Skip to content
    Purple+

    Home / Legal / Privacy

    Privacy Policy

    Purple Media Ltd
    3 Bedlam Court
    Gibraltar GX11 1AA
    hello@purpleplus.ai

    Last Updated: 5 October 2026

    Purple Media Ltd ("Purple+", "Purple Media", "we", "us" or "our") is committed to protecting and respecting your personal information and your privacy.

    This privacy policy (together with our Terms and Conditions and any other documents referred to in it) describes how we will collect, store and use personal information through our website at www.purpleplus.ai (the "Website") and the Purple+ platform (the "Services"). It also sets out your rights in relation to the personal information which we hold about you.

    Please read this privacy policy carefully to understand our practices regarding your personal information and how we will treat it.

    1. About Us

    1.1 Purple Media Ltd is a company registered in Gibraltar, whose registered office is at 3 Bedlam Court, Gibraltar GX11 1AA.

    1.2 We will only process personal information in accordance with the Gibraltar General Data Protection Regulation (Gibraltar GDPR), the Data Protection Act 2004, the Privacy and Electronic Communications (EC Directive) Regulations and any other applicable privacy laws.

    1.3 If you have any questions in relation to this privacy policy or how we collect, use or store your personal information, you can contact us by emailing hello@purpleplus.ai.

    2. Which Personal Information Will We Collect?

    We may collect and process any of the following information about you:

    2.1 Information you give us. You may give us information about yourself by using the online forms provided on the Website or by corresponding with us by phone, email or otherwise. This includes, without limitation, information you provide when you sign-up and register to use the Website, subscribe to our Services, ask a question via the Website, participate in discussion features, and/or when you report a problem with the Website or our Services.

    The information you give us may include:

    • Your name
    • Your job title
    • Your business address
    • Your telephone number and email address
    • Your business bank or building society account details and credit or debit card information
    • Your IP address

    2.2 Information we collect about you. Each time you visit our Website we will automatically collect the following information:

    • Technical information, including the Internet protocol (IP) address used to connect your computer to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform.
    • Information about your visit, including the full Uniform Resource Locators (URL), clickstream to, through and from our Website (including date and time), products you viewed or searched for, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page.

    2.3 Information we receive from other sources. This includes information we receive about you if you use any of the other websites we operate or the other services we provide. We work closely with third parties (including, for example, business partners, sub-contractors in technical, payment and delivery services, advertising networks, analytics providers, search information providers and credit reference agencies) and may receive information about you from them.

    3. Cookies

    3.1 Our Website uses cookies to distinguish you from other users of our Website. This helps us to provide you with a good experience when you browse our Website and also allows us to improve our site.

    3.2 For detailed information on the cookies we use and the purposes for which we use them, see our Cookie Policy.

    4. How Will We Use Your Personal Information?

    4.1 We will use the personal information we hold about you in the following ways:

    • To carry out our obligations arising from any contracts entered into between you and us and to provide you with information, products and Services that you request from us.
    • To provide you with information about other goods and services we offer that are similar to those that you have already purchased or enquired about.
    • To provide you, or permit selected third parties to provide you, with information about goods or services we feel may interest you (subject to your consent where required).
    • To notify you about changes to our Services.
    • To ensure that content from our Website is presented in the most effective manner for you and for your computer.
    • To administer our Website and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes.
    • To improve our Website and Services.
    • To allow you to participate in interactive features of our service, when you choose to do so.
    • As part of our efforts to keep our Website safe and secure.
    • To measure or understand the effectiveness of advertising we serve to you and others, and to deliver relevant advertising to you.
    • To make suggestions and recommendations to you and other users of our Website about goods or services that may interest you.

    4.2 For information obtained through connected Google and Microsoft services, the specific purposes, sharing restrictions and safeguards described in the connected-services sections of this policy take precedence over the general marketing, advertising and sharing provisions elsewhere in this policy.

    5. Legal Basis for Processing

    5.1 We will only process your personal data where we have a lawful basis to do so. The lawful bases we rely on are:

    • Consent: You have given clear consent for us to process your personal data for a specific purpose.
    • Contract: The processing is necessary for a contract we have with you, or because you have asked us to take specific steps before entering into a contract.
    • Legal obligation: The processing is necessary for us to comply with the law.
    • Legitimate interests: The processing is necessary for our legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect your personal data which overrides those legitimate interests.

    6. Disclosure of Your Information

    6.1 We may share your personal information with:

    • Any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries.
    • Business partners, suppliers and sub-contractors for the performance of any contract we enter into with them or you.
    • Advertisers and advertising networks that require the data to select and serve relevant adverts to you and others.
    • Analytics and search engine providers that assist us in the improvement and optimisation of our Website.

    6.2 We may disclose your personal information to third parties if we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of use and other agreements; or to protect our rights, property, or safety, or those of our customers or others.

    6.3 For information obtained through connected Google and Microsoft services, the specific purposes, sharing restrictions and safeguards described in the connected-services sections of this policy take precedence over the general marketing, advertising and sharing provisions elsewhere in this policy.

    7. Where We Store Your Personal Data

    7.1 The data that we collect from you may be transferred to, and stored at, a destination outside Gibraltar or the European Economic Area ("EEA"). It may also be processed by staff operating outside Gibraltar or the EEA who work for us or for one of our suppliers.

    7.2 Where we transfer your personal data outside Gibraltar or the EEA, we will ensure that it is protected in a manner that is consistent with how your personal data will be protected by us. This can be done in a number of ways, for instance by ensuring that the country in which your personal data will be processed has been deemed "adequate" by the relevant authority, or by using contracts in a form approved by the relevant authority.

    8. Data Retention

    8.1 We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

    8.2 To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

    9. Your Rights

    9.1 Under data protection laws, you have the following rights:

    • Right of access: You can ask for copies of your personal information.
    • Right to rectification: You can ask us to rectify inaccurate personal information.
    • Right to erasure: You can ask us to erase your personal information in certain circumstances.
    • Right to restriction of processing: You can ask us to restrict the processing of your personal information in certain circumstances.
    • Right to object to processing: You can object to the processing of your personal information in certain circumstances.
    • Right to data portability: You can ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
    • Right to withdraw consent: When we use consent as our lawful basis you can withdraw your consent at any time.

    9.2 If you wish to exercise any of these rights, please contact us at hello@purpleplus.ai.

    9.3 You have the right to make a complaint at any time to the Gibraltar Regulatory Authority (GRA), the Gibraltar supervisory authority for data protection issues (www.gra.gi).

    10. Security

    10.1 We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

    10.2 We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

    11. Google account and connected Google services

    Google sign-in and service connections

    When you use Google to sign in to Purple+, we receive your Google account identifier and the basic identity information you authorise, such as your name, email address and profile picture. We use this information to authenticate you and maintain your Purple+ account.

    Google sign-in does not, by itself, grant access to your Gmail mailbox, contacts, Drive files, documents, spreadsheets, calendar or advertising accounts. Access to those services requires the relevant authorisation.

    You connect Google services through the Connectors tab in Purple+. Selecting a service starts Google’s authorisation process, where you can review and grant the requested permissions. You also manage and disconnect your integrations through the Connectors tab.

    Gmail

    When you connect Gmail, Purple+ may access your mailbox address; message and conversation identifiers; senders, recipients, subjects and timestamps; message bodies; attachments; drafts; and mailbox labels and status information.

    We use this information to perform the email tasks you request, including finding and reading messages, retrieving recent conversations, summarising correspondence, preparing drafts and replies, handling attachments, and sending emails you approve. Supported mailbox-management actions are performed on your instruction.

    Purple+ requests Google’s Gmail permission gmail.modify for these features. This permission allows reading, composing and sending emails and supported mailbox changes. It does not permit immediate, permanent deletion of messages or conversations bypassing Gmail’s Trash.

    We use this permission only to provide the email features you authorise.

    Google Contacts

    If you authorise Google Contacts access, Purple+ may retrieve contact names, email addresses and other contact fields returned by the authorised service.

    We use this information to help you find people and address correspondence. Contact access does not authorise Purple+ to contact those people independently.

    Google Drive, Docs and Sheets

    When you enable these integrations, Purple+ may access files and folders within the permissions you grant. This may include file names and identifiers, file types, folder locations, ownership and sharing metadata, and the contents of authorised files, documents and spreadsheets.

    We use this information to perform supported tasks you request, such as finding and reading files, summarising documents, analysing spreadsheet data, creating or editing documents and spreadsheets, and saving or exporting your work.

    The scope of access depends on the permissions displayed by Google during authorisation. Where access is limited to individually selected files, it does not grant access to your entire Drive.

    Google Calendar

    When you connect Google Calendar, Purple+ may access authorised calendar identifiers and names, event titles and descriptions, dates and times, time zones, locations, attendee details, meeting links and availability information.

    We use this information to perform supported calendar tasks you request, such as checking availability, finding events, and creating, updating or deleting events. Inviting attendees or changing an event may send notifications through Google Calendar.

    Google Analytics, Search Console and Ads

    Depending on the integrations you enable, Purple+ accesses:

    • Google Analytics: website traffic, audience and performance information through read-only access.
    • Google Search Console: search performance, search queries and indexing information through read-only access.
    • Google Ads: advertiser account identifiers, names, currency and status; campaigns, budgets, ad groups, ads, keywords, targeting and creative assets; and performance information including impressions, clicks, spend, conversions, CPA and ROAS.

    These disclosures apply to both information received directly from Google and reports, summaries or aggregated information derived from it.

    We use connected Google data to provide the analytics, reporting, insights and advertising-management features you request in Purple+.

    For Google Ads, authorised users can review and confirm campaign creation and supported changes to campaigns, budgets, targeting, keywords and creatives. Campaigns may be created enabled and begin serving after Google’s checks, according to the settings the user confirms. Users can also pause campaigns.

    The Google Ads integration requests the adwords permission for these operations. Google Data Manager is currently disabled: this release does not request the datamanager permission or provide Data Manager conversion-event or Customer Match member uploads.

    Your instructions and approvals

    Connecting a service authorises access within the permissions granted. It does not give Purple+ unrestricted permission to send messages, share files or change your account.

    You can give task instructions through Purple+’s assistant. Actions are performed in response to your instructions and the applicable approval controls.

    Where you expressly authorise a recurring workflow, it may carry out actions within the scope and schedule you have approved. You manage the underlying service connection through the Connectors tab.

    AI processing

    When you request an AI-assisted feature, relevant connected content and your instructions may be processed by the AI service providers used to operate that feature. For example, summarising a conversation requires processing the relevant messages, and analysing a spreadsheet requires processing the relevant spreadsheet data.

    We limit the content supplied to what is needed for the requested task.

    We do not use connected Google Workspace content, or information derived from it, to train, fine-tune or improve general-purpose or shared AI or machine-learning models. We require providers processing that content on our behalf to comply with the same restriction.

    AI processing is used to deliver your requested feature. Your mailbox, files, contacts and calendar are not used to create a dataset for training shared AI models.

    Sharing and service providers

    We do not sell connected Google user data.

    Providers operating our hosting, databases, authentication, integration infrastructure and AI-assisted features may process the information necessary to deliver those features on our behalf, subject to appropriate contractual restrictions and security safeguards.

    When you instruct Purple+ to send an email, invite an attendee, share a file or export content, the information needed to carry out that action is transmitted to the service and recipients you specify.

    Connected content and generated outputs may be available to other members of your Purple+ workspace where your sharing choices and the workspace’s access permissions permit it.

    We do not use Google Workspace content or information derived from it for advertising targeting, retargeting, audience creation, data brokerage, credit scoring or unrelated third-party marketing. These restrictions apply even where other parts of this policy describe advertising or marketing activities.

    Human access

    Our personnel and service providers do not routinely read your connected Google Workspace content.

    Human access is limited to circumstances permitted by Google’s policies: where you explicitly agree to access to specific content; where access is necessary to investigate security issues or abuse or meet legal obligations; or where aggregated and anonymised information is used for permitted internal operations.

    Security

    We communicate with Google using encrypted connections. OAuth access and refresh tokens are stored encrypted on our backend. Access to connected data is controlled through authentication and applicable account and workspace permissions.

    Retention

    We retain connection credentials while needed to maintain an authorised integration.

    Retrieved content, attachments and temporary processing data are retained only as necessary to provide the requested feature and subject to applicable Google requirements.

    Content included in your Purple+ conversations, saved outputs or authorised workflows may have a separate retention lifecycle from the connection itself. Disconnecting a service should therefore not be treated as a request to delete all previously saved Purple+ content.

    Disconnection and deletion

    You can disconnect a Google integration at any time from the Connectors tab in Purple+. Disconnection stops subsequent access through that connection and removes its active stored credentials.

    You can also revoke Purple+’s authorisation through your Google Account’s third-party connections settings.

    Disconnecting does not delete messages, files, documents, spreadsheets, events or advertising campaigns from your Google account. It also does not delete your separate Purple+ account.

    To request deletion of connected data retained by Purple+, or deletion of your Purple+ account, contact hello@purpleplus.ai. We will explain any applicable legal retention requirements and any remaining backup-retention limitations when responding to your request.

    Google Limited Use commitment

    Purple+’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Our use of Google Workspace data also complies with the Google Workspace API User Data and Developer Policy.

    12. Microsoft account and connected Microsoft services

    Connection and permissions

    You connect supported Microsoft services through the Connectors tab in Purple+. Selecting a service starts Microsoft’s authorisation process, where you can review and grant the requested permissions. You also manage and disconnect your integrations through the Connectors tab.

    Purple+ accesses information within the permissions you grant. We do not receive your Microsoft password.

    Outlook email and contacts

    For Outlook email, we may access your mailbox address; message and conversation identifiers; senders and recipients; subjects and timestamps; message bodies; attachments; drafts; folders; and read status.

    We use this information to find and read correspondence, retrieve recent conversations, summarise messages, prepare drafts and replies, handle attachments, send emails you approve, and perform supported mailbox-management tasks you request.

    Where you authorise contact access, we use the authorised contact information to help you find people and address correspondence.

    Microsoft calendars and files

    Where you connect a supported Microsoft calendar integration, we use authorised calendar and event information, including dates, times, attendees and availability, to perform the scheduling tasks you request.

    Where you connect supported OneDrive, SharePoint or Microsoft document integrations, we use authorised file metadata and content to perform the file and document tasks you request.

    Instructions and AI processing

    Connecting an account does not give Purple+ unrestricted permission to send messages, share files or change your account. Tasks are performed in response to your instructions and the applicable approval controls, including any recurring workflow you expressly authorise.

    Relevant Microsoft content may be processed by our AI service providers when necessary to deliver an AI-assisted task you request. We do not use that content to train general-purpose or shared AI models, and require providers processing it on our behalf to comply with the same restriction.

    Sharing and security

    We do not sell connected Microsoft data or use it for unrelated advertising, data brokerage or third-party marketing.

    We share relevant information only as necessary with providers operating the requested service, with recipients you specify, with workspace members permitted by your sharing settings, or where required for security or legal obligations.

    Connections use encrypted transport. OAuth tokens are stored encrypted on our backend. Access is controlled through authentication and applicable account and workspace permissions.

    Retention, disconnection and deletion

    We retain credentials while needed to maintain an authorised connection. Connected content is retained only as necessary for the requested features and any content you choose to save in Purple+.

    You can disconnect a Microsoft integration at any time from the Connectors tab in Purple+. Disconnection stops subsequent access through that connection and removes its active stored credentials.

    You can also revoke Purple+’s authorisation through the relevant Microsoft account or organisation controls.

    Disconnecting does not delete information from your Microsoft account. Content already included in Purple+ conversations or saved outputs may remain until separately deleted.

    To request deletion of connected data retained by Purple+, or deletion of your Purple+ account, contact hello@purpleplus.ai.

    13. Meta (Facebook & Instagram) API Data

    Our Services integrate with Meta's Marketing API to help you create and manage advertising campaigns on Facebook and Instagram. When you connect your Meta account via Facebook Login, we access the following data:

    Account Information:

    • Your Facebook user ID, name, and email address.
    • Your Meta ad account names, IDs, currency settings, and account status.
    • Your Facebook Page names, IDs, and categories.

    Advertising Data (read and write):

    • Campaign, ad set, ad, and ad creative data.
    • Campaign performance metrics including spend, impressions, clicks, conversions, CPA, and ROAS.
    • Audience targeting information including interests, demographics, and geographic data.
    • Ad creative content including primary text, headlines, descriptions, and image assets.

    When you connect your Meta Ads account, our platform may create, edit, pause, resume, and manage advertising campaigns, ad sets, ads, and ad creatives on your behalf. All campaign creation actions require your explicit approval before execution. Campaigns are created in a paused state and are only activated with your direct confirmation. Ads are published from your selected Facebook Page.

    We store your Meta access tokens securely in our encrypted database. Meta access tokens have a maximum lifetime of 60 days, after which you will need to reconnect your account. We do not store your Facebook password.

    We do not sell, share, or transfer your Meta advertising data to any third parties. Your Meta data is used solely to provide advertising management and analytics features within the Purple+ platform.

    You can disconnect your Meta account at any time through the Integrations page in your Purple+ dashboard. Upon disconnection, we immediately revoke the stored access token, remove your Meta data from our systems, and cease all API access to your Meta ad accounts.

    Data Deletion: If you wish to request deletion of all data associated with your Meta account, you can do so by emailing hello@purpleplus.ai. We will process deletion requests within 30 days.

    Our use of Meta APIs complies with Meta's Platform Terms and Developer Policies.

    14. Changes to This Policy

    14.1 We may update this privacy policy from time to time. We will notify you of any changes by posting the new privacy policy on this page with a new "Last Updated" date.

    14.2 You are advised to review this privacy policy periodically for any changes.

    15. Contact

    If you have any questions about this privacy policy or our privacy practices, please contact us at:

    Purple Media Ltd
    3 Bedlam Court
    Gibraltar GX11 1AA
    Email: hello@purpleplus.ai