Vellum

Version 1 · effective 8/11/2026

Vellum Privacy Policy

Last updated: [Insert Date]

DRAFT — placeholders in [brackets] must be completed, and this document reviewed by a qualified solicitor, before publication. This is a starting point, not legal advice.

1. Who We Are

Vellum ("Vellum", "we", "us", "our") operates a private, invitation-only social club application for adults, accessible at vellumclubapp.com (the "Service"). We are the data controller responsible for your personal information under applicable data protection law.

Controller: [Legal Entity Name], [Registered Address]. Contact: [Privacy Contact Email].

2. Who Can Use Vellum

Vellum is strictly for adults aged 18 and over. We do not knowingly collect information from anyone under 18. Access is by invitation only, and all members must confirm their age as part of registration and identity verification.

3. Information We Collect

We collect the following categories of information:

  • Account and profile information: name, email address, profile details, interests, and preferences you provide.
  • Identity verification data: a selfie photograph and self-attestations submitted as part of our lightweight verification process.
  • Content you share: photos and media uploaded to your private media vault (when this feature is enabled), messages sent to other members, community posts and comments.
  • Connection and activity data: your connections, blocks, reports, event RSVPs, community memberships, and referral activity.
  • Technical data: device information, IP address, log data, and similar technical identifiers collected automatically.
  • Communications: correspondence between you and Vellum, such as support requests.

4. How We Use Your Information

We use your information to:

  • Operate, maintain, and improve the Service, including invitation, matching, messaging, and community features.
  • Verify eligibility (age and identity) and maintain the trust and safety of the club.
  • Enforce our Terms of Service, investigate reports, and take moderation action where necessary.
  • Send transactional communications, such as invitation and account emails.
  • Comply with legal obligations, including responding to lawful requests from authorities.

We do not sell your personal information.

5. Legal Basis for Processing

Where UK/EU data protection law applies, we rely on the following legal bases: performance of a contract with you (providing the Service you've signed up for), our legitimate interests (such as safety, fraud prevention, and improving the Service, balanced against your rights), your consent (such as for identity verification and optional features), and compliance with legal obligations (such as responding to lawful authority requests).

6. How We Share Your Information

We share information in the following limited circumstances:

  • With other members, according to your privacy settings (for example, profile visibility, connection-based messaging, and shared media).
  • With service providers who help us run the Service, such as our hosting/database provider (Supabase) and transactional email provider (Resend), under contractual confidentiality obligations.
  • With content-safety vendors for automated scanning of uploaded media where such scanning is active (see Section 9).
  • Where required by law, regulation, legal process, or governmental request, including reporting obligations relating to child safety.
  • In connection with a merger, acquisition, or sale of assets, subject to continued protection of your information.

We do not share your private messages, private media, or verification selfie with other members beyond what your own actions and privacy settings permit.

7. Data Retention

We retain personal information for as long as your account is active and as needed to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. Verification selfies and moderation records may be retained longer where necessary for safety and legal compliance. You may request deletion of your account and associated data as described in Section 10.

8. Your Rights

Depending on your location, you may have rights to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent where processing is based on consent. To exercise these rights, contact us at [Privacy Contact Email]. You also have the right to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office).

9. Content Safety and Child Protection

Protecting against child sexual abuse material (CSAM) is treated as a fundamental requirement of this Service. Where automated content-scanning is active for uploaded media, we use it to detect and report known and suspected CSAM in line with applicable law, including reporting to relevant authorities such as the National Center for Missing & Exploited Children (NCMEC) where required. Some features involving new media uploads may be temporarily limited or disabled while such infrastructure is being put in place. [To be finalised with legal counsel, including any jurisdiction-specific reporting obligations.]

10. Account Deletion

You may request deletion of your account at any time by [contacting us at / using the in-app option at — to be completed]. We will delete or anonymise your personal information within a reasonable period, except where retention is required for legal, safety, or fraud-prevention purposes.

11. International Data Transfers

Your information may be processed in countries other than your own. Where we transfer personal information internationally, we take steps to ensure appropriate safeguards are in place in accordance with applicable data protection law. [To be finalised with legal counsel based on actual hosting/processor locations.]

12. Security

We use technical and organisational measures designed to protect your information, including access controls, encryption in transit, and row-level security restricting who can access private data such as messages and media. No system is completely secure, and we cannot guarantee absolute security.

13. Cookies and Similar Technologies

We use cookies and similar technologies necessary for authentication and core functionality of the Service. [Expand with a full cookie inventory before publication if analytics/marketing cookies are introduced.]

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify members of material changes and indicate the date of the latest revision at the top of this document.

15. Contact Us

If you have questions about this Privacy Policy or how we handle your information, contact us at [Privacy Contact Email].