a bcrypt hash, never in clear). If you sign in with Google we receive your Google id, your verified email and your name; we don’t receive your Google password or your contacts. We also store the date of your last sign-in and the date you accepted the terms and declared you are 18.

Page: name, line, photo, images, buttons with their addresses, codes, colors and settings. You enter them and they are shown only to people who type a valid code.

Payments: if you upgrade to Plus or Pro, payment happens on Stripe. Card data is handled by Stripe; we keep the customer id, the plan, the subscription status, the renewal date and any withdrawal.

Only email and password, or Google sign-in, are required: without them we can’t create the account. Everything else is your choice.

Page statistics

When a fan enters a page with a valid code we store: the date and time, which code was used and the country, only if the network or CDN sends it in a request header (we don’t look the country up from the IP address). When they tap a button we store which button and when.

Only if you accept statistics (the question appears on the page, with equal “Accept” and “Decline”), we add to the entry the kind of device (phone, tablet, computer) and a random identifier kept in a cookie on your device (veylyn_vid, 13 months), stored on our side only hashed: it is used to count unique visitors. We don’t use fingerprinting and don’t store the IP address. If you decline, the entry stays just date, code and country, and you see the page all the same. You can change your mind from the “Statistics” link at the bottom of the page; the choice lasts 6 months.

The creator sees only aggregated numbers, and small numbers are grouped so a single fan can’t be singled out: countries with fewer than 5 entries are shown together as “other”, the hours chart only appears from 20 entries and devices only from 20 entries of fans who accepted. The creator’s own visits to her page don’t count.

Entries and taps are deleted after 90 days.

Why this way: some pages may belong to adult-content creators, and the mere fact of opening a page could hint at the interests of whoever opens it. That’s why there is no IP, device and identifier only with your explicit consent, aggregated numbers, and 90 days.

Joint controllership of the statistics

This is the essence of the arrangement between Veylyn and each creator (art. 26 GDPR). Veylyn decides how statistics data is collected and kept, and takes care of its security and of this notice. The creator receives only the aggregated numbers described above and agrees not to try to single out people.

To exercise your rights over this data write to Veylyn (—); if you write to the creator, she forwards the request to us.

Fan emails

If the creator turns the form on, you can leave her your email. The form is optional and asks for explicit consent: “I explicitly agree that <creator’s name> may email me. I know signing up may reveal my interest in their content.”

After you sign up we send you a confirmation email: only if you confirm does the address reach the creator. We store the email, the time of consent, the consent text and its version, and the time of confirmation. Unconfirmed sign-ups are deleted after 7 days.

For these emails the controller is the creator and Veylyn is her processor. The creator must put an unsubscribe link in every email and use them only for what you agreed to. You can ask the creator, or us, to delete your email, and withdraw consent at any time.

Waitlist

Veylyn is being tested with a small number of creators and sign-ups aren’t open yet. If you leave your email on the waitlist on the creators’ page, we keep the email, the language, the time and the consent wording you accepted.

We use it only to write to you when Veylyn opens, once, based on your consent (art. 6(1)(a) GDPR). We don’t give it to anyone and don’t use it for advertising.

We delete it after the launch email, and in any case within 12 months. You can ask us to delete it sooner, any time, by writing to —: withdrawing consent costs nothing.

Reports

If you report a page we store the reason, your explanation, the good-faith statement and, if you leave them, your name and email (used only to reply to you). We also store the decision taken and the reasons for it.

Security

To limit wrong attempts (code, sign-in, sign-up, password reset) we count attempts per IP address and, for sign-in and reset, per email. In the counter IP and email are stored only as a hash with a secret key, never in clear. Each counter expires within an hour and is deleted in the hours after.

Before saving the photos you upload we remove the data the phone writes into the file (GPS position, model, date).

The provider hosting the site may keep the technical logs of requests, with the IP address, for a short time, for security and to fix faults.

Why, and on what basis

Account, page and payments: to provide the service you ask for (contract). Invoices and payment records: legal obligation.

Page statistics: for entries (date, code, country) the creator’s legitimate interest in knowing how many people open her page, and ours in providing it; for device and unique visitors your consent (art. 6(1)(a) GDPR and art. 122 of the Italian Privacy Code), which you can withdraw at any time.

Security, attempt limits and the administrator log: legitimate interest in protecting the service and the accounts.

Fan emails: consent, which can be withdrawn at any time.

Reports and moderation: legal obligation (Regulation (EU) 2022/2065, the “DSA”) and legitimate interest in keeping the service safe.

Who else sees the data

These providers process data on our behalf: Vercel, hosting the site, and Turso, hosting the database (named on the Legal notes page); Stripe, for payments; Google, only if you choose to sign in with Google; Resend, for password reset and fan confirmation emails.

Some of them may process data outside the European Union, in the United States. The transfer relies on the safeguards of the GDPR: the adequacy decision on the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

If a creator puts a video or a song on her page (YouTube, Vimeo, Spotify, SoundCloud), the player is loaded by that service, which receives the request’s technical data under its own rules. We don’t sell data and don’t use it for advertising.

Who at Veylyn can see the data

Only the service’s administrator, from an area protected by a password, Google sign-in and a second factor (a code that changes every 30 seconds). It is opened only when needed: support you ask for, a report, account security, a request of yours about your data, or a legal obligation.

Every look at an account and every action (suspension, code change, export, deletion) is logged with the date, the reason and the administrator’s IP address. The log is kept 24 months, then deleted. The emails fans leave with creators are not shown to the administrator: only how many there are.

How long

Account, page, codes and images: as long as the account exists. Entries and taps: 90 days. Confirmed fan emails: until the creator deletes them or the account. Unconfirmed sign-ups: 7 days. Password reset links: one hour. Attempt counters: one hour at most. Administrator log: 24 months. Reports and moderation decisions: 24 months. Invoices and payment records: as long as tax law requires (10 years), kept by Stripe and by us.

From the creator area you can download all your data in one file and delete the account: we delete the page, codes, numbers, fan emails and images at once, and close any subscription.

No automated decisions

We make no decisions based solely on automated processing and we don’t profile creators or fans. Decisions on reports, too, are made by a person.

If something goes wrong

When a personal data breach requires it, we notify the Italian data protection authority (Garante per la protezione dei dati personali) within 72 hours of becoming aware of it, and tell the people concerned when the risk to them is high.

Your rights

You can ask for access, correction, deletion, restriction, portability, object to processing based on legitimate interest and withdraw consent at any time, by writing to —. We reply within one month.

You can also complain to the Garante per la protezione dei dati personali (garanteprivacy.it) or to the authority of the country where you live.

Cookies

Technical cookies only. The full list, with durations, is on the Cookies page.

Minors

The service is for adults: accounts of minors are closed. Pages may lead to adult content only behind the 18+ confirmation.