Privacy notice

Who is responsible

Velvet Society is the controller for the personal data described here. If you want to exercise any of the rights below, or you are unhappy with how we have handled your data, use the contact page.

You can also complain to the Information Commissioner’s Office, the UK supervisory authority, at ico.org.uk.

What we hold about advertisers

Your account details: email address, and the password you set, stored only as a hash we cannot reverse.

Your listing: everything you chose to publish, including photographs, and the contact details you asked us to show.

Your identity documents and verification photograph. These are held in private storage, are never published, are visible only to the moderators who review them, and are deleted once verification is decided.

Your location as a postcode DISTRICT only — the outward part, such as SW1. We never store your full postcode, and it appears in no page, no address bar and no email.

Your payment history: what you bought, when, and how much. Never your card details, which stay with the payment provider.

What we hold about readers

If you browse without an account, we hold analytics events describing which pages were read and which links were followed — and only if you consented to analytics.

Those events carry no name, no account and no IP address. Visitors are counted using a hash of the IP address and browser, salted with a value derived from the date and never written down, so the salt and the hash never exist together and yesterday’s cannot be reconstructed.

We store a normalised page path, never the full address and never the query string, because a query string on this site can carry a postcode. The search box has no term recorded against it at all, for the same reason.

Why we hold it, and on what basis

To provide the service you asked for — your account, your listing, your subscription: performance of our contract with you.

To verify identity and moderate what is published: our legal obligations, and our legitimate interest in running a platform that is not used to harm people.

To show an advertiser how their listing performed: our legitimate interest in giving people evidence of what they paid for.

For analytics that are not strictly necessary: your consent, which you may withdraw at any time without affecting anything done before you withdrew it.

Cookies and similar technology

We use cookies for sign-in, account security and your privacy choices. Your analytics choice is stored for up to 180 days. The language selector explains how long your chosen language is remembered.

Open Cookie preferences in the footer to accept, reject or change optional analytics. Optional page and interaction measurement stays off until you accept. Withdrawal stops future optional collection and discards pending optional events in your browser.

Limited operational counts for contact reveals, registration steps and campaign arrivals are separate from optional browsing analytics and use the legitimate interests described above. Declining optional analytics does not switch off the account, security or service operations you request.

Browser storage remembers adult acknowledgement and synchronizes privacy changes between tabs. A pending registration email may be stored temporarily in this tab to complete verification and is removed after successful verification. Browser settings let you clear this storage.

How long we keep it

Your account and listing: while your account exists. Delete your account and the listing goes with it.

Identity documents: deleted once verification is decided — they are not kept as a record of the decision.

Analytics events: 365 days, then deleted automatically.

How you first arrived at the site: 180 days, then anonymised automatically and permanently.

Payment and order records: kept for as long as tax and accounting law requires, currently six years, then deleted.

Who we share it with

Our hosting, database and email providers, who process it on our instructions and may not use it for anything else. Our payment provider, who is a controller in their own right for the payment itself.

We do not sell personal data, and we do not share it for anyone else’s advertising.

We will disclose data where we are legally required to, or where it is necessary to protect someone from harm.

Your rights

You may ask for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, and ask for it in a portable form. Where we rely on consent you may withdraw it; where we rely on legitimate interests you may object.

You can export your data and delete your account from your dashboard without asking us. Deleting your account removes your listing immediately and your personal data within 30 days, except where we must keep a payment record.

We answer requests within one month.

Where your data is

Our infrastructure is in the United Kingdom and the European Economic Area. Where a provider processes data outside those, it is under terms that give it equivalent protection.