Privacy Policy

1. Who We Are

VALORIZD (https://www.valorizd.app) is a download gate platform for artists and creators, operated by an individual based in the European Union. As a controller of personal data, we are subject to the General Data Protection Regulation (GDPR) and applicable Italian data protection law.

For any privacy-related questions, contact us at: support@valorizd.app

2. What Data We Collect and Why

2.1 Account & Profile Data (Creators)

When you register and use VALORIZD as a creator, we collect:

• Email address and authentication provider (email/password or Google)
• Display name, and optionally first name, last name, and a short bio
• Country of residence (selected during onboarding)
• Username (used for your public profile URL)
• Profile photo and brand logo (uploaded files stored securely)
• How you heard about us (referral source, collected at onboarding)
• Account creation date and last login date

Legal basis: Contract performance (Art. 6(1)(b) GDPR) — this data is necessary to provide you with the service.

2.2 Gate Content

When you create download gates, we store:

• Gate title, description, category, and cover image
• The social actions you configure (links to Instagram, YouTube, SoundCloud, etc.)
• The reward content: an external URL or an uploaded file
• Gate analytics: view counts and unlock counts (aggregated, not linked to individual visitors)

Legal basis: Contract performance (Art. 6(1)(b) GDPR).

2.3 Visitor Email Addresses (Fan Emails)

Creators may optionally require email collection on individual gates by enabling the "Collect fan email" option in each gate's settings. This is disabled by default and must be explicitly activated per gate. When enabled and a visitor submits their email address to unlock that specific gate, the address is stored securely on our servers and associated with the creator's account. Specifically:

• The email address, the gate it was submitted through, the submission date, and the visitor's device type are recorded
• This data is accessible only to the creator who owns the gate — VALORIZD staff do not access it for commercial purposes
• VALORIZD will never use visitor email addresses for its own marketing, promotional communications, or any purpose unrelated to operating the platform
• Creators are solely responsible for how they use collected email addresses and must comply with applicable law (including GDPR where relevant) when contacting their audience
• Visitors may request deletion of their email address by contacting the creator directly or by reaching us at the address below

Legal basis: Legitimate interest of the creator in managing their audience (Art. 6(1)(f) GDPR); consent provided by the visitor at the time of submission.

2.4 Subscription & Payment Data

Payments are processed by Stripe. We do not store card numbers or full payment details on our servers. We do retain:

• Your Stripe customer ID
• Subscription plan, status, and billing period dates
• Invoice history (amount, date, status)

Legal basis: Contract performance and legal obligation (Art. 6(1)(b) and 6(1)(c) GDPR).

2.5 Usage & Analytics Data

We use the following analytics services to understand how the platform is used and to improve it:

• Google Analytics 4 — collects anonymized page view data, session duration, device type, and approximate geographic location. Data is processed by Google LLC under standard contractual clauses.
• Vercel Analytics — collects aggregated page-level performance and traffic data. No cookies are used by Vercel Analytics and no personal identifiers are stored.

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) — to improve the platform experience.

3. Third-Party Services

We rely on the following sub-processors to operate the platform:

We do not sell your personal data. We share data with third parties only as described above or when required by law.

4. Cookies

We use the following categories of cookies and similar technologies:

• Strictly necessary: Session and authentication cookies managed by Firebase. These cannot be disabled as they are required for the platform to function.
• Analytics: Google Analytics 4 uses cookies to distinguish users and sessions. You can opt out via your browser settings or the Google Analytics Opt-out Browser Add-on.

Vercel Analytics does not use cookies.

5. Data Retention

• Account data is retained for as long as your account is active. When you delete your account, your personal data is removed within 30 days, except where we are legally required to retain it (e.g. invoices).
• Uploaded files (profile photos, brand logos, gate reward files) are deleted when you remove them or close your account.
• Fan email addresses collected through gates are retained as long as the creator's account is active and the data has not been manually deleted. Creators can delete individual entries or their entire fan email database at any time from their dashboard. When a creator deletes their account, all associated fan email data is removed within 30 days.
• Billing records are kept for up to 10 years as required by Italian fiscal law.
• Analytics data is retained according to the respective service's policies (Google Analytics: up to 14 months; Vercel Analytics: aggregated, no personal retention).

6. International Data Transfers

Some of our sub-processors (Google, Stripe, Vercel) process data in the United States. These transfers are conducted under the EU–US Data Privacy Framework or Standard Contractual Clauses (SCCs), ensuring an equivalent level of protection as required by GDPR.

7. Your Rights (GDPR)

If you are in the EU/EEA, you have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your account and associated data
• Portability — receive your data in a structured, machine-readable format
• Restriction — request that we limit how we process your data
• Objection — object to processing based on legitimate interest
• Withdraw consent — where processing is based on consent, you can withdraw it at any time

To exercise any of these rights, email us at support@valorizd.app. We will respond within 30 days. You also have the right to lodge a complaint with the Italian data protection authority (Garante per la Protezione dei Dati Personali).

8. Data Security

We implement appropriate technical and organizational measures to protect your data, including encrypted connections (HTTPS), secure cloud storage with access controls, and authentication tokens with limited lifetimes. No method of internet transmission is 100% secure, and we cannot guarantee absolute security.

9. Children's Privacy

VALORIZD is not intended for use by anyone under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this privacy policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email. Continued use of the platform after changes constitutes acceptance of the updated policy.

11. Contact

For any questions, requests, or concerns about this privacy policy or how we handle your data, please reach out at: support@valorizd.app