Privacy Policy

Last updated 26 October 2026.

This policy explains what personal data Muselle Limited, 28 Oktovriou 227, Eden Beach Apartments, Block 4, Office 212, 3035 Limassol, Cyprus ("Velvra", "we") processes when you use myvelvra.com and related services, why, and what rights you have. We are the controller. Contact: support@myvelvra.com.

1. What we collect and why

• Account: your email address, to log you in with a one-time link and to send messages about your account and subscription. Login links are stored only as a cryptographic hash and expire after 20 minutes. Legal basis: contract.
• Subscription and usage: your plan, renewal and cancellation dates, purchased add-ons, and counts of what you have used (number of messages, voice messages, image packs, videos), with our cost for each. We do not store the content of your messages in these records. Legal basis: contract; legal obligation (accounting).
• Your AI companion: her name, chosen personality, language, voice and look, and the images and videos generated for her. These are stored in a private storage bucket and shown to you through links that expire. Legal basis: contract.
• Chat messages: when you chat, your messages and the conversation so far are sent to our AI model provider to generate the reply, and replies you choose to hear are sent to our voice provider. Your chat history is stored only in your own browser, not on our servers. So that your companion remembers you, we keep a short list of facts you have told her in the regular (non-explicit) chat — for example your first name, work or plans — stored with her on our servers; it never includes sexual or health details, and it is deleted when you delete her or your account. Photos you ask her for in the chat are stored with her images. If you have chatted with her recently, she may send you a message first (at most once a day, during the day in your time zone); that message is stored until you open the chat. You can turn this off in the chat, and you only get an email about it if you switch on message notifications on your account page — the email never contains what she wrote. Chats can contain intimate information, including about your sex life. We process it only to give you the replies you ask for, with your explicit consent, which you give by starting a chat and can withdraw by stopping and clearing your history. Legal basis: contract; explicit consent (Art. 9(2)(a) GDPR).
• Age verification (explicit features only): the check is done by Didit. We store only the result (passed or not), the method used, the time and Didit's session reference. We do not store your face image, ID document or name; Didit keeps them under its own privacy policy and our data processing agreement. Legal basis: legal obligation; legitimate interest in keeping minors away from adult content.
• Payments: handled by our payment provider on its own page. We receive the payment status and a reference, never your full card number. Legal basis: contract; legal obligation.
• Waitlist, business enquiries and reports: the email address, name, links and message you send us, and your site language. If you report a chat reply, the reported reply text is stored with the report. Legal basis: consent (waitlist); legitimate interest (enquiries and reports).
• Safety and moderation log: when our filters block a message or an AI reply, discard a generated image, or when an account is suspended, we log the account, the time, what was blocked and the word or reason that triggered it. We never log the whole conversation. Legal basis: legitimate interest and legal obligation (protecting minors, preventing illegal content).
• Technical data: IP address, country, browser and timestamps in our hosting providers' logs, used for security, fraud prevention, to block countries where the service is not offered, to decide whether your country requires age verification and to show the right crisis line. Legal basis: legitimate interest; legal obligation (sanctions).

We do not sell your data, use it for advertising or build marketing profiles. We do not use your chats to train AI models, and our AI providers' terms do not allow them to use your messages for training.

2. Cookies and local storage

We use only cookies that are strictly necessary for the site to work. There are no analytics, advertising or tracking cookies, so we do not ask for cookie consent.

• velvra_vid: keeps you logged in and links your browser to your account (1 year).
• velvra_18: remembers that you confirmed you are 18 or older (1 year).
• velvra_lang: remembers your language.
• velvra_av and velvra_av_pending: record a passed age verification and an age check in progress (1 year and 30 minutes).
• velvra_preview: staff preview access only.
• Local storage in your browser holds your chat history. You can delete it at any time by clearing your browser's site data.

3. Who we share data with

We use these service providers (processors) under data processing agreements:

• Vercel (website hosting)
• Railway (application and database hosting)
• Cloudflare (private file storage, R2)
• RunPod (GPU servers that generate images and video)
• Anthropic (AI model for chat replies)
• ElevenLabs (text-to-speech voices)
• Didit (age verification)
• Resend (sending login emails)
• [Payment provider] (payments, fraud and chargeback checks)

Some of these providers are in the United States or other countries outside the EU/EEA. Transfers are protected by the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. We also disclose data to authorities where the law requires it, for example reports about child sexual abuse material.

4. How long we keep data

• Account and subscription data: for as long as you have an account, then up to 30 days, except what accounting law requires us to keep (usually 7 years).
• Generated images and videos: until you delete your companion or your account.
• Age verification result: for as long as you have an account.
• Waitlist emails: until you unsubscribe or we launch and contact you once.
• Server logs: up to 30 days.
• Moderation log and reports: 12 months. Reports and evidence concerning minors are kept as long as needed for the authorities.

5. Your rights

You can ask us to access, correct, delete or export your data, to restrict or object to processing, and to withdraw consent at any time. Email support@myvelvra.com and we answer within one month. You can also complain to your data protection authority. In Cyprus, this is the Commissioner for Personal Data Protection (dataprotection.gov.cy).

6. Security

Data is encrypted in transit. Files are kept in a private bucket with time-limited links. Access to production systems is restricted and protected by keys. Login links are single-use and short-lived.

7. Children

The service is only for adults aged 18 and over. We do not knowingly collect data from minors. If we learn that an account belongs to a minor, we close it and delete its data.

8. Changes

If we change this policy in a material way, we will notify you by email or on the site before the change applies.