In short
- Data is hosted in the European Union, in Frankfurt.
- No data is sold, rented or used for advertising.
- The website sets no advertising or analytics cookies.
- For Models' data, the Agency decides: TECH APP STUDIO processes it on the Agency's behalf.
- You can exercise your rights at any time by writing to support@velora-hq.com.
1. Who is responsible for your data
TECH APP STUDIO, a French SAS, 19 Avenue des Diables Bleus, 06300 Nice, France ("we"), publishes Velora. Our role depends on the data:
- Controller for Agency accounts, billing, platform security, support and the website. This policy applies to that processing.
- Processor for the data each Agency puts into Velora about its Models and its team (sales, content, messages, shoots, contracts, activity in the app). The Agency is then the controller. We act on its instructions, under the data processing agreement.
Are you a Model? Your Agency is your first contact for your data. Its own policy can be read in the app (Settings, Privacy). You can also write to us: we will forward your request to your Agency.
We have not appointed a data protection officer. For any question: support@velora-hq.com.
2. Data we process as controller
| Why | What data | Legal basis | How long |
|---|---|---|---|
| Create and manage the Agency's and its team's accounts | Name, e-mail, password (hashed, never readable), Agency name, role, language | Performance of the contract | Term of the contract, then 30 days for export |
| Bill the subscription | Company name, address, VAT number, billing e-mail, payment history (card and IBAN stay with Stripe) | Performance of the contract and legal obligation | 10 years for invoices (French Commercial Code) |
| Secure the service and prevent fraud | IP address, browser, devices, sessions, failed sign-ins, log of sensitive actions, bot check | Legitimate interest (security of the service) | Sessions: until they expire. Audit log: 3 years |
| Send the service's e-mails | E-mail, name, message content (verification, invitation, invoice, security alert) | Performance of the contract | Sending logs: 30 days at most |
| Answer support requests | E-mail exchanges and information needed for the request | Legitimate interest | 3 years after the last exchange |
| Establish or defend our rights | Data needed as evidence (contract, invoices, logs) | Legitimate interest | Applicable limitation period |
We do not send advertising e-mails. If that changes, your consent will be asked where the law requires it, and each message will include an unsubscribe link.
3. Data processed on behalf of Agencies
To provide the service, we process for each Agency, on its instructions:
- Models: stage name and name, e-mail, phone, photo, language, time zone, connected platforms (encrypted sessions and keys), sales, work content, form answers, shoots, contracts, voice samples if the Agency uses the voice feature, activity in the app.
- The Agency's team: name, e-mail, role, scope, activity in the console.
- Data from the Model's device (see section 4).
The Agency sets how long this data is kept. It is deleted no later than 30 days after its subscription ends, or earlier on its request.
4. iPhone app: device, notifications, App Attest
- Device: iPhone model, iOS and app version, first and last sign-in dates. Used to show your signed-in devices and sign them out remotely.
- Notifications: if you accept them, an Apple notification token is stored to send you sales alerts and messages from your Agency. You can switch them off in the iPhone settings.
- App Attest: the app proves to Apple that it is the genuine, unmodified app. We keep the public key and receipt provided by Apple, and a counter against replayed requests. Legal basis: legitimate interest (account security).
- Modified device: the app may report signs of a jailbreak. It is a security signal and does not block access.
- Face ID: the check happens on the iPhone. No biometric data is sent to us.
- Keychain: an encrypted copy of the session stays on this iPhone only, never in iCloud or in a backup.
5. My cycle: health data
The "My cycle" tracker involves health data, protected by Article 9 of the GDPR. It is optional and only switched on with the Model's explicit consent, given in the app.
This data is encrypted and not shown to the Agency. The Model can withdraw her consent at any time by switching the feature off: all her cycle data is then erased.
6. Who receives the data
- Authorised staff of TECH APP STUDIO, only when needed (support, security, maintenance), bound by confidentiality.
- Members of the Agency, according to their role and scope in the console.
- Our technical processors, listed below, within the limits of their task.
- The third-party services the Agency connects itself (sales platforms, messaging, e-signature, social networks, AI providers). They receive the data the Agency chooses to send them, under its responsibility and their own terms.
- Authorities, only upon a lawful request.
In the console's "Customize" screen, the font preview loads the chosen font from Google Fonts: the IP address of the signed-in person is then sent to Google.
7. Our processors
| Provider | Service | Role | Data location | Transfer safeguards |
|---|---|---|---|---|
| Vercel Inc. | Vercel | Hosting and running the application | Frankfurt (Germany, EU) | EU-US Data Privacy Framework, Standard contractual clauses |
| Supabase Pte. Ltd. | Supabase | Database | Frankfurt (Germany, EU) | Standard contractual clauses |
| Upstash, Inc. | Upstash Redis | Cache, job queues, rate limits | Frankfurt (Germany, EU) | Standard contractual clauses |
| Cloudflare, Inc. | Cloudflare R2, Turnstile | Media storage, bot protection | European Union | EU-US Data Privacy Framework, Standard contractual clauses |
| Stripe Payments Europe, Limited | Stripe | Payments and invoicing | Ireland (EU) | EU-US Data Privacy Framework, Standard contractual clauses |
| Plus Five Five, Inc. | Resend | Sending the service's e-mails | United States | Standard contractual clauses |
| Apple Inc. | Apple Push Notification service | iPhone notifications | United States | EU-US Data Privacy Framework, Standard contractual clauses |
Any change to this list is announced to Agencies at least 30 days in advance, as set out in the DPA.
8. Transfers outside the European Union
Databases, cache and files are hosted in the European Union. Some providers are companies established outside the EU, mainly in the United States: their teams may access data for support or operations, and e-mails and notifications are sent through their servers.
These transfers are covered by the European Commission's standard contractual clauses and, where the provider is certified, by the EU-US Data Privacy Framework (adequacy decision of 10 July 2023). A copy of the safeguards can be requested at support@velora-hq.com.
9. Security
The main measures: agencies isolated in the database, secrets encrypted with one key per agency, hashed passwords (Argon2id), two-factor authentication, private media behind links limited to 5 minutes, audit log, encrypted backups, rate limits against scraping. Details are on the Security page.
In the event of a data breach posing a risk, we notify the CNIL (the French data protection authority) within 72 hours and, where the law requires it, the people concerned.
10. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw your consent at any time. You can also set instructions about what happens to your data after your death.
To exercise them, write to support@velora-hq.com from the address linked to your account. We answer within one month, which may be extended by two months for a complex request. Proof of identity is only requested in case of reasonable doubt.
Many actions can be done directly: editing your profile, exporting the Agency's data (Settings, Data), requesting account deletion from the console or the app.
11. Complaints
If you believe your rights are not respected, you can lodge a complaint with the CNIL: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or online at cnil.fr. You may also contact the supervisory authority of the EU country where you live.
13. Minors
The service is reserved for adults. Agencies undertake not to invite any minor. An account we learn belongs to a minor is closed and its data deleted.
14. Changes
This policy may change. The update date is shown at the top of the page. In the event of a significant change, Agencies are notified by e-mail.