Privacy Policy

1. Who we are

purplebutter ("we", "us", "our") operates the purplebutter platform at purplebutter.io, a threat-informed security awareness training service. The game library is free to play for anyone, with no account required. This policy explains how we collect, use, and protect your personal data when you use our website and services.

2. Data we collect

No account or sign-up is required to play. We collect only the following:

• Contact form data: name, email, company (if provided), and message content when you submit a contact form — including enterprise/SCORM inquiries.
• Technical data: IP address, browser type, device type, and pages visited. We collect this through server logs and privacy-friendly analytics to keep the service secure and to understand which games are played.

3. How we use your data

We use your personal data to:

• Respond to your inquiries, including enterprise/SCORM requests
• Operate and secure the platform
• Understand aggregate usage of the game library

We do not sell your personal data. We do not send marketing emails, and we do not use your data to build advertising profiles.

4. Legal basis for processing (GDPR)

We process your personal data based on:

• Consent: when you submit a contact or enterprise inquiry form
• Legitimate interest: to maintain platform security, prevent abuse, and understand aggregate usage of the service
• Legal obligation: to comply with applicable tax, accounting, and regulatory requirements where relevant (e.g., for Enterprise customer agreements)

5. Third-party services

We share data with the following third-party processors:

• Hosting provider — infrastructure and content delivery. Servers are located in the EU/US.
• Analytics provider — privacy-friendly, cookie-free traffic analytics. No personal profiles are built from this data.

We do not use third-party advertising networks or tracking pixels.

6. Data retention

Contact and enterprise inquiry submissions are retained for 12 months, then deleted, except where a resulting customer agreement requires longer retention (e.g., billing records for tax purposes, retained for up to 10 years). Server logs are retained for a limited period for security purposes and then rotated out.

7. Your rights

Depending on your jurisdiction, you may have the right to:

• Access, correct, or delete your personal data
• Export your data in a portable format
• Restrict or object to processing
• Withdraw consent for optional processing
• Lodge a complaint with a supervisory authority

To exercise these rights, contact us at privacy@purplebutter.io or use the contact form.

8. Cookies

We do not use advertising or tracking cookies. Any analytics we use is cookie-free. No cookie consent banner is required for this level of data collection under EU law.

9. AI use and transparency

This platform — including its website, code, and portions of its training game content — was built with the assistance of AI tools. AI assistance was used as a development aid; all content is reviewed before publication. No part of the platform uses your personal data to train AI models, and we do not run AI systems against your personal data as part of the service. See our Terms of Service for more detail on AI use in relation to the Service, including in the context of the EU AI Act.

10. Security

We protect your data using encryption in transit (TLS), encryption at rest, and access controls. We regularly review our security practices. If you discover a security vulnerability, please report it to security@purplebutter.io.

11. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top reflects the most recent revision. Material changes will be reflected on this page.

12. Contact

For privacy-related inquiries, contact us at privacy@purplebutter.io or via the contact form.