Velvet Rule

Privacy Policy

Last updated: 30 September 2026

This Privacy Policy explains how Velvet Rule collects, uses, stores, shares and protects personal data when you use our website, applications and related services (collectively, the “Service”).

By using Velvet Rule, you acknowledge the practices described in this Privacy Policy.

1. Who We Are

Velvet Rule is operated by MEI KIM HOLDINGS PTE. LTD. (UEN 202644893M), a company incorporated in Singapore.

In this Privacy Policy, “Velvet Rule”, “we”, “us” and “our” refer to the operator of the Service.

2. Information We Collect

The information we collect depends on how you use Velvet Rule.

Account Information

We may collect:

  • your name or display name;
  • email address;
  • authentication information;
  • timezone;
  • account preferences; and
  • information required to manage your account.

Connection Information

When you create or participate in a Connection, we may process information such as:

  • Connection type and participants;
  • roles and preferences;
  • invitations;
  • agreements and acceptance records;
  • rules, boundaries and safeguards;
  • Journey levels and phases;
  • review and progression records; and
  • other information you choose to add to the Connection.

Activity Information

We may process information about your use of Service features, including:

  • habits and tasks;
  • completion and verification records;
  • schedules and calendar activity;
  • timers and timer adjustments;
  • review outcomes; and
  • relevant activity history.

Content You Provide

We may process content that you choose to create, upload or share, including:

  • journal entries;
  • notes and reflections;
  • responses to prompts;
  • files and attachments;
  • support requests; and
  • content deliberately shared with another participant.

Professional Features

If you use professional functionality, we may process information associated with your client Connections, private professional notes, templates, assessments and related activity.

Technical Information

We may automatically collect technical information reasonably necessary to operate and secure Velvet Rule, including:

  • IP address;
  • browser and device information;
  • login and authentication events;
  • timestamps;
  • system and security logs;
  • diagnostic information; and
  • information about how the Service is used.

3. Personal and Sensitive Information

Velvet Rule may contain information that users consider private or sensitive.

You decide what information you enter into the Service, except for information necessary to create, secure and operate your account.

We design features so that participation in the same Connection does not automatically make all information visible to other participants.

Private preparation remains private unless you deliberately share it or the relevant feature clearly indicates otherwise.

You should consider carefully what information you choose to record or share.

4. How We Use Personal Data

We may collect, use and process personal data to:

  • create, authenticate and maintain accounts;
  • operate Connections;
  • provide agreements, rules, Journey, habits, tasks, timers, journals and other Service features;
  • record user actions, decisions and acceptance records;
  • display authorised information to Connection participants;
  • maintain relevant histories and records;
  • provide account-management and data-export functionality;
  • respond to support requests and feedback;
  • investigate technical problems;
  • detect and prevent fraud, abuse and security incidents;
  • maintain and improve the Service;
  • enforce our Terms of Service;
  • comply with applicable legal obligations; and
  • establish, exercise or defend legal claims.

We will not use personal data for materially different purposes without an appropriate basis under applicable law.

5. Information Within Connections

Different information may have different visibility depending on the feature being used.

Private information is not automatically shared simply because users participate in the same Connection.

Shared information may include agreements, accepted rules, relevant activity records, schedules and other information intended for participants in that Connection.

Private journal entries remain private unless the author deliberately chooses to share them.

Where sharing creates a separate shared record, subsequent changes to the private original may not modify the previously shared version.

Professional-client Connections are maintained separately from other client Connections.

You are responsible for reviewing information before deliberately sharing it with another person.

6. Consent and Your Choices

Where applicable, we may rely on your consent to collect, use or disclose particular personal data.

You may withdraw consent subject to applicable law and reasonable notice.

Depending on the information involved, withdrawing consent may mean that we can no longer provide some or all of the Service to you.

Privacy consent is separate from any agreement, permission or decision made between users within a Connection.

7. Service Providers

We may use third-party providers to help operate Velvet Rule.

These providers may support functions such as:

  • cloud infrastructure and hosting;
  • databases;
  • authentication;
  • file storage;
  • email delivery;
  • security;
  • error monitoring; and
  • technical operations.

These providers may process personal data on our behalf only to the extent reasonably necessary to provide their services to us.

We may also disclose information where otherwise described in this Privacy Policy or where required or permitted by law.

We do not sell your personal data.

8. International Data Transfers

Some of our infrastructure or service providers may process information outside Singapore.

Where personal data is transferred outside Singapore, we will take reasonable steps as required by applicable law to ensure that the transferred personal data receives a standard of protection comparable to that provided under Singapore's Personal Data Protection Act 2012 (“PDPA”).

9. Data Retention

We retain personal data for as long as reasonably necessary to:

  • provide the Service;
  • maintain appropriate account and activity records;
  • fulfil the purposes for which the information was collected;
  • protect the security and integrity of the Service;
  • resolve disputes;
  • prevent fraud or abuse; and
  • comply with applicable legal obligations.

Different types of information may have different retention periods.

Uploaded attachments may be deleted after their configured retention period while related completion or activity records remain.

Historical records may also be preserved where necessary to distinguish previous agreements or activity from current records.

When personal data is no longer required for legal or business purposes, we will cease retaining it or remove the means by which it can reasonably be associated with an identifiable individual, as required by applicable law.

10. Account Deletion

You may request deletion of your account through the available account controls.

Deleting an account may close affected Connections and revoke access to associated information.

Deletion may not result in the immediate removal of every record. We may retain information where reasonably necessary or permitted by law, including for security, fraud prevention, dispute resolution, legal compliance and legitimate record-keeping purposes.

Information previously shared with another participant may also remain as part of an authorised shared record or Connection history.

11. Data Exports

Velvet Rule may allow you to request a readable export of information associated with your account and records you are currently authorised to access.

An export does not provide access to information belonging exclusively to another person.

Certain information may remain available for a limited period following the closure of a Connection so that an authorised user can obtain an exit archive without restoring live access.

12. Security

We use reasonable administrative, technical and organisational measures designed to protect personal data against unauthorised access, collection, use, disclosure, copying, modification, loss or disposal.

These measures may include access controls, authentication systems, database permissions, security monitoring and other safeguards appropriate to the Service.

No internet-based service can guarantee absolute security.

You are responsible for protecting your login credentials and should notify us promptly if you believe your account has been compromised.

13. Adults Only

Velvet Rule is intended only for people aged 18 or older.

We do not knowingly provide the Service to children.

If we become aware that an individual under 18 has created an account or provided personal data contrary to this requirement, we may suspend or close the account and take appropriate steps to delete the relevant information.

14. Access and Correction

Subject to applicable law, you may request access to personal data that we hold about you and information concerning how that data has been used or disclosed.

You may also request correction of inaccurate or incomplete personal data.

Some information can be reviewed or updated directly through your account.

We may need to verify your identity before processing certain requests.

15. Withdrawal of Consent

Where we rely on consent, you may request to withdraw your consent to the continued collection, use or disclosure of relevant personal data.

We may explain the likely consequences of withdrawing consent before processing your request.

Withdrawal does not affect processing that occurred lawfully before the withdrawal.

We may also continue to retain, use or disclose information where permitted or required by applicable law.

16. Cookies and Similar Technologies

Velvet Rule may use cookies, local storage and similar technologies to operate the Service.

These technologies may be used to:

  • authenticate users;
  • maintain sessions;
  • remember preferences;
  • protect accounts and the Service;
  • provide essential functionality;
  • diagnose technical issues; and
  • understand Service performance.

Where required by applicable law, we will obtain appropriate consent before using non-essential cookies or similar technologies.

17. Legal and Safety Disclosures

We may disclose personal data where reasonably necessary to:

  • comply with applicable law or legal process;
  • respond to a valid request from a competent authority;
  • investigate suspected fraud, abuse or security incidents;
  • protect the security and integrity of the Service;
  • protect the rights or safety of users or other persons; or
  • establish, exercise or defend legal claims.

Where reasonably practicable, we will consider the validity and scope of a request before disclosing personal data.

18. Business Transfers

If Velvet Rule or the business operating it is involved in a merger, acquisition, restructuring, financing, sale of assets or similar transaction, personal data may be disclosed or transferred as part of that transaction.

Any handling of personal data in connection with such a transaction will remain subject to applicable data-protection requirements.

19. Your Responsibilities

You should not enter another person's personal data into Velvet Rule unless you have an appropriate reason and authority to do so.

You are responsible for information you deliberately share with other users.

Once information has legitimately been shared with another person, we cannot control information that person independently records, copies or retains outside Velvet Rule.

20. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to the Service, our practices or applicable requirements.

The updated version will display its effective or “Last updated” date.

Where changes are material, we may provide additional notice through the Service or another appropriate method.

21. Contact and Data Protection

If you have questions about this Privacy Policy, wish to exercise an applicable privacy right, or have a concern about how your personal data is handled, you may contact Velvet Rule at hello@velvetrule.app or through the support channel provided on the Service.

Where required, requests relating to personal data will be handled by or referred to the person responsible for data protection matters.

We may request information reasonably necessary to verify your identity and process your request.