Privacy Policy

1. Information We Collect

We collect personal information in several categories to deliver our digital reading service:

• Account Credentials: When you sign in using Google, Facebook, Apple, or email, we receive your email address, profile name, and unique authentication identifier.
• Payment & Transaction Data: Records of coin packs purchased, subscriptions, dates, transaction amounts, and payment processor transaction IDs. Full credit card numbers are handled exclusively by Apple Pay, Google Pay, PayPal, or card gateways; Velvet never stores full card numbers.
• Usage & Reading Records: Chapters read, reading progress, book bookmarks, unlocked content, search queries, check-in streaks, and library contents stored on your device and synced with your account.
• Device & Technical Logs: IP address, device model, operating system, browser type, referral URLs, language preferences, unique device identifiers, and crash diagnostic logs.
• Cookies & Storage: Local storage and cookie identifiers used to maintain your session, keep reading preferences, and track security events.

2. Purposes of Data Processing

We process your personal information for the following legitimate business purposes:

• Operating and delivering the Velvet reading platform and mobile web experience.
• Syncing your reading progress, bookmarks, coin wallet, and subscription status across devices.
• Processing payments, managing subscriptions, and providing transaction receipts.
• Preventing bot abuse, scraping, payment fraud, and unauthorized content redistribution.
• Delivering customer support and resolving technical issues.
• Evaluating platform performance, optimizing recommendation algorithms, and improving user experience.

3. Legal Bases for Processing (GDPR)

For users residing in the European Economic Area (EEA) and United Kingdom (UK), our legal grounds under the General Data Protection Regulation (GDPR) are:

• Performance of a Contract (Art. 6(1)(b) GDPR): Delivering reading content, syncing balances, processing orders, and providing user support.
• Legitimate Interests (Art. 6(1)(f) GDPR): Securing our platform, preventing scraping and fraud, and analyzing reader engagement to improve our catalog.
• Consent (Art. 6(1)(a) GDPR): Non-essential cookies, marketing notifications, and personalized advertising.
• Legal Obligations (Art. 6(1)(c) GDPR): Fulfilling accounting, tax, financial record-keeping, and legal compliance mandates.

4. Information Sharing & Third Parties

We do not sell your personal data. We share personal information only with trusted categories of third-party recipients:

• Infrastructure & Cloud Providers: Cloud hosting, database, and content delivery networks that host the Velvet application.
• Payment Processors: Apple, Google, PayPal, and merchant card acquirers who execute payment transactions.
• Analytics & Advertising Partners: Analytics partners (such as Google Analytics) and digital advertising networks (such as Google Ads and Meta Pixel) to measure traffic and campaigns.
• Legal & Regulatory Authorities: When required by subpoena, court order, or applicable law to protect our legal rights, users, or public safety.
• Business Transfer: If the operation of Velvet is transferred to another operator, subject to this Privacy Policy.

5. Cookies, Advertising Partners & Opt-Outs

Velvet uses cookies and similar technologies to remember your preferences and deliver relevant ads via partners like Google and Meta.

You can manage or opt out of personalized tracking through the following mechanisms:

• Browser Settings: Configure your browser to reject or delete cookies. Note that disabling essential cookies may impact reading functionality.
• Google Ads Opt-Out: Manage your Google ad personalization preferences at https://adssettings.google.com.
• Meta Ads Opt-Out: Adjust your Facebook and Instagram ad preferences at https://www.facebook.com/adpreferences.
• Industry Opt-Out Portals: Opt out of participating interest-based ad networks via the Digital Advertising Alliance at https://optout.aboutads.info or EDAA at https://www.youronlinechoices.eu.

6. International Data Transfers

Velvet operates globally. Your information may be transferred to and maintained on servers located outside of your state, province, or country, where data protection laws may differ.

When transferring personal data outside the EEA or UK, we implement appropriate safeguards, including European Commission Standard Contractual Clauses (SCCs), to ensure an adequate level of data protection.

7. Data Retention

We retain your personal data for as long as your account remains active or as needed to provide you with the Service.

Transaction and payment history records are retained for statutory periods (typically 5–7 years) to satisfy tax, audit, and financial compliance requirements. Upon account deletion, personal identifiers are permanently removed or irreversibly anonymized.

8. User Rights (GDPR & CCPA/CPRA)

Depending on your jurisdiction, you have specific statutory privacy rights:

• GDPR Rights (EEA/UK): Right to access your data, rectify inaccuracies, request erasure ("right to be forgotten"), restrict processing, request data portability, and object to processing.
• CCPA/CPRA Rights (California): California residents have the right to know what personal data is collected, delete personal data, correct inaccurate data, opt out of the sale or sharing of personal data for cross-context behavioral advertising, and not be discriminated against for exercising privacy rights.
• Exercising Your Rights: You may exercise any of these rights by emailing us at sure@readinnook.com. We will verify your identity and respond within 2 business days.

9. Account Deletion & Marketing Preferences

You have direct control over your account and communications at all times:

• Account Deletion: You can delete your account at any time via Profile > Delete account. This action immediately deletes your personal information and cancels unspent coin balances.
• Marketing Unsubscribe: You can unsubscribe from marketing emails by clicking the "Unsubscribe" link at the bottom of any promotional email.
• Push Notifications: You can disable browser or device push notifications within your device operating system settings.

10. Security Measures

We maintain industry-standard administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, destruction, loss, alteration, or disclosure. Communications with Velvet are encrypted using TLS/SSL technology.

11. Children's Privacy (18+ Policy)

Velvet is strictly intended for individuals who are at least 18 years old. We do not knowingly solicit or collect personal information from children or minors.

If we discover that a user under 18 has registered or provided personal information, we will promptly delete that information and terminate the account. Parents or guardians who believe a minor has accessed Velvet may contact us at sure@readinnook.com.

12. Privacy Policy Updates & Contact

We may periodically update this Privacy Policy to reflect changes in our legal obligations or data practices. We will notify you of material changes by updating the "Last updated" date at the top of this policy.

For questions or privacy inquiries, email sure@readinnook.com.