Privacy Policy

The short version: we collect the information needed to provide accounts and community features, keep Vistafolk safe, respond to founding-community and partner requests, and operate the website. We do not sell personal data, run third-party advertising in the app, or track app members across other companies’ apps or sites. Optional website analytics are off until you choose to allow them.

1. Who is responsible

Vistafolk is operated by Amafi (HK) Limited (“Vistafolk,” “we,” “us”), a company incorporated in Hong Kong. Amafi (HK) Limited is the data user under Hong Kong’s Personal Data (Privacy) Ordinance and, where another law uses that term, the controller of the personal data described here.

Privacy, access, and correction requests should be addressed to the Vistafolk Data Protection Contactat contact@vistafolk.com. Technical and account-support requests may be sent to support@vistafolk.com.

2. When this policy applies

This policy applies to the Vistafolk iOS app, vistafolk.com, creator and partner forms, emails we send or receive, support, moderation, and related services. A third-party site, app, or service has its own privacy practices. For example, Apple separately handles App Store accounts and purchases, and a publisher hosting a Vistafolk calculator embed may operate its own analytics.

3. What we collect—and whether you must provide it

App account and profile

• Required to create an account: email address, display name, handle, authentication credentials, and account identifiers. If you do not provide them, we cannot create or secure an account.
• Eligibility and policy records: your confirmation that you are at least 18, the confirmation time, and the versions of the Terms, Community Guidelines, and privacy notice presented at signup.
• Optional profile information: bio, member-entered location, avatar, and accent preferences. Leaving these blank does not prevent account use.

Supabase processes authentication credentials for us. We do not receive a readable copy of your password.

Posts and community activity

• Content you choose to provide: selected photos, captions, post locations, topics, comments, and replies.
• Community actions: likes, saves, follows, blocks, Activity read status, and post or comment activity.
• Safety information: reports, report details, moderation status and history, appeals, and appeal outcomes.

These items are voluntary, but the relevant feature cannot work without its required input. For example, you cannot publish a post without selecting a photo, or submit an appeal without explaining it.

Creator and partner forms

• Creator requests: name, email, city or country, niche, primary format, stated goal, and an optional current handle or portfolio link.
• Partner interest: name, work email, organisation, organisation type, niche, target location, opportunity type, budget band, timing, brief, and an optional website.
• Submission context: source page, submission time, referrer host, campaign parameters, and IP address.

Fields marked required are needed to evaluate and answer the request. If they are omitted, we cannot accept the form. Fields marked optional may be left blank. Submitting a form does not publish the information or guarantee app access, an introduction, paid work, or any reward.

Support and communications

We collect the sender and recipient addresses, message contents, attachments, timestamps, and related account or support records when you contact us. Please provide enough information for us to respond; screenshots and other attachments are optional unless they are needed to investigate the issue. Never send us your password.

Technical, security, and website information

• Necessary service data: IP address, request time, browser or device information, server logs, authentication events, error records, and abuse-control records. These arise automatically when you use an online service and are needed to deliver requests, secure accounts, and diagnose failures.
• Optional website analytics: if you choose “Allow analytics,” we collect page paths and categorical actions such as a page view, form attempt, calculator use, sharing, download, embed copy, or attributed referral. We do not identify website visitors by name or email in PostHog.

Website analytics are not required. Choosing “Essential only” does not affect the app, forms, calculator, or site. Vistafolk does not use a third-party analytics or advertising SDK in the current iOS app.

Raw calculator inputs—including views, income, costs, hours, targets, calculated monetary results, and generated card contents—stay in the browser and are not included in Vistafolk analytics. An embedded calculator may receive ordinary request information such as the referring origin, but it does not send those financial inputs to the publisher hosting the embed.

Selected photos and on-device analysis

The app receives only the photo you select through Apple’s photo picker, not your full photo library. If Communication Safety is enabled on a supported Apple device, Apple’s framework may analyse the selected image on the device before upload. Vistafolk does not receive Apple’s model or your wider photo library. If you continue, the selected photo is uploaded to Vistafolk for pre-publication review.

4. Where information comes from

Most information comes directly from you. Technical information comes from your device, browser, and service requests. We may receive limited information from Apple or our infrastructure providers when needed to operate, secure, or support the service. We do not buy data-broker profiles or upload your device contacts.

5. Why we use personal data

• Provide the service: create and authenticate accounts; maintain profiles; display approved posts and comments; operate likes, saves, follows, blocks, Activity, support, and account deletion.
• Safety and integrity: screen submissions, investigate reports, enforce our Terms and Community Guidelines, prevent fraud and abuse, apply rate limits, preserve evidence, and handle appeals.
• Founding-community and partner requests: evaluate fit, reply, send a requested confirmation or invitation, and make an introduction only after appropriate consent.
• Operate and improve: host, secure, troubleshoot, measure, and improve the service. Optional website analytics are used only after your choice to allow them.
• Legal purposes: comply with law and valid legal process, protect people and rights, and establish, exercise, or defend legal claims.

Where the GDPR or UK GDPR applies, our legal bases are performance of our agreement or steps you request before entering one; our legitimate interests in providing, securing, moderating, and improving Vistafolk; consent for optional analytics or a use that specifically asks for consent; and compliance with legal obligations. We balance legitimate interests against the effect on the people concerned.

We use creator and partner form details to handle the request you made. We will not add those details to unrelated promotional mailing lists. If we later offer marketing messages, we will provide the notices and consent or opt-out channel required by applicable law before sending them.

6. What other members can see

Approved display names, handles, bios, member-entered locations, avatars, posts, comments, and visible engagement are available to signed-in Vistafolk members, subject to blocking and moderation. Other members may copy or capture material they can see, so do not post information you do not want shared in that community.

Email addresses, passwords, saves, block lists, reports, internal moderation notes, creator requests, and partner briefs are not shown to members. Pending, rejected, and removed content is not placed in the community feed, though authorised reviewers may access it for moderation and appeals.

7. Who receives information

We disclose only what is reasonably needed to the following recipients:

• Supabase: app authentication, the Singapore-hosted app database and media storage, Edge Functions, backups, and creator or partner form persistence.
• Vercel: website hosting, serverless form requests, network delivery, and security logs.
• Resend: requested form confirmations and internal form notifications.
• Google: website font delivery and the Google-hosted mailboxes that receive and send Vistafolk correspondence.
• PostHog: optional, consent-based website product analytics hosted in the United States. Autocapture and session recording are disabled.
• Apple: App Store distribution and Apple-controlled device features. Apple handles this information under its own terms and privacy policy.
• Professional advisers, insurers, and authorities: where reasonably necessary for advice, a claim, safety, or compliance with law or valid legal process.
• A genuine successor: if the Vistafolk business is reorganised, financed, merged, or sold, subject to confidentiality, applicable law, and notice where required.

We require processors acting for us to use personal data only for the contracted service, apply protection that is at least equivalent to the commitments in this policy and applicable law, notify us of relevant security incidents, and delete or return data when their services end, subject to lawful retention. Providers may use subprocessors under their published data-processing terms.

8. No sale, behavioural advertising, or app tracking

We do not sell personal data or share it for cross-context behavioural advertising. The current app has no ads, advertising identifier collection, data broker, or tracking across third-party apps and websites. If the business model or technology changes, we will update the policy and obtain any required permission before starting the new processing.

9. International processing

Amafi (HK) Limited operates from Hong Kong. The primary Vistafolk app database is in Singapore. Vercel, Resend, PostHog, Google, Supabase support services, and their subprocessors may process information in the United States and other countries. Privacy rights and government-access rules can differ between countries.

Where a transfer mechanism is legally required, we rely on the provider’s data-processing agreement and applicable contractual safeguards, such as approved standard contractual clauses or an equivalent mechanism. You may ask the Vistafolk Data Protection Contact for information about the safeguard relevant to your data.

10. How long we keep information

• Accounts and member content: while the account exists. In-app deletion removes the live account, selected media, posts, comments, profile, and associated social records. Provider backups are isolated from normal use and disappear when overwritten under the provider’s backup cycle, unless preservation is legally required.
• Individual posts and comments: until you delete them, delete the account, or we remove them. A limited evidentiary copy may be kept with a report, appeal, dispute, or legal hold.
• Creator and partner requests: up to 24 months after submission or the last meaningful interaction, then deleted or de-identified unless an active relationship or legal need requires longer retention.
• Support records: normally up to 24 months after the issue closes.
• Reports, appeals, and moderation records: normally up to three years after closure so we can identify repeated serious abuse, review decisions, and defend claims. After that, we delete or de-identify them unless an active legal, safety, or dispute hold requires longer retention.
• Security and request logs: normally up to 12 months, unless an incident, investigation, legal obligation, or provider backup cycle requires longer.
• Optional website analytics: normally up to 12 months before deletion or aggregation.

We may shorten these periods. We extend one only where reasonably necessary for an active account, safety issue, dispute, legal hold, statutory duty, or technical backup cycle. When the reason ends, we delete or de-identify the information.

11. Account and content deletion

You can delete your account in the app under Settings → Delete account. This deletes the live account and associated user-generated content rather than merely deactivating it. Limited moderation action facts, such as the decision, reason, and date, may remain for the retention period above after live account and content references are cleared. Other limited data may be retained where law, safety, fraud prevention, dispute resolution, or backup integrity requires it. If you cannot access the app, contact support from the registered email address.

12. Your choices and rights

• Edit profile information and remove your posts or comments using available app controls.
• Delete the account and associated content in the app.
• Choose whether to allow optional website analytics and change that choice at any time.
• Ask us to stop contacting you about a creator or partner request.
• Ask whether we hold your personal data and request access to or correction of it.
• Where applicable, request deletion, restriction, portability, or object to processing, and withdraw consent without affecting processing already carried out lawfully.

For a Hong Kong data access or correction request, email the Vistafolk Data Protection Contact with “Data access request” in the subject. We may ask for the prescribed request form and information reasonably needed to verify identity. Subject to lawful exceptions, Hong Kong data access requests are handled within 40 calendar days. Any permitted fee will be limited to the direct and necessary cost of compliance and will not be excessive.

People in the EEA or United Kingdom may also complain to their local data-protection authority. Hong Kong concerns may be raised with theOffice of the Privacy Commissioner for Personal Data. We will not discriminate against a person for making a privacy request.

Open analytics choices

13. Security

Measures include access controls and row-level permissions, private media storage, encrypted network connections, short-lived signed media links, restricted moderator tools, password screening, rate limits, server-only privileged credentials, and provider backups. Staff and providers receive access only where their role requires it. No online service can promise absolute security; use a unique password and contact support promptly if you suspect misuse.

14. Security incidents

We investigate suspected incidents, contain and remediate them where possible, document material decisions, and notify affected people and regulators when law requires it or notification is appropriate to reduce serious harm.

15. Age limit

Vistafolk accounts and forms are for people aged 18 or older. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided data, emailsupport@vistafolk.com so we can investigate and remove it.

16. Changes

We may update this policy as the service, providers, or law changes. We will post the new effective date. Before a material change takes effect, we will provide additional notice or request consent where law requires it. Earlier versions will be retained in our records.

17. Contact

Vistafolk Data Protection Contact
Amafi (HK) Limited
Hong Kong
contact@vistafolk.com