Legal

Privacy Policy

Last updated: 17 July 2026

This Privacy Policy explains how VelvetSpider("VelvetSpider", "we", "us") collects, uses, and protects personal data when you visit velvetspider.tech, contact us, or purchase our services. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Portuguese law.

1. Data controller

VelvetSpider
Rua Da Liberdade 107 1 ESQ, 4835-065 Guimarães, Portugal
Email: info@velvetspider.tech
Phone: +351 923 327 451

2. Data we collect

Contact and inquiry data: name, email address, company name, service interest, and message content you submit via forms or email.
Project data: materials, credentials you choose to share, feedback, and communications needed to deliver services.
Billing-related data: billing name, address, and transaction metadata. Payment card details are processed by Stripe; we do not store full card numbers.
Technical data: IP address, browser type, device information, and basic server logs generated when you visit our website.

3. Purposes and legal bases

Responding to inquiries and preparing quotes — legitimate interests and/or steps prior to a contract (Art. 6(1)(b)/(f) GDPR).
Performing contracts and delivering services — contract necessity (Art. 6(1)(b)).
Processing payments and preventing fraud — contract and legitimate interests (Art. 6(1)(b)/(f)).
Complying with legal and accounting obligations — legal obligation (Art. 6(1)(c)).
Improving website reliability and security — legitimate interests (Art. 6(1)(f)).

4. Processors and service providers

We may share personal data with trusted processors such as:

Hosting providers (e.g. Hostinger) for website operation
Stripe for payment processing (see Stripe Privacy Policy)
FormSubmit (formsubmit.co) to deliver contact-form messages to our inbox
Email delivery providers used to send or receive messages

These providers process data under their own terms and applicable data processing arrangements, only as needed to provide their services.

5. International transfers

Some providers may process data outside the European Economic Area. Where that occurs, we rely on appropriate safeguards such as Standard Contractual Clauses or the provider's equivalent transfer mechanism, as applicable.

6. Retention

Inquiry data is retained as long as needed to respond and for a reasonable follow-up period (typically up to 24 months if no contract follows), unless a longer period is required. Contract, invoice, and accounting records are retained as required by Portuguese law. Technical logs are kept for a limited period for security and diagnostics.

7. Your rights

Under GDPR, you may have the right to:

Access your personal data
Rectify inaccurate data
Erase data in certain circumstances
Restrict or object to certain processing
Data portability where applicable
Withdraw consent where processing is consent-based

To exercise these rights, email info@velvetspider.tech. You may also lodge a complaint with the Portuguese data protection authority (CNPD) or your local supervisory authority.

8. Cookies and analytics

Our website currently uses essential cookies/technologies required for security and basic operation. We do not use advertising cookies. If we add analytics in the future, we will update this policy and, where required, request consent.

9. Security

We use HTTPS and reasonable administrative and technical measures to protect personal data. No method of transmission or storage is completely secure; please use strong unique passwords for any accounts or tools we share during projects.

10. Children

Our services are directed to businesses and professionals. We do not knowingly collect personal data from children under 16.

11. Changes

We may update this Privacy Policy periodically. The "Last updated" date will reflect the latest version.