Privacy Policy

Last updated: 23 August 2026

This Privacy Policy explains how Paints Animation Ltd ("Paints", "we", "us") collects, uses, shares, and protects information about you when you visit our website or otherwise interact with the Paints Service. By using the Service you confirm that you have read and understood this Policy.

1. Who we are

The data controller is Paints Animation Ltd, Park Street, Windsor, Berkshire, SL4 1LB, United Kingdom. For any privacy question, contact us at contact@paints.app.

Our privacy contact is privacy@paints.app. We have not appointed a formal Data Protection Officer under Article 37 of the UK GDPR; we will appoint one if and when our processing requires it.

2. Information we collect

2.1 Information you give us

2.2 Information we collect automatically

2.3 Information from third parties

• If you sign in with Google, we receive the basic profile information you authorise (typically name, email, and a unique identifier).
• Venue and event partners may share attendance confirmations or feedback related to experiences you booked through Paints.

2.4 Special category data

Some of the answers you give during Paints onboarding may include special category data under Article 9 of the UK GDPR, including:

• information that reveals sexual orientation or sexual life (for example, your answer to romantic openness or who you would like to be matched with);
• information about religious or philosophical beliefs (for example, your answers about spirituality);
• information that may reveal racial or ethnic origin (for example, nationality or place of birth).

We process this information only with your explicit consent, which you give during onboarding by completing these optional questions. You can withdraw consent at any time by editing your profile in the app or by emailing privacy@paints.app, at which point we will stop using the data for matching and either delete it or anonymise it.

We do not use special category data for any purpose other than matching, recommending events, and improving the Service.

3. How & why we use your information

• Provide the Service — create and authenticate your account, run onboarding, deliver event and venue recommendations, form groups, and process subscriptions.
• Personalise your experience — tailor suggestions and content based on your taste responses, preferences, city, and past activity.
• Prepare reviewed matching proposals — OpenAI may propose group composition and choose a primary and backup venue only from the curated IDs Paints supplies. Inputs use opaque candidate IDs, bounded matching attributes, and coarse area data; they exclude names, emails, Firebase identifiers, biographies, and exact coordinates. Deterministic safety checks and a Paints operator review every proposal before any group can be committed.
• Communicate with you — send transactional messages (sign-in codes, receipts, subscription notices) through Resend, product updates, and — only with your consent where required — marketing emails.
• Improve and develop the Service — analyse server logs and service reliability, debug faults, and evaluate matching and recommendation quality.
• Safety, security & fraud prevention — detect abuse, enforce our Terms, protect users and partners, comply with legal obligations.
• Comply with law — respond to lawful requests, manage tax and accounting records, and exercise or defend legal claims.

Marketing communications

We send you two kinds of email:

• Transactional emails — sign-in codes, receipts, subscription notices, event confirmations, safety information, and changes to these policies. These are essential to providing the Service and you cannot opt out while your account is active.
• Marketing emails — product updates, new launches, recommendations, and editorial features. We send these to you only with your consent, which we obtain during sign-up or in your profile. You can unsubscribe at any time using the link at the bottom of any marketing email, or by emailing privacy@paints.app. Unsubscribing does not affect transactional emails.

4. Legal basis (UK GDPR)

We rely on the following lawful bases under the UK GDPR and the Data Protection Act 2018: (a) contract, where processing is necessary to provide the Service you requested; (b) legitimate interests, for example to keep the Service secure and improve it, balanced against your rights; (c) consent, for non-essential cookies, marketing, and precise location; and (d) legal obligation, where we are required to retain or disclose information by law.

5. Automated decision-making and profiling

We use an automated matching engine to suggest events, form groups, and recommend connections. This involves profiling — building a picture of your taste, social preferences, and likely fit with other members.

Automated matching does not produce legal effects on you, and we do not consider it to significantly affect you within the meaning of Article 22 of the UK GDPR. You retain full control over which events you book and which connections you accept.

If you would like a human review of a specific match decision, or if you would like to object to profiling, email privacy@paints.app. We will respond within one month.

6. Who we share your information with

We do not sell your personal information. We share it only with the categories of recipient below, and only for the specific purposes listed.

Service providers acting on our instructions:

• Google (Firebase, Google Cloud) — authentication. Data may be processed in the United States.
• MongoDB Atlas — application, account, booking, matching, safety, and operational records.
• Vercel Hosting and private Vercel Blob — website hosting, server execution, and private customer media storage and delivery.
• Stripe (including Stripe Connect and Stripe Identity) — membership and event payments, refunds, disputes, host accounts and payouts, and identity checks. Stripe acts as an independent controller for payment data; see stripe.com/privacy.
• Resend — transactional service-email delivery: sign-in codes, receipts, subscription notices, and product updates.
• Mapbox — address and location search.
• OpenAI — privacy-reduced, review-only group and curated-venue proposals. Model output cannot directly publish a group or venue.

Venue and event partners: We share the information they need to host you — typically attendance confirmation, group size, first name, and any dietary requirements.

Authorities and law enforcement: Where we have a good-faith belief that disclosure is necessary to comply with law, protect users, or defend our rights.

Successors: In a merger, acquisition, or asset sale, subject to confidentiality protections and continued application of this Policy.

We keep this list current. When we add a new significant processor, we will update this section before that processor begins handling your data, and we will give material notice through the Service where required by law.

7. Cookies, analytics & tracking

Our website uses minimal cookies and local storage required for the site to function. Optional, first-party product analytics are off by default and begin only if you switch on Help improve Paints in your profile. Approved interactions are sent directly to PostHog and are not copied into the Paints database. They record bounded interaction facts such as opening, viewing, booking, or publishing an event and the relevant content ID and city. They do not record Story text, search text, precise location, date of birth, protected matching answers, or arbitrary event metadata. You can withdraw consent in your profile at any time; doing so stops future collection. We do not use advertising trackers or sell this data.

8. How long we keep your information

Account deletion is irreversible and starts immediately after you confirm the request. We remove personal account data and anonymise shared records, retaining only records that must remain for financial, safety, fraud-prevention, or legal reasons. Provider systems may take additional limited time to finish an accepted deletion request.

If we ask you to verify your age or identity, we hold the verification document only for the time needed to complete the check, and then delete it.

9. International data transfers

We operate from the United Kingdom. Several of our service providers process data in countries outside the UK, including:

• the United States — Google (Firebase, Google Cloud), MongoDB Atlas, Vercel, Stripe, Resend, Mapbox, and OpenAI operate global infrastructure including US data centres.

For transfers outside the UK and EEA, we rely on appropriate safeguards under Articles 45 to 49 of the UK GDPR, including:

• adequacy decisions, where the receiving country has been recognised by the UK as offering equivalent protection;
• the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, where adequacy does not apply;
• other safeguards permitted by law.

A copy of the relevant transfer safeguard is available on request to privacy@paints.app.

10. Photography, video, and event content

Photos and video captured at Paints events are personal data when you are identifiable in them. We use this content for marketing, social media, editorial features, and member communications.

We rely on the licence you give us in our Terms when you attend a Paints event. You will be told in advance when an event will be photographed and will be offered a way to opt out.

You can ask us to remove your identifiable image from a channel under our control by emailing privacy@paints.app, subject to material already distributed beyond our control (for example, content already shared by other users).

11. Security

We use commercially reasonable technical and organisational measures to protect your information — including encryption in transit, hashed passwords via Firebase Authentication, and role-based access controls. No system is perfectly secure, and we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately at contact@paints.app.

12. Your rights & choices

Under UK GDPR and equivalent laws you may have the following rights:

• Access the personal information we hold about you.
• Correct information that is inaccurate or incomplete.
• Delete your account and associated personal information, subject to legal exceptions.
• Object to processing based on legitimate interests, or restrict processing in certain cases.
• Portability — receive a copy of your data in a structured, commonly used, machine-readable format.
• Withdraw consent at any time, where we rely on consent. Withdrawal does not affect prior processing.
• Complain to your local data-protection authority. In the UK, you may complain to the Information Commissioner's Office (ICO) at ico.org.uk.

To exercise these rights, email us at privacy@paints.app. We will respond within the time period required by applicable law.

13. Children's privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information without verifiable parental consent, contact us and we will delete it. See also our Child Safety Standards Policy.

14. Changes to this policy

We may update this Policy from time to time. We will post the new version here and update the "Last updated" date above. For material changes, we will provide additional notice through the Service or by email. We encourage you to review this Policy periodically.

15. Contact us

For any privacy question or to exercise your rights, contact us at privacy@paints.app or by post at Paints Animation Ltd, Park Street, Windsor, Berkshire, SL4 1LB, United Kingdom.