Privacy policy. VelvetDesk

VelvetDesk ("we", "us") is a front desk for Instagram direct messages. It answers messages on behalf of beauty professionals in their own words and books their clients. This policy explains what we collect, why, and what you can do about it. It is written for two people: the artist who uses VelvetDesk (the "artist") and the person who messages the artist on Instagram (the "client").

Who we are

VelvetDesk is operated by Yury Sharlou, Los Angeles, California. You can reach us at hello@velvetdesk.io for any question about this policy or your data.

What we collect from artists

Your name, Instagram handle, phone or WhatsApp number, email address and booking software, when you fill in the start form.
Your prices, deposit rules, hours, booking link, address, pre-care notes, frequent questions, languages and the phrases you use, when you fill in the onboarding form.
Instagram conversations you share with us to build your voice: as an Instagram data export, as screenshots, or through a connected Instagram account.
When you connect your Instagram professional account through Meta, we receive an access token, your Instagram account id and username, and the direct messages sent to your account from the moment you connect. We use the Instagram Messaging API under Meta's Platform Terms.
Technical records: the time of each message, which replies were sent, which bookings were made, and errors.

What we collect from clients

When a client messages an artist who uses VelvetDesk, we receive the message text, the client's Instagram username and display name, and the time of the message. We use this to answer the message on the artist's behalf and to tell the artist about a booking. We do not use client messages for advertising, and we do not sell them.

Why we collect it

To answer messages in the artist's voice and send booking links. This is the service.
To build and update the artist's voice from their real conversations.
To notify the artist about bookings and questions it cannot answer.
To send the artist a morning summary or weekly report, where included in their plan.
To keep the service working, find errors and prevent abuse.

We do not use artist or client data to train models that serve other customers.

Automated replies

Replies are drafted by an automated system from the artist's prices, rules and past conversations. The system does not quote prices the artist did not give it, does not confirm times without the artist's calendar, and does not promise results or discounts. When it is not sure, it asks the artist. If a client asks whether they are talking to an assistant, it says so.

Who sees your data

Hosting and storage: Cloudflare (United States), for the website, the forms and uploaded files.
Meta Platforms, for the Instagram connection, under Meta's own terms.
Language model providers that process message text to draft a reply. They receive the message and the artist's rules, and nothing more than needed to write the reply.
Resend, for transactional email to the artist.
Stripe, for payment after the free trial, if the artist subscribes. We never see full card numbers.

We do not sell personal data and we do not share it with advertisers.

How long we keep it

Conversations and booking records: for as long as the artist's account is active, and up to 90 days after it closes, unless the artist asks us to delete them sooner.
Uploaded exports and screenshots: until the voice is built and checked, then up to 90 days.
Instagram access tokens: until the artist disconnects or the token expires. We delete them within 24 hours of disconnection.
Start form and onboarding entries from people who do not go on to use the service: 12 months.

Your rights

Whether you are an artist or a client, you can ask us to show you the data we hold about you, correct it, or delete it. Write to hello@velvetdesk.io or follow the steps on the data deletion page. We answer within 30 days. California residents have these rights under the CCPA, and we do not discriminate against anyone who exercises them.

A client who wants their messages removed from an artist's VelvetDesk records can write to us directly; we will confirm the deletion with the client and tell the artist.

Security

Data travels over HTTPS. Access tokens and uploaded files are stored encrypted at rest. Only the people who run VelvetDesk can reach the storage, and only to operate the service or on your request.

Children

VelvetDesk is for businesses and is not directed at children under 16. If we learn that we hold data about a child, we delete it.

Changes

If this policy changes, we update the date at the top and tell active artists by email before the change applies.

Contact

VelvetDesk, Los Angeles. hello@velvetdesk.io.