1.Overview
This policy covers the website, the Discord community, the Elite membership and the Sinux Signals dashboard. The Velvet Den is the data controller under the PDPA, and a paid membership is a commercial transaction to which the Act applies.
How The Velvet Den handles personal data across the website, the Discord community, the Elite membership and the Sinux Signals dashboard. This notice is issued under Malaysia’s Personal Data Protection Act 2010 (PDPA), as amended.
This policy covers the website, the Discord community, the Elite membership and the Sinux Signals dashboard. The Velvet Den is the data controller under the PDPA, and a paid membership is a commercial transaction to which the Act applies.
Contact details supplied at signup or in support; payment information handled and stored exclusively by Whop and never by The Velvet Den; usage data such as pages viewed, session length, browser and referrer via analytics; Discord account identifiers used to grant and verify the Elite role; and the contents of support tickets.
Data is used to manage membership access, grant the correct Discord role, respond to support, send service-related messages, improve the site through aggregate analytics, and meet legal obligations. The Discord identifier and the Whop account are obligatory: the Elite role cannot be granted without them. Everything else is voluntary. Personal data is never sold, rented or traded.
Personal data may be disclosed only to these classes of third party: the payment and membership platform, the community platform, the hosting provider, the trade-tracking dashboard, analytics providers, and any authority where disclosure is legally required.
Whop (membership and payments, and an advertising pixel that runs on this site), Discord (community, role sync, and the live member count on this site, which your browser requests from Discord directly), Sinux Signals (member dashboard, gated by Discord role) and Vercel (hosting). Each has its own privacy practices, which members should review; The Velvet Den is not responsible for third-party data handling.
Every processor named above operates outside Malaysia, so personal data will be transferred to and processed in other countries, principally the United States. Transfers are made on the basis that the recipient provides protection substantially similar to the PDPA, or with the member’s consent, and using the services constitutes that consent.
Cookies and similar technologies may be used to measure traffic and improve the site. Analytics is aggregate and not tied to individual identity. Browser settings can control or disable cookies; disabling them may affect functionality.
This site also loads an advertising pixel from Whop on every page. It reports page views to Whop so that advertising for The Velvet Den can be measured, and it runs whether or not you are a member. Blocking third-party scripts or using a tracker blocker stops it, and nothing on the site depends on it.
Information is kept only as long as needed for the purposes described or as required by law, then deleted or permanently anonymised. In practice: account and role data for the life of the membership plus the period needed to resolve billing questions, support threads for up to two years, aggregate analytics indefinitely in a form that identifies nobody.
Access to the personal data held about you; correction of inaccurate, incomplete or out-of-date data; withdrawal of consent to processing; a requirement that processing stop where it causes or is likely to cause damage or distress; prevention of processing for direct marketing; and data portability under the 2024 amendment. Exercise any of them through a Discord support ticket; requests are answered within the timeframes the Act sets.
If a personal data breach occurs, The Velvet Den will notify the Personal Data Protection Commissioner as soon as practicable after becoming aware of it, and will notify affected members directly where the breach is likely to cause them significant harm.
The services are not directed at children. The floor is 18, matching Malaysia’s age of majority, and information is never knowingly collected from anyone under 13 in any jurisdiction. Data of a minor is deleted on notice.
Reasonable technical and organisational measures protect personal data in storage and transit. No internet transmission or storage is completely secure, and absolute security cannot be promised.
This policy is governed by the laws of Malaysia, with disputes subject to the exclusive jurisdiction of the Malaysian courts, identically to the Terms. Updates are posted here with a revised effective date, and continued use constitutes acceptance. Data requests go through a Discord support ticket.