Privacy Policy

The controller for data processing on Velora (Art. 4 No. 7 GDPR) is:

[Firmenname eintragen] [Rechtsform eintragen][Straße und Hausnummer eintragen][PLZ und Ort eintragen][Land eintragen]

Email for privacy requests: [Datenschutz-E-Mail eintragen]

Data protection officer

[Datenschutzbeauftragte:r — Name und Kontakt eintragen]

We only process personal data insofar as this is necessary to provide Velora and our services. The legal bases are in particular:

• Art. 6 (1) (b) GDPR — contract and pre-contractual measures (e.g. account, purchases, chats),
• Art. 6 (1) (c) GDPR — legal obligations (e.g. retention, proof of age),
• Art. 6 (1) (f) GDPR — legitimate interests (e.g. secure operation, abuse prevention),
• Art. 6 (1) (a) GDPR — consent, where we expressly ask you for it.

As Velora is a platform for adults, the mere use of it may allow conclusions to be drawn about your sex life (special category under Art. 9 GDPR). We treat such data with particular confidentiality and do not pass it on to advertising partners. There is no automated decision-making, including profiling (Art. 22 GDPR).

Our web application is operated by Railway. With every request, the server processes technically necessary data: IP address, date and time, requested address, amount of data transferred, and browser and device type (user agent). This serves secure and stable operation and the defence against attacks (Art. 6 (1) (f) GDPR). Retention period of the logs: [Speicherdauer der Server-Logs eintragen].

• Provider: [Vertragspartner und Anschrift eintragen]
• Server location: [Serverstandort/Region eintragen]
• Transfers to third countries: [Grundlage für Drittlandübermittlung eintragen, z. B. EU-US Data Privacy Framework oder Standardvertragsklauseln — oder „keine“]
• The provider processes the data exclusively on our behalf and according to our instructions (data processing under Art. 28 GDPR).

We store account, profile, content, chat and order data in a database at Neon (Art. 6 (1) (b) GDPR).

• Provider: [Vertragspartner und Anschrift eintragen]
• Server location: [Serverstandort/Region eintragen]
• Transfers to third countries: [Grundlage für Drittlandübermittlung eintragen, z. B. EU-US Data Privacy Framework oder Standardvertragsklauseln — oder „keine“]
• The provider processes the data exclusively on our behalf and according to our instructions (data processing under Art. 28 GDPR).

Uploaded images, videos and verification documents are stored at Cloudflare R2. Non-public files can only be retrieved via signed links with a limited validity.

• Provider: [Vertragspartner und Anschrift eintragen]
• Server location: [Serverstandort/Region eintragen]
• Transfers to third countries: [Grundlage für Drittlandübermittlung eintragen, z. B. EU-US Data Privacy Framework oder Standardvertragsklauseln — oder „keine“]
• The provider processes the data exclusively on our behalf and according to our instructions (data processing under Art. 28 GDPR).

For confirmation and password codes and notices about your account, we use Resend. This involves processing your email address and the content of the message (Art. 6 (1) (b) GDPR).

• Provider: [Vertragspartner und Anschrift eintragen]
• Server location: [Serverstandort/Region eintragen]
• Transfers to third countries: [Grundlage für Drittlandübermittlung eintragen, z. B. EU-US Data Privacy Framework oder Standardvertragsklauseln — oder „keine“]
• The provider processes the data exclusively on our behalf and according to our instructions (data processing under Art. 28 GDPR).

We store messages from the feedback form in our database and also receive them by email via Web3Forms. We process your message, the page you are writing from, your email address for the reply and, if you are signed in, your handle (Art. 6 (1) (f) GDPR). Using the form is voluntary.

• Provider: [Vertragspartner und Anschrift eintragen]
• Server location: [Serverstandort/Region eintragen]
• Transfers to third countries: [Grundlage für Drittlandübermittlung eintragen, z. B. EU-US Data Privacy Framework oder Standardvertragsklauseln — oder „keine“]
• The provider processes the data exclusively on our behalf and according to our instructions (data processing under Art. 28 GDPR).

When you register by email, we process your email address, your password (only as a secure hash, never in plain text), your confirmation that you are at least 18 years old, and the details in your profile. To confirm your address, we send you a code by email (Art. 6 (1) (b) GDPR).

If you open Velora as a Telegram Mini App or via our Telegram bot, Telegram sends us signed login data: your Telegram user ID, your first name and, if applicable, last name, username and language setting. We verify the signature and use it to create your account or sign you in (Art. 6 (1) (b) GDPR). We do not share your Telegram ID with other users. Via the bot, you also receive notifications about your account.

• Provider: [Vertragspartner und Anschrift eintragen]
• Server location: [Serverstandort/Region eintragen]
• Transfers to third countries: [Grundlage für Drittlandübermittlung eintragen, z. B. EU-US Data Privacy Framework oder Standardvertragsklauseln — oder „keine“]
• The provider processes the data under its own responsibility; its own privacy policy also applies.

If you choose “Sign in with Google”, we redirect you to Google. After you give your approval, we receive a Google account ID and your email address including its verification status (Art. 6 (1) (b) GDPR). We never learn your Google password.

• Provider: [Vertragspartner und Anschrift eintragen]
• Server location: [Serverstandort/Region eintragen]
• Transfers to third countries: [Grundlage für Drittlandübermittlung eintragen, z. B. EU-US Data Privacy Framework oder Standardvertragsklauseln — oder „keine“]
• The provider processes the data under its own responsibility; its own privacy policy also applies.

Payments are processed exclusively by external payment service providers. You enter your card, bank or wallet credentials directly with the provider — we neither receive nor store them. We transmit the order number, amount and currency and receive a signed confirmation of the payment status from the provider (Art. 6 (1) (b) and (c) GDPR). For payments in cryptocurrencies, transactions are publicly visible on the respective blockchain.

For orders of physical items, we process your name and delivery address. The address is stored encrypted and used only for shipping (Art. 6 (1) (b) GDPR). With anonymous shipping, the creator does not see your address; the parcel reaches you via Velora. If you expressly choose direct shipping, your address appears on the shipping label that the creator receives.

Anyone who offers content as a creator must prove their identity and that they are of age — for example with an identity document. We store these documents with special protection and only for as long as required by law and documentation obligations (Art. 6 (1) (c) and (f) GDPR). Retention period: [Speicherdauer der Verifizierungsunterlagen eintragen].

We store posts, images, videos and chat messages in order to display them to you and the intended recipients (Art. 6 (1) (b) GDPR). If there are indications of illegal content or abuse, we may review the content concerned (Art. 6 (1) (c) and (f) GDPR).

We use technically necessary cookies without consent (§ 25 (2) no. 2 TDDDG). We only set analytics cookies with your consent, and advertising cookies not at all.

• Session cookie (“xstage_session”): keeps you signed in. It only contains an encrypted, random session ID and is valid until you sign out or the session expires.
• Google sign-in: short-lived security cookies that only exist during sign-in with Google and are deleted afterwards.
• Telegram Mini App: within Telegram, the Telegram SDK and Velora store start parameters or a sign-in marker in your device's session storage (sessionStorage); it is discarded when the session ends.
• Your usage analytics choice: stored in this browser's local storage (localStorage) and valid for a maximum of 9 months.

Usage analytics with Microsoft Clarity (only with consent)

If you are signed in and give your consent, Microsoft Clarity sets cookies and records clicks, page views and session recordings so that we can improve Velora (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). Page content is masked. Without consent, Microsoft Clarity is not loaded. You can change or withdraw your consent at any time with effect for the future in section 14 of the German privacy policy.

• Provider: [Vertragspartner und Anschrift eintragen]
• Server location: [Serverstandort/Region eintragen]
• Transfers to third countries: [Grundlage für Drittlandübermittlung eintragen, z. B. EU-US Data Privacy Framework oder Standardvertragsklauseln — oder „keine“]
• The provider processes the data exclusively on our behalf and according to our instructions (data processing under Art. 28 GDPR).

Audience measurement with Cloudflare Web Analytics

We use Cloudflare Web Analytics for audience measurement. The service does not set cookies and does not store query parameters (Art. 6 (1) (f) GDPR).

• Provider: [Vertragspartner und Anschrift eintragen]
• Server location: [Serverstandort/Region eintragen]
• Transfers to third countries: [Grundlage für Drittlandübermittlung eintragen, z. B. EU-US Data Privacy Framework oder Standardvertragsklauseln — oder „keine“]
• The provider processes the data exclusively on our behalf and according to our instructions (data processing under Art. 28 GDPR).

We delete personal data as soon as the purpose no longer applies — at the latest after your account is deleted — unless statutory retention obligations prevent this (e.g. under commercial and tax law, usually six to ten years). You can delete your account in your profile at any time.

You have the right at any time to

• access the data stored about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdraw consent given, with effect for the future (Art. 7 (3) GDPR).

Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation.

To do so, contact [Datenschutz-E-Mail eintragen].

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your residence, your place of work or the place of the alleged infringement. The authority responsible for us is: [Zuständige Datenschutz-Aufsichtsbehörde mit Anschrift eintragen].