Last updated: [date of publication]
This policy explains what personal data Loaded Brush collects, why, who we share it with, and the choices you have. It covers our website (loadedbrush.app), our Help Centre (support.loadedbrush.com), the waitlist, and the Loaded Brush app.
1. Who we are
Loaded Brush is run by Loaded Brush Ltd, a company registered in England and Wales (company number 17133114), registered office Suite RA01, 195-197 Wood Street, London, E17 3NU. We are the controller of your personal data under UK GDPR and the Data Protection Act 2018. [ICO registration number – LB-20]
Contact for anything in this policy: support@mail.loadedbrush.com.
2. What we collect
| Data | Where it comes from | Examples |
|---|---|---|
| Contact data | You: waitlist, sign-up, support | Email address, name, support messages |
| Age | You, at sign-up | Date of birth (to check you're 16 or over and to apply under-18 settings) |
| Account and content | You, in the app | Username, profile photo, banner, bio, posts, photos, comments, likes, follows, pages, reports you make, people you block |
| Data kept only on your device | You, in the app | Palette, wishlist, custom mixes, collections. We don't receive these. |
| Camera and photos | Your device, with permission | Camera is used to scan paint labels; photos you choose to attach. We only receive photos you upload. |
| Technical and security data | Your device | IP address (at sign-up, login and when you upload), device and app version, push notification token |
| Moderation data | Our safety systems and staff | Safety scan results, reports, warnings, suspensions, bans |
| Advertising data | Google AdMob, in the app | Advertising ID and ad interactions (personalised only with your consent and never if you're under 18) |
| Usage data (only with consent) | Analytics on the website and in the app | Screens viewed, features used. We never send the text of your searches, comments or posts to analytics. |
| Consent records | Our consent tools (Ketch on the website; Google's consent message in the app) | Your choices and when you made them |
3. Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Providing your account and the app's features | Contract |
| Checking you are 16 or over | Legal obligation / legitimate interests |
| Scanning content for safety before it's public, reviewing reports, enforcing our rules | Legal obligation (Online Safety Act 2023) and legitimate interests |
| Detecting and reporting child sexual abuse material | Legal obligation (Online Safety Act 2023, s.66) |
| Keeping the service secure; preventing fraud, spam and ban evasion | Legitimate interests |
| Running the waitlist and early-access emails | Consent |
| Answering support requests | Legitimate interests / contract |
| Showing ads that fund the free app | Legitimate interests for non-personalised ads; consent for personalised ads |
| Analytics | Consent |
| Records we must keep (tax, consent) | Legal obligation |
4. Safety scanning
Before your posts, comments, images, bio and page details are public, they are checked by automated moderation tools, including OpenAI's moderation service. Uploaded images are sent to the Canadian Centre for Child Protection (Arachnid Shield), which hash-matches them against known child sexual abuse material. Images that already matched our own hash list are not sent. A Shield match is not sent to any other scanner. The results are used only to keep Loaded Brush safe, never for advertising. Staff may review content that is flagged or reported.
5. Cookies and similar technologies (website)
When you first visit, a consent banner (Ketch) asks for your choice. In the UK and EU, analytics and advertising tools stay off until you accept them. You can change your mind with the privacy button at the bottom-left of the site.
| Category | Provider | Purpose | Cookies / storage |
|---|---|---|---|
| Strictly necessary | Ketch | Remembers your consent | _swb, local storage |
| Strictly necessary | Cloudflare | Security and performance | __cf_bm (only when needed) |
| Strictly necessary | Loaded Brush | Keeps you signed in | [session cookie name] |
| Analytics (consent) | Google Analytics 4 | Usage statistics | _ga, _ga_TYXW6VF6TP |
| Analytics (consent) | Matomo Cloud (InnoCraft) | Usage statistics | _pk_id, _pk_ses |
| Analytics (consent) | Microsoft Clarity | Heatmaps and session replays; inputs masked | _clck, _clsk, CLID |
Cloudflare Web Analytics is also used; it doesn't use cookies or identify visitors. We don't run advertising trackers on the website.
In the app, Google's consent message asks UK and EEA users whether ads can be personalised, and you can change this later in Settings → Ad privacy. On iOS, Apple asks whether we may track you. If you're under 18, ads are never personalised whatever you choose.
6. Who we share data with
We don't sell your personal data. We share it only with providers who process it for us under contract, and with authorities where the law requires.
| Provider | What they do | Location |
|---|---|---|
| Supabase (on AWS) | App database, sign-in, admin tools | Ireland (EU) and London |
| Bunny.net | Storing and delivering images | EU-based, global edge network |
| OpenAI | Automated safety scanning of text and images | USA |
| Canadian Centre for Child Protection (Arachnid Shield) | Hash-matching uploaded images we send them against known child sexual abuse material | Canada |
| Google (AdMob) | Ads in the app | USA / global |
| Google (Analytics / Firebase) | Analytics, with consent | USA / global |
| InnoCraft (Matomo Cloud) | Website analytics, with consent | [EU – confirm region] |
| Microsoft (Clarity) | Website usability analytics, with consent | USA / global |
| Cloudflare | Website hosting and security | Global |
| Ketch | Consent management | USA |
| Loops | Waitlist and account emails | USA |
| DigitalOcean | Hosting the Help Centre and support tickets | London |
| Apple / Google | App stores and push notifications | USA / global |
| [Stripe] | [Payments, only if Pro is sold on the web – LB-81] | [USA / EU] |
Authorities. If we find child sexual abuse material, we must report it to the UK National Crime Agency, including the content and information about the account that posted it. We may also share data with the police or courts where the law requires it, or to protect someone's safety.
7. International transfers
App data is stored in Ireland and London. Where providers process data outside the UK and EU, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified) or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
8. How long we keep it
- Your account and content: while your account is open. When you delete your account, we delete everything within 30 days, and backups are overwritten within a further 30 days.
- Waitlist: until you unsubscribe; deleted 12 months after launch if you don't create an account.
- Support tickets: 2 years after they close.
- IP addresses: [at least 3 months – confirm in LB-76].
- Moderation records (reports, warnings, suspensions): [period – LB-76].
- Analytics: 14 months (Google Analytics, Matomo); about 30 days for Clarity recordings.
- Payment and tax records: 6 years (HMRC).
- Consent records: while relevant, and up to 6 years after.
What we keep after you delete your account, because the law requires it or to keep people safe:
- Evidence of child sexual abuse material and the related account information: 1 year after we report it to the National Crime Agency, and the report reference for 5 years.
- The email address of a permanently banned account, so it can't sign up again.
- Payment and tax records, as above.
9. Your rights
Under UK GDPR (and EU GDPR if you're in the EEA) you can access, correct, delete, restrict, object to, or receive a copy of your data, and withdraw consent at any time. Email support@mail.loadedbrush.com or raise a Help Centre ticket (Privacy inquiries). We'll respond within one month. You can delete your account in Settings, or at [web deletion page – LB-80].
You can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113). We'd appreciate the chance to help first.
10. Age
Loaded Brush is for people aged 16 and over. We ask for your date of birth at sign-up. If you're 16 or 17, your account gets our most private settings and ads are never personalised. If we learn someone under 16 has an account, we close it and delete their data.
11. Security
We use encryption in transit, access controls and reputable providers. No system is perfectly secure; if a breach puts you at risk, we'll tell you and the ICO as the law requires.
12. Changes
If we make significant changes, we'll tell you by email or in the app before they take effect.