Privacy Policy
This Privacy Policy explains how Paints Animation Ltd ("Paints", "we", "us") collects, uses, shares, and protects information about you when you join our waitlist, visit our website, use our forthcoming mobile applications, or otherwise interact with the Paints Service. By using the Service you confirm that you have read and understood this Policy.
1. Who we are
The data controller is Paints Animation Ltd, Park Street, Windsor, Berkshire, SL4 1LB, United Kingdom. For any privacy question, contact us at contact@paints.app.
Our privacy contact is privacy@paints.app. We have not appointed a formal Data Protection Officer under Article 37 of the UK GDPR; we will appoint one if and when our processing requires it.
2. Information we collect
2.1 Information you give us
| Context | Examples |
|---|---|
| Waitlist sign-up | Email address; optionally name and city. |
| Account creation | Email, phone number, password (hashed by Firebase Authentication), display name, profile photo. |
| Onboarding & profile | Date of birth or age, city, taste responses (your answers to our discovery prompts), interests, preferences, and any optional fields you complete. |
| Subscription & purchases | Plan tier, billing period, founding-member status. Payment is handled by Apple or Google — we receive a transaction identifier and entitlement status, not your full payment-card details. |
| Event participation | Events you join or attend, group matches, RSVPs, check-ins, ratings, and feedback. |
| Support & communications | Messages you send to us, support tickets, survey responses. |
2.2 Information we collect automatically
| Category | Examples |
|---|---|
| Device & technical data | Device model, operating system, app version, language, time zone, crash reports, performance traces. |
| Usage data | Screens you view, features you use, taps and interactions, session duration, referral source. |
| Approximate location | City-level location derived from IP address, or precise location only with your explicit permission (for example, to find venues near you). |
| Identifiers | Firebase Installation ID, app-instance ID, advertising identifier (only if you enable analytics that use it). |
2.3 Information from third parties
- If you sign in with Google, Apple, or Facebook, we receive the basic profile information you authorise (typically name, email, and a unique identifier).
- App-store providers (Apple, Google) share subscription status, renewal events, and refund events with us so we can keep your entitlements in sync.
- Venue and event partners may share attendance confirmations or feedback related to experiences you booked through Paints.
2.4 Special category data
Some of the answers you give during Paints onboarding may include special category data under Article 9 of the UK GDPR, including:
- information that reveals sexual orientation or sexual life (for example, your answer to romantic openness or who you would like to be matched with);
- information about religious or philosophical beliefs (for example, your answers about spirituality);
- information that may reveal racial or ethnic origin (for example, nationality or place of birth).
We process this information only with your explicit consent, which you give during onboarding by completing these optional questions. You can withdraw consent at any time by editing your profile in the app or by emailing privacy@paints.app, at which point we will stop using the data for matching and either delete it or anonymise it.
We do not use special category data for any purpose other than matching, recommending events, and improving the Service.
3. How & why we use your information
- Provide the Service — create and authenticate your account, run onboarding, deliver event and venue recommendations, form groups, and process subscriptions.
- Personalise your experience — tailor suggestions and content based on your taste responses, preferences, city, and past activity.
- Communicate with you — send transactional messages (sign-in codes, receipts, subscription notices), product updates, waitlist invites, and — only with your consent where required — marketing emails.
- Improve and develop the Service — analyse usage, run experiments, debug crashes, evaluate matching and recommendation quality.
- Safety, security & fraud prevention — detect abuse, enforce our Terms, protect users and partners, comply with legal obligations.
- Comply with law — respond to lawful requests, manage tax and accounting records, and exercise or defend legal claims.
Marketing communications
We send you two kinds of email:
- Transactional emails — sign-in codes, receipts, subscription notices, event confirmations, safety information, and changes to these policies. These are essential to providing the Service and you cannot opt out while your account is active.
- Marketing emails — product updates, new launches, recommendations, and editorial features. We send these to you only with your consent, which we obtain during sign-up or in your profile. You can unsubscribe at any time using the link at the bottom of any marketing email, or by emailing privacy@paints.app. Unsubscribing does not affect transactional emails.
4. Legal basis (UK GDPR)
We rely on the following lawful bases under the UK GDPR and the Data Protection Act 2018: (a) contract, where processing is necessary to provide the Service you requested; (b) legitimate interests, for example to keep the Service secure and improve it, balanced against your rights; (c) consent, for non-essential cookies, marketing, and precise location; and (d) legal obligation, where we are required to retain or disclose information by law.
5. Automated decision-making and profiling
We use an automated matching engine to suggest events, form groups, and recommend connections. This involves profiling — building a picture of your taste, social preferences, and likely fit with other members.
Automated matching does not produce legal effects on you, and we do not consider it to significantly affect you within the meaning of Article 22 of the UK GDPR. You retain full control over which events you book and which connections you accept.
If you would like a human review of a specific match decision, or if you would like to object to profiling, email privacy@paints.app. We will respond within one month.
6. Who we share your information with
We do not sell your personal information. We share it only with the categories of recipient below, and only for the specific purposes listed.
Service providers acting on our instructions:
- Google (Firebase, Google Cloud) — authentication, real-time database, cloud functions, analytics, crash reporting, app distribution. Data may be processed in the United States.
- Apple — billing and entitlement management for in-app purchases on iOS.
- Google (Play Billing) — billing and entitlement management for in-app purchases on Android.
- Stripe (from V2 launch) — direct event payments and host payouts. Stripe acts as an independent controller for payment data; see stripe.com/privacy.
- TheFork, OpenTable, and Mozrest — venue reservations on your behalf. We share the minimum information needed to make a booking: typically the name of the lead booker, group size, and dietary notes.
- Our transactional and waitlist email provider — for sign-in codes, receipts, subscription notices, waitlist invites, and product updates.
- Our customer support tool — for handling support tickets.
Venue and event partners: We share the information they need to host you — typically attendance confirmation, group size, first name, and any dietary requirements.
Authorities and law enforcement: Where we have a good-faith belief that disclosure is necessary to comply with law, protect users, or defend our rights.
Successors: In a merger, acquisition, or asset sale, subject to confidentiality protections and continued application of this Policy.
We keep this list current. When we add a new significant processor, we will update this section before that processor begins handling your data, and we will give material notice through the Service where required by law.
7. Cookies, analytics & tracking
Our website uses minimal cookies and local storage required for the site to function. Our mobile apps use Firebase Analytics, Crashlytics, and Performance Monitoring to understand usage and improve reliability. Where required by law, we will ask for your consent before enabling analytics that use cookies or device identifiers, and you can change your choice at any time in your device or app settings.
8. How long we keep your information
| Category | Retention period |
|---|---|
| Waitlist email | Until you unsubscribe or we close the waitlist, whichever is sooner. |
| Account profile and onboarding answers | For the life of your account. Deleted or anonymised within 30 days of account deletion, except where retention is required by law. |
| Special category data | For the life of your account, or until you withdraw consent, whichever is sooner. |
| Event participation history (events booked, attended, ratings) | For the life of your account, then aggregated and anonymised. |
| Messages sent through Paints Connect | For the life of your account, plus 12 months of cold storage for safety and dispute resolution. |
| Payment transaction identifiers and entitlement status | For the life of your account, plus 6 years for tax and accounting records. |
| Support tickets and correspondence | For 24 months from the last interaction. |
| Server logs, crash reports, and security logs | Up to 12 months. |
| Cookies on the Paints website | Audience-measurement cookies: up to 6 months. Other cookies: up to 13 months. |
| Aggregated and anonymised data | May be retained indefinitely as it can no longer be linked to you. |
If we ask you to verify your age or identity, we hold the verification document only for the time needed to complete the check, and then delete it.
9. International data transfers
We operate from the United Kingdom. Several of our service providers process data in countries outside the UK, including:
- the United States — Google (Firebase, Google Cloud), Apple, and Stripe operate global infrastructure including US data centres;
- the European Economic Area — TheFork, OpenTable, and Mozrest operate primarily in the EEA, which the UK considers adequate.
For transfers outside the UK and EEA, we rely on appropriate safeguards under Articles 45 to 49 of the UK GDPR, including:
- adequacy decisions, where the receiving country has been recognised by the UK as offering equivalent protection;
- the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, where adequacy does not apply;
- other safeguards permitted by law.
A copy of the relevant transfer safeguard is available on request to privacy@paints.app.
10. Photography, video, and event content
Photos and video captured at Paints events are personal data when you are identifiable in them. We use this content for marketing, social media, editorial features, and member communications.
We rely on the licence you give us in our Terms when you attend a Paints event. You will be told in advance when an event will be photographed and will be offered a way to opt out.
You can ask us to remove your identifiable image from a channel under our control by emailing privacy@paints.app, subject to material already distributed beyond our control (for example, content already shared by other users).
11. Security
We use commercially reasonable technical and organisational measures to protect your information — including encryption in transit, hashed passwords via Firebase Authentication, role-based access controls, and least-privilege rules in Firestore. No system is perfectly secure, and we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately at contact@paints.app.
12. Your rights & choices
Under UK GDPR and equivalent laws you may have the following rights:
- Access the personal information we hold about you.
- Correct information that is inaccurate or incomplete.
- Delete your account and associated personal information, subject to legal exceptions.
- Object to processing based on legitimate interests, or restrict processing in certain cases.
- Portability — receive a copy of your data in a structured, commonly used, machine-readable format.
- Withdraw consent at any time, where we rely on consent. Withdrawal does not affect prior processing.
- Complain to your local data-protection authority. In the UK, you may complain to the Information Commissioner's Office (ICO) at ico.org.uk.
To exercise these rights, email us at privacy@paints.app. We will respond within the time period required by applicable law.
13. Children's privacy
The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information without verifiable parental consent, contact us and we will delete it. See also our Child Safety Standards Policy.
14. Changes to this policy
We may update this Policy from time to time. We will post the new version here and update the "Last updated" date above. For material changes, we will provide additional notice through the Service or by email. We encourage you to review this Policy periodically.
15. Contact us
For any privacy question or to exercise your rights, contact us at privacy@paints.app or by post at Paints Animation Ltd, Park Street, Windsor, Berkshire, SL4 1LB, United Kingdom.