Privacy built for discreet first contact.

Controller and contact

Velvora is the brand operating this website and creator-management enquiry service from Poland. For personal-data matters, contact hello@velvora.pl or @hellovelvora on Telegram. Velvora acts as controller for information submitted through this website and for direct enquiries it receives.

The full legal name, registered address, tax details and contracting contact of the entity that will manage an accepted model are provided before onboarding and repeated in the management agreement. Those details must be added to this public notice when the operating entity is formally confirmed. No data protection officer has been appointed because the current scale and processing activities do not require one; privacy requests remain available through the contacts above.

Data we collect

You may browse without giving us your name. The private application collects your preferred reply method, Telegram handle or email address, optional OnlyFans or social link, current stage and optional goals. The form does not request a legal name, identity document, password, payment information or explicit content.

When you visit, hosting and security systems may process IP address, time, requested URL, browser and device information, response status and abuse-prevention signals. The 18+ gate stores only whether that browser selected allowed or denied. If you contact us directly through Telegram or email, we receive the account information and message content you choose to send.

If both sides decide to proceed, a separate onboarding process may collect legal identity, proof of age, contract details, payout and accounting information, approved content boundaries, platform access records and information necessary to deliver the agreed service. We provide additional information before materially different onboarding processing begins.

• Do not submit passwords, identity documents, home addresses or payment-card data through the public form.
• Do not send intimate content through the public form or an unsolicited direct message.
• Provide only information that concerns you or that you are authorised to share.

Purposes and legal bases

We use application data to deliver your message, reply through your chosen channel, assess whether our services may be suitable, prevent duplicate or abusive submissions, arrange a conversation and prepare a proposal you request. The main GDPR bases are steps taken at your request before a possible contract and Velvora’s legitimate interests in operating a secure, selective intake process.

If you enter a management relationship, processing may be necessary to perform the agreement, comply with Polish tax, accounting and legal obligations, protect accounts and confidential information, enforce or defend legal claims, and maintain platform compliance. We do not use an application for unrelated direct marketing unless you separately request or consent to it.

Adult-creator work can reveal sensitive information, including information concerning sex life, health or biometric identity. Velvora does not infer or process such information merely because someone makes an enquiry. Where special-category data becomes genuinely necessary, we identify a valid Article 9 GDPR condition—such as explicit consent or legal-claims necessity—and apply additional access controls before processing it.

Application delivery and other recipients

Website applications are sent by Velvora’s server through two independent delivery channels: to a private Telegram chat through the Telegram Bot API and to Velvora’s application inbox through Resend. Telegram and Resend therefore process the application content to deliver these notifications under their applicable terms, privacy documentation and data-processing arrangements. Choosing Telegram for a reply may also reveal your Telegram profile information according to your Telegram settings.

Authorised Velvora personnel receive application data on a need-to-know basis. Depending on the service stage, recipients may also include website hosting and security providers, email and communications services, accountants, lawyers, e-signature providers and carefully selected operational contractors. They receive only the data needed for their function and are subject to confidentiality and data-protection duties where required.

We do not sell applicant data, publish applications, or disclose an applicant’s identity to other models. We may disclose limited information where required by a binding legal obligation or where reasonably necessary to protect a person, account or legal right.

International transfers

Some communications, hosting or collaboration providers, including Telegram and Resend, may process information outside Poland or the European Economic Area. Where Chapter V GDPR applies, Velvora relies on an applicable adequacy decision, approved Standard Contractual Clauses or another lawful transfer mechanism, together with proportionate technical and organisational safeguards.

No transfer mechanism removes every practical risk. Applicants who prefer not to use the public form may contact hello@velvora.pl directly, although email delivery still involves the relevant email providers. You may ask for more information about the safeguards relevant to your data.

Retention

Applications that do not proceed are normally retained for up to 12 months after the last meaningful contact so we can manage follow-ups, document consent and boundaries, prevent abuse and respond to disputes. We may delete them earlier when they are no longer needed, or retain limited evidence longer where a concrete legal claim, safety incident or legal duty requires it.

For accepted models, contractual, accounting and tax records are retained for the periods required by Polish law. Operational data is reviewed during offboarding and returned, deleted or restricted according to the agreement, legal duties and documented backup cycles. The age-gate cookie lasts for up to 12 months, while its local-storage backup remains until the user clears the site’s browser data.

Your GDPR rights

Subject to the GDPR conditions and exceptions, you may request access, a copy, correction, deletion, restriction, portability or objection. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing. You also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects; Velvora does not make intake decisions in that way.

Send a request to hello@velvora.pl. An alias may be used to begin, but we may need proportionate evidence that you control the relevant contact channel before disclosing or changing data. We normally respond within one month and will explain any lawful extension or refusal.

You may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO) in Poland, or with the competent supervisory authority where you live or work in the EEA. UODO publishes complaint instructions at uodo.gov.pl.

Security and confidentiality

Velvora uses role-based access, confidentiality commitments, separated work accounts, multi-factor authentication where available, protected credentials, controlled onboarding and offboarding, and incident escalation. The public form deliberately minimises identity data and does not request explicit media.

No internet transmission or service is perfectly secure. If an incident creates a risk to individuals, Velvora assesses containment, notification and regulatory duties under Articles 33 and 34 GDPR and communicates practical protective steps where required.

Adults only

The website and services are intended only for people aged 18 or older. The age gate is a declaration, not identity verification. No legal identity is required for a first conversation, but secure age and identity verification may be required before account access, content operations or a management agreement begins.

If we reasonably believe a visitor or applicant is under 18, access and processing stop. Relevant information is isolated and deleted unless limited preservation or reporting is legally required to protect a child or investigate suspected unlawful conduct.

Changes and language

We update this notice when the application flow, providers, processing purposes or legal requirements materially change. The effective date and version identify the current text. Material changes affecting existing applicants or models will be communicated through an appropriate channel where required.

This English version is the primary website notice. A translated version may be supplied for convenience; mandatory law and the signed agreement govern if a translation creates ambiguity.