1. Introduction
Vlvet ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and mobile application (collectively, the "Platform"). By using the Platform, you consent to the practices described in this policy.
2. Information We Collect
We collect the following types of information:
- Account Information: Name, email address, username, profile photo, bio, and role (creator or business) provided during registration.
- Payment Information: Payment details processed through Stripe Connect, including bank account information for payouts. Vlvet does not directly store your full payment credentials.
- Content & Submissions: TikTok video links, campaign submissions, messages, comments, and other content you provide on the Platform.
- TikTok Account Data: When you connect your TikTok account, we access your TikTok profile information (display name, username, avatar, and bio) via TikTok's Login Kit. We also access your TikTok video list (titles, thumbnails, share URLs, view counts, and durations) and video statistics (views, likes, comments, and shares) via TikTok's Display API to track campaign performance and calculate payouts. If you use the "Post to TikTok" feature, we use TikTok's Content Posting API to publish video content to your TikTok account on your behalf.
- Usage Data: Information about how you interact with the Platform, including feed interactions (views, likes, shares, skips), pages visited, features used, and device information.
- Device Information: Device type, operating system, browser type, IP address, and unique device identifiers.
3. How We Use Your Information
We use your information to:
- Provide, operate, and improve the Platform
- Process payments, escrow, and milestone-based payouts
- Personalize your feed experience based on niche preferences and interactions
- Facilitate communication between creators and businesses
- Send notifications about campaign updates, milestones, and messages
- Enforce our Terms of Service and prevent fraud or abuse
- Comply with legal obligations
4. Third-Party Services
We integrate with the following third-party services:
- Supabase: Provides authentication, database, and storage services. Your data is stored securely on Supabase infrastructure.
- Stripe Connect: Handles payment processing, escrow, and payouts. Stripe collects and processes payment information under its own privacy policy.
- TikTok: We integrate with TikTok's APIs (Login Kit, Display API, and Content Posting API) to provide core Platform functionality. When you connect your TikTok account, we store your TikTok access and refresh tokens securely on our servers to maintain your connection. We access your TikTok profile data, video list, and video statistics to track campaign performance and calculate CPM-based payouts. If you opt in to Spark Codes, businesses may use your content for TikTok advertising. TikTok's data practices are governed by TikTok's Privacy Policy.
We encourage you to review the privacy policies of these third-party services.
5. TikTok Data & Revocation
When you connect your TikTok account to Vlvet, we access and store the following data from TikTok:
- Your TikTok profile information (display name, username, and avatar URL)
- Your TikTok video list (titles, thumbnails, share URLs, view counts, and durations)
- Video statistics for submitted content (views, likes, comments, and shares) — used to calculate campaign payouts
- Authentication tokens (access token and refresh token) to maintain your TikTok connection
Revoking TikTok Access: You can disconnect your TikTok account at any time from the Settings page in the app or on the website. When you disconnect, we immediately revoke your TikTok access token with TikTok's servers and delete all stored TikTok tokens and account data from our database. Your TikTok profile information (display name, avatar) that was synced to your Vlvet profile will remain unless you update it manually.
If you delete your Vlvet account entirely, all TikTok data including tokens, profile data, and associated records are permanently deleted, and your TikTok access token is revoked.
6. Cookies & Tracking
We use cookies and similar technologies to maintain your session, remember preferences, and analyze Platform usage. Essential cookies are required for the Platform to function. You can manage cookie preferences through your browser settings, though disabling cookies may affect your experience.
7. Data Sharing
We do not sell your personal information. We may share information in the following circumstances:
- With other users as part of normal Platform functionality (e.g., your public profile, submissions, and campaign activity)
- With third-party service providers who help us operate the Platform
- When required by law, legal process, or government request
- To protect the rights, safety, or property of Vlvet, our users, or the public
- In connection with a merger, acquisition, or sale of assets
8. Data Retention
We retain your information for as long as your account is active or as needed to provide services. When you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required by law or for legitimate business purposes (e.g., financial records, dispute resolution).
9. Data Security
We implement appropriate technical and organizational measures to protect your information, including encryption in transit and at rest, Row Level Security (RLS) on our database, and secure authentication practices. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.
10. Your Rights
Depending on your jurisdiction, you may have the following rights:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your personal data
- Object to or restrict certain processing of your data
- Request data portability
- Withdraw consent where processing is based on consent
To exercise these rights, please contact us at privacy@vlvet.app.
11. Children's Privacy
The Platform is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If we learn that we have collected information from a user under 18, we will take steps to delete that information promptly.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Platform and updating the effective date. Your continued use of the Platform after changes constitutes acceptance of the updated policy.
13. Contact Us
If you have questions or concerns about this Privacy Policy, please contact us at privacy@vlvet.app.