We collect information you provide when creating your account: email address, display name, profile details (age, gender, orientation, location, bio, kinks, preferences), and photos you upload.
We also collect usage data (pages visited, swipe activity, feature usage) to improve the platform. We do not sell or share personal data with advertisers.
2. How We Use Your Data
To provide the matching, messaging, and social features of the platform
To verify your identity and age via Yoti, a UK-based regulated identity provider — Yoti receives your ID document and selfie; Purple Vixen only receives a verified yes/no flag
To display your profile to other users based on your visibility preferences
To serve contextual (not personalised) ads to free users
To improve the platform and fix bugs
To enforce our Terms of Service and protect user safety
3. Advertising & Privacy
We never share your personal data, profile details, kink preferences, or activity with advertisers. Ads are served contextually based on the section of the app you are using (e.g. events section, discovery section), not based on your personal information or browsing behaviour. We use specialist ad networks appropriate for lifestyle content.
4. Photo Privacy
Purple Vixen supports three photo categories:
Public photos: Visible to all users who match your visibility preferences
Private photos: Only visible to users you explicitly grant access to
CSAM hash-matching: Every uploaded image is automatically hashed and the hash is checked against a database of known child sexual abuse material maintained by Project Arachnid (Canadian Centre for Child Protection) and/or Microsoft PhotoDNA. The image itself does not leave Purple Vixen — only an opaque hash is shared. Matches are quarantined, the user is suspended, and a report is filed with the Internet Watch Foundation (UK). This is required to comply with the Online Safety Act 2023 and is industry-standard practice.
Verification photos (legacy / fallback only): Only visible to Purple Vixen verification staff. Stored on UK-region object storage with operating-system-level access controls. Never shared with other users. Purged upon account deletion.
Age verification documents (Yoti flow): Identity documents submitted to Yoti for age and identity verification never reach Purple Vixen servers. Yoti is the controller for those documents under their published privacy policy and ISO 27001 / 27018 certifications. Purple Vixen only receives a verified yes/no flag and an opaque session id, used to support your right to erasure (we call Yoti's deletion API when you delete your account or withdraw consent).
5. Data Retention & Deletion
You can delete your account at any time from Settings. Account deletion permanently removes all profile data, photos (including verification photos), messages, matches, points balances, and associated data. This action cannot be undone. We may retain anonymised, aggregated data for analytics purposes.
Age verification documents held by Yoti are subject to Yoti's retention policy (typically up to 13 months unless extended for fraud or dispute reasons). When you delete your Purple Vixen account, or withdraw consent in Settings, we automatically call Yoti's deletion API to remove your verification record from their systems as well as our own.
Legacy verification photos held by Purple Vixen prior to the move to Yoti are being retired; they will be migrated or deleted by 31 May 2026.
6. Third-party processors
We use the following processors. Each is governed by a Data Processing Agreement and processes data only on our documented instructions.
Project Arachnid / Microsoft PhotoDNA — CSAM hash-matching. Only an opaque image hash is shared, never the image itself.
Internet Watch Foundation (IWF) (UK) — recipient of CSAM reports. Reports are filed via Project Arachnid's onward-reporting pipeline, with supplementary reports made via IWF's public reporting tool where appropriate.
We do not use DeepSeek or any AI service hosted outside the UK/EU for verification data. (Earlier versions of the platform did; that flow was retired in April 2026 and is no longer in use.)
7. Your Rights
Under UK GDPR you have the rights to access, rectify, erase, port, restrict, and object to the processing of your personal data, plus the right to withdraw consent at any time without affecting the lawfulness of prior processing.
Subject access / data export (Article 15): Settings → Privacy & Your Data → Download my data. Returns a JSON file with all data we hold about you. Excludes records of other people's reports about you (Article 15(4)) and Yoti-held identity documents (request those directly from Yoti).
Erasure (Article 17): Settings → Account → Delete account. Also triggers Yoti deletion API for your verification record.
Rectification (Article 16): Edit your profile in Settings, or email us for fields you can't edit yourself.
Appeal a moderation decision (OSA Section 17): Settings → Account Status → Appeal.
Other requests / complaints: privacy@purplepandaconsulting.co.uk. We respond within 30 days. You also have the right to complain to the ICO at ico.org.uk.
8. Cookies
We use essential cookies for authentication and session management. We do not use tracking cookies for advertising purposes. Ad networks may use their own cookies subject to their privacy policies.
Purple Vixen is operated by Purple Panda Consulting Ltd. Registered in England & Wales.