Legal

Privacy Policy

Last updated: April 2026

VELVET is committed to protecting your privacy in accordance with the New Zealand Privacy Act 2020.

1.Who We Are

VELVET is operated by Prompt Engineered Ltd, based in Auckland, New Zealand. Our Privacy Officer can be contacted at noreply@nzvelvet.com.

2.What Information We Collect

For workers: Display name, email address, phone number, password (encrypted), photos, profile information (age, location, physical attributes, services, rates, working hours), and account activity data.

For clients browsing the site: We collect anonymised analytics data including hashed IP addresses for view counting, browser type, and pages visited. We do not require client accounts or collect client personal information.

Cookies: We use a session cookie for age verification and authentication. We do not use tracking cookies, advertising cookies, or share data with advertising networks.

3.How We Use Your Information

To create and display worker profiles on the platform.
To provide worker analytics showing profile view counts.
To send account-related emails such as confirmation and password resets.
To maintain platform security including rate limiting and abuse prevention.
To improve the platform based on aggregated, anonymised usage patterns.

4.How We Store Your Information

Worker profile data and authentication data are stored on Supabase, a hosted database service with servers in the Singapore region. Data is encrypted at rest using AES-256 and in transit using TLS. Photos are stored in Supabase Storage with the same encryption standards. Passwords are hashed and never stored in plain text. We do not store payment information as we do not process payments through the platform.

5.Who We Share Your Information With

We do not sell, rent, or trade personal information to any third party. We do not share data with advertising networks. We use Resend for transactional email delivery. Email addresses are shared with Resend solely for the purpose of delivering account-related emails. We may disclose information if required by law or to protect the safety of our users.

6.Your Rights Under the NZ Privacy Act 2020

You have the right to access your personal information held by VELVET.
You have the right to request correction of inaccurate information.
You have the right to request deletion of your account and associated data.

You can exercise these rights by contacting us at noreply@nzvelvet.com. We will respond within 20 working days as required by the Privacy Act.

7.Data Retention

Worker profiles remain active until the worker deletes their account or requests removal.
Anonymised analytics data such as view counts are retained indefinitely.
Account data is deleted within 30 days of an account deletion request.
Photos are deleted from storage when a profile is removed.

8.Data Breach Notification

In the event of a privacy breach that may cause serious harm, we will notify affected individuals and the NZ Privacy Commissioner as required by the Privacy Act 2020.

9.Children

VELVET is strictly for users aged 18 and over. We do not knowingly collect information from anyone under 18. If we become aware that information has been collected from a minor, it will be deleted immediately.

10.International Data

Your data may be processed in Singapore where our database is hosted and in the United States where our hosting provider Vercel operates. Both services maintain encryption and security standards comparable to those required under NZ law.

11.Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated date. Material changes will be communicated via email where possible.

12.Contact

For privacy enquiries or to exercise your rights, contact our Privacy Officer at noreply@nzvelvet.com.