Privacy Policy

This policy covers the website, the Discord community, the Elite membership and the Sinux Signals dashboard. The Velvet Den is the data controller under the PDPA, and a paid membership is a commercial transaction to which the Act applies.

Contact details supplied at signup or in support; payment information handled and stored exclusively by Whop and never by The Velvet Den; usage data such as pages viewed, session length, browser and referrer via analytics; Discord account identifiers used to grant and verify the Elite role; records of how each account joined the Discord server and, where an affiliate referred it, the payments and commissions linked to it (clause 4); and the contents of support tickets.

Data is used to manage membership access, grant the correct Discord role, respond to support, send service-related messages, improve the site through aggregate analytics, and meet legal obligations. The Discord identifier and the Whop account are obligatory: the Elite role cannot be granted without them. Everything else is voluntary. Personal data is never sold, rented or traded.

Some people are paid as affiliates: they get a share of what The Velvet Den keeps from members they bring into the Discord community. To credit and pay them correctly, The Velvet Den records, for every account that joins the Discord server, its Discord account ID, username and display name, when it joined or left, which invite link or route it came in through, and when it gained or lost the Elite role. Whop sends a record of each Elite payment: the amount, fees and refunds, the product and plan, and the Whop membership and account IDs. The buyer’s email, name, billing address, IP address and card details are removed before anything is stored. For members credited to an affiliate, their Whop memberships are matched to their Discord account, and the commission each payment earns and each payout made to the affiliate are kept in a ledger. An affiliate can see, for the members they referred, only the Discord username, the join date and whether the member is free, Elite or has left. They never see an email, a payment detail, or anyone else’s data. For invite rewards, the same join records show who invited each member; the invite leaderboard shows each inviter’s Discord display name, avatar and invite counts to The Velvet Den and its affiliates, and may be posted in the community.

For affiliates, this processing is necessary to perform the affiliate arrangement and to keep the accounting records Malaysian law requires. For members, it rests on the consent given by joining the community and using the services (clause 7). That consent can be withdrawn under clause 10, but a payment already credited to an affiliate stays in the ledger as an accounting record.

Personal data may be disclosed only to these classes of third party: the payment and membership platform, the community platform, the hosting provider, the trade-tracking dashboard, analytics providers, advertising platforms, and any authority where disclosure is legally required.

Whop (membership and payments, and an advertising pixel that runs on this site), Discord (community, role sync, and the live member count on this site, which your browser requests from Discord directly), Sinux Signals (member dashboard, gated by Discord role), Google (Google Analytics, which measures traffic on this site), Reddit (an advertising pixel that runs on this site), Vercel (hosting), Supabase (the database that holds referral, commission and payout records, hosted in Singapore) and Hetzner (the server in Germany that runs The Velvet Den’s own Discord bot). Each has its own privacy practices, which members should review; The Velvet Den is not responsible for third-party data handling.

Every processor named above operates outside Malaysia, so personal data will be transferred to and processed in other countries, principally the United States, Singapore and Germany. Transfers are made on the basis that the recipient provides protection substantially similar to the PDPA, or with the member’s consent, and using the services constitutes that consent.

Cookies and similar technologies, including Google Analytics, may be used to measure traffic and improve the site. Analytics is aggregate and not tied to individual identity. Browser settings can control or disable cookies; disabling them may affect functionality.

This site also loads an advertising pixel from Whop on every page. It reports page views to Whop so that advertising for The Velvet Den can be measured, and it runs whether or not you are a member. Blocking third-party scripts or using a tracker blocker stops it, and nothing on the site depends on it.

It also loads the Reddit Pixel on every page. The pixel records page visits and clicks on the links that join the Discord or open a Whop checkout, together with device and browser data, and sets cookies, so that advertising for The Velvet Den on Reddit can be measured. It runs whether or not you arrived from Reddit or are a member. Blocking third-party scripts or using a tracker blocker stops it, and nothing on the site depends on it.

Information is kept only as long as needed for the purposes described or as required by law, then deleted or permanently anonymised. In practice: account and role data for the life of the membership plus the period needed to resolve billing questions, support threads for up to two years, aggregate analytics indefinitely in a form that identifies nobody. Join and referral records are kept while the account is in the Discord server and for two years after it leaves. Payment, commission and payout records are kept for seven years after the end of the year they relate to, the period Malaysian tax law requires for accounting records. Both are then deleted automatically.

Access to the personal data held about you; correction of inaccurate, incomplete or out-of-date data; withdrawal of consent to processing; a requirement that processing stop where it causes or is likely to cause damage or distress; prevention of processing for direct marketing; and data portability under the 2024 amendment. Exercise any of them through a Discord support ticket; requests are answered within the timeframes the Act sets.

If a personal data breach occurs, The Velvet Den will notify the Personal Data Protection Commissioner as soon as practicable after becoming aware of it, and will notify affected members directly where the breach is likely to cause them significant harm.

The services are not directed at children. The floor is 18, matching Malaysia’s age of majority, and information is never knowingly collected from anyone under 13 in any jurisdiction. Data of a minor is deleted on notice.

Reasonable technical and organisational measures protect personal data in storage and transit. No internet transmission or storage is completely secure, and absolute security cannot be promised.

This policy is governed by the laws of Malaysia, with disputes subject to the exclusive jurisdiction of the Malaysian courts, identically to the Terms. Updates are posted here with a revised effective date, and continued use constitutes acceptance. Data requests go through a Discord support ticket.