Privacy Policy

1. Who is responsible for your data

The controller for personal data processed through Herpegram is the person or legal entity operating the Herpegram service. The controller's full legal name, postal/service address and privacy contact must be inserted here before public commercial launch.

Where a supplier processes data only on Herpegram's instructions, that supplier acts as a processor or sub-processor as applicable. Some third parties, including an age-assurance provider depending on its role and service design, may act as independent controllers for their own purposes.

2. Data we may collect

Herpegram does not require users to expose their real-world identity publicly and is designed to minimise the personal data collected directly by Herpegram. The exact data processed depends on which features you use. The current architecture may process the following categories.

• Account and pseudonymous identity data: account identifiers, authentication/contact information where required to operate or secure the account, Variant number and authentication identifiers. These records may be personal data even though the public Sewer displays a Variant number rather than a real name.
• Age-verification status: confirmation supplied by the designated third-party provider that the eligibility requirement has been met, together with limited verification metadata where reasonably necessary. Herpegram does not receive or retain the underlying passport, identity document, selfie, date of birth or other source material used by the provider to perform the age check.
• Profile data: the profile fields you provide, Herbert/avatar selection, region, gender where required by the service, occupation, location fields, nationality or language preferences, and optional profile information.
• Content and social data: Contaminations, comments/Vomits, reactions, polls, Mutations, mutation requests, mentions, Clusters, reports and other interactions.
• Security data: sessions, browser/device identifiers and names, trusted-device state, authentication events, MFA/passkey information, security events, rate-limit data and access-control records.
• Approximate location and connection data: IP-derived or request-derived country/region information and, where a security feature expressly uses it, device/session geolocation information.
• Preference data: theme, text size, language, feed settings, notification choices, privacy choices, blocking and conversation preferences.
• Moderation and safety data: reports, report reasons, evidence snapshots, enforcement records, blocked-Variant relationships and relevant contextual information.
• Subscription and transaction data if paid services launch. Payment-card details should ordinarily be handled by the payment provider rather than stored directly by Herpegram unless expressly stated otherwise.
• Technical data: request metadata, error/security logs and information reasonably necessary to diagnose failures, defend the service and prevent abuse.

3. Information you make visible to other users

Herpegram is pseudonymous, not necessarily private. Content you post to shared areas of the service can be visible to other authorised users according to the feature's access rules. Profile fields marked as visible may also be displayed to other Variants.

If you voluntarily publish your real name, photograph, social-media account, employer, contact details or other identifying information, that information becomes part of the User Content you chose to disclose. Herpegram cannot restore pseudonymity once other users have seen, copied or acted on information that you voluntarily made available. You should not put information into public or shared content that you do not want other users to see or use to identify you outside Herpegram.

Herpegram may restrict direct access to real-world identity data while still displaying pseudonymous activity.

4. Why we use personal data and our lawful bases

We determine the lawful basis for each processing purpose before using personal data. Depending on the activity, we may rely on performance of our contract with you, compliance with a legal obligation, our legitimate interests, consent, or another basis available under UK data-protection law.

Our legitimate interests can include operating and securing the service, preventing fraud and abuse, protecting users, investigating reports, maintaining service integrity, improving functionality and defending legal claims, provided those interests are not overridden by your rights and interests.

• Account creation, authentication and requested service features: generally necessary to perform the user agreement or take requested pre-contract steps.
• Security, fraud prevention, abuse detection and platform integrity: generally legitimate interests and, where applicable, legal obligations.
• Moderation, reporting and safety investigations: legitimate interests, contractual enforcement and/or legal obligations depending on the case.
• Optional communications or non-essential technologies: consent where the law requires consent.
• Billing, accounting, tax and statutory records: performance of contract and/or legal obligation.
• Legal requests, regulatory compliance and defence of claims: legal obligation and/or legitimate interests as appropriate.

5. Special category and sensitive information

Some profile fields, posts or reports may reveal information that UK data-protection law treats as special category data, such as health information, political opinions, religious beliefs, sexual orientation or certain other sensitive characteristics. Herpegram does not require users to publish such information merely to participate unless a specific feature lawfully requires a particular field.

Where Herpegram itself intentionally processes special category data for a defined purpose, we will identify both an Article 6 lawful basis and an applicable special-category condition before that processing begins. Users should avoid disclosing unnecessary sensitive information about other people.

6. Gender and profile attributes

Where Herpegram requires a gender field for a current product function, such as enforcing the available Herbert/avatar catalogue, that field is account/profile data and is handled under the same data-protection principles as other profile information. We will not describe a field as anonymous merely because it is not shown publicly.

If the purpose for a mandatory field changes, we will reassess the lawful basis, necessity and transparency information before using it for the new purpose.

7. Location data

Herpegram may process coarse location information derived from requests for localisation, security or regional functionality. Certain trusted-device security features may also record location-related information where implemented.

We will distinguish between approximate location and precise device location. Precise location will not be treated as implicitly authorised merely because a user has an account; where consent or device permission is required, the service must request it.

8. Transmissions and end-to-end encryption

Herpegram's private messaging architecture is designed around end-to-end encryption. Message content should be encrypted on participating devices so that Herpegram's messaging infrastructure stores or relays ciphertext rather than routinely readable plaintext.

The service may still process messaging metadata necessary to provide the feature, such as account/conversation identifiers, device keys, message identifiers, timestamps, delivery or state events, conversation preferences, trusted-device state and encrypted payloads. End-to-end encryption does not mean that no personal data is processed.

A recipient can access plaintext on their device and may choose to report content. If a reporting mechanism intentionally submits message content or evidence to Herpegram, that submitted evidence is no longer inaccessible to the moderation system simply because the original transmission was end-to-end encrypted. We will make this clear at the point of reporting.

9. View-once private photos

Where Herpegram offers view-once private photos, the system may enforce file type, file size, pixel/resource limits, expiry and one-time-consumption controls. Current architecture is designed to expire unopened view-once photos after a limited period and to clean up consumed or expired media.

A 'view once' control reduces persistence within Herpegram's own service. It cannot guarantee that a recipient cannot photograph a screen, use a compromised device or otherwise preserve what they can see. Users should treat view-once media accordingly.

10. Reports and moderation evidence

When you report a Contamination, Variant or eligible private interaction, we process the reporter's account identifier, the reported account/content identifiers, reason and explanation, timestamps and relevant evidence needed to review the report.

Herpegram may preserve a snapshot of reported public content and its context so that later editing or deletion does not erase the evidence under review. Access to moderation records should be limited to authorised personnel and systems with a legitimate operational need.

We retain moderation evidence only for as long as reasonably necessary for the investigation, enforcement history, safety, legal claims, regulatory duties or other documented lawful purposes.

11. Blocking and safety preferences

When you block another Variant or change safety preferences, we process the relationship and settings necessary to enforce that choice. The blocked person may be able to infer that an interaction is unavailable, but Herpegram does not need to disclose the internal reason or additional private account data.

12. Passkeys, MFA, PINs and credentials

Herpegram may support passwords, passkeys, multi-factor authentication, trusted devices and a separate Transmission PIN. We process the authentication records and cryptographic/public-key material necessary to verify access.

We should not store plaintext passwords or plaintext Transmission PINs. Secret authentication material must be protected using appropriate cryptographic techniques. Passkey private keys normally remain under the control of the user's authenticator rather than being provided to Herpegram.

13. Cookies and local technologies

Herpegram uses or may use cookies and similar browser storage for authentication, security, language, preferences and other service functions. Strictly necessary technologies may be used without consent where permitted by law. Non-essential cookies or similar technologies will not be activated until any legally required consent has been obtained.

The Cookie Policy will provide the production list, purposes, providers and lifetimes of these technologies before public launch.

14. Automated systems and CERBERUS

Herpegram may use automated systems to rank, search, recommend, filter and organise content, and to detect suspicious or abusive activity. These systems may use activity, content, relationship, preference, recency, security and contextual signals.

If Herpegram introduces solely automated decision-making that produces legal effects or similarly significant effects on a person, we will provide the additional information and safeguards required by applicable data-protection law, including meaningful information about the logic and consequences where required.

15. Who we share data with

We do not need to sell personal data in order to operate Herpegram, and this policy does not authorise the sale of users' personal data. We may disclose data to service providers and other recipients where necessary and lawful.

• Hosting, database, authentication, storage, content-delivery and infrastructure providers, including production providers actually configured for Herpegram.
• Age-assurance providers used to verify adult eligibility. Where possible, Herpegram receives only the verification outcome rather than the underlying identity material used by that provider.
• Security, monitoring, communications, customer-support and payment providers where those services are enabled.
• Authorised Herpegram moderation/administration systems and personnel, including Pathogen HQ where it is used for moderation and operational administration.
• Professional advisers such as lawyers, accountants, auditors or insurers where reasonably necessary.
• Courts, regulators, law-enforcement bodies or other authorities where disclosure is required by law or is otherwise lawful and necessary.
• A purchaser, investor or successor in connection with a genuine corporate transaction, subject to appropriate confidentiality and data-protection safeguards.

16. Infrastructure providers

Herpegram's current project uses Supabase-related database/authentication infrastructure and is designed for Vercel-hosted web deployment. The final production Privacy Policy must name or clearly categorise every material processor actually in use at launch, rather than listing vendors that merely appeared in a development plan.

We enter into appropriate data-processing arrangements with processors where required and restrict them to processing personal data for agreed purposes.

17. International transfers

Some service providers may process data outside the United Kingdom. Before production processing begins, Herpegram will document where relevant personal data is transferred and the transfer mechanism relied upon, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful safeguard as applicable.

The final production notice must explain how users can obtain information about the relevant safeguards. We will not claim that all data remains in the UK unless the deployed infrastructure actually guarantees that.

18. How long we keep data

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including service operation, security, moderation, legal obligations and the establishment, exercise or defence of legal claims. Different records require different periods.

Before public commercial launch, Herpegram will maintain a documented retention schedule covering at least account data, deleted accounts, content, reports/evidence, security logs, trusted devices, private-message metadata/ciphertext, view-once media, backups and financial records. Where a fixed period is not appropriate, we use documented criteria such as account status, unresolved disputes, security need and statutory limitation periods.

19. Account and content deletion

Deleting content or an account removes it from ordinary service use according to the relevant deletion process, but deletion may not instantly remove every copy from backups, security records or preserved moderation evidence.

We may retain limited information after deletion where necessary and lawful to comply with law, prevent fraud or ban evasion, resolve disputes, preserve report evidence, enforce rights or maintain security. Retained information remains subject to access controls and retention limits.

20. Security

We use technical and organisational measures intended to protect personal data, including access controls, row-level/database policies where applicable, authentication controls, trusted-device mechanisms, encryption, separation of private-messaging infrastructure and security testing.

No internet service can promise absolute security. We review safeguards in light of risk and respond to personal-data breaches in accordance with applicable notification and documentation duties.

21. Your data-protection rights

Depending on the processing and applicable law, you may have rights to be informed, access your personal data, correct inaccurate data, request erasure, restrict processing, object to processing, receive portable data, withdraw consent where consent is the lawful basis, and obtain safeguards concerning qualifying automated decisions.

These rights are not absolute in every circumstance. For example, we may lawfully retain information needed for legal claims or security even after an erasure request. We will explain any applicable exemption or refusal where the law requires us to do so.

22. Your right to object

Where we rely on legitimate interests, you have the right to object to processing based on your particular situation. We will stop the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims, subject to the exact rules applicable to the processing.

Where personal data is used for direct marketing, you may object to that use at any time and we will stop using it for that purpose.

23. Exercising your rights

Requests should be made through Herpegram's designated privacy/data-rights route. We may need to verify that the requester is entitled to the account or data before disclosing, changing or deleting personal information. Verification should be proportionate to the risk.

We will respond within the period required by applicable data-protection law and will tell you if a lawful extension, exemption or fee applies.

24. Complaints and the ICO

If you have concerns about how Herpegram uses personal data, contact the privacy route first so the issue can be investigated. You also have the right to complain to the UK Information Commissioner's Office (ICO). The ICO's current contact and complaint information is available on its official website.

Using Herpegram's internal complaint route does not remove your right to contact the ICO.

25. Children

Herpegram is intended for adults aged 18 and over and does not knowingly invite children to create accounts. Age verification is intended to be performed by a specialist third-party provider rather than by Herpegram collecting users' identity documents directly. We will assess whether the service is likely to be accessed by children as required by applicable UK online-safety law and will not rely solely on an 18+ statement where additional measures are legally required.

If we discover that a child's personal data has been collected contrary to our rules or legal obligations, we will take appropriate steps based on the circumstances and applicable law.

26. Law-enforcement and legal requests

We may preserve or disclose personal data where required by a valid legal obligation, court order or other lawful process, or where another lawful basis permits disclosure for a sufficiently important purpose. We assess requests and disclose no more information than reasonably required by the lawful request.

End-to-end encryption can limit the content Herpegram is technically capable of providing. We will not describe encrypted plaintext as available to us where it is not.

27. Changes to this Privacy Policy

We review this notice when the service, law or processing changes. We will update the effective date and bring material new uses of personal data to users' attention before beginning the new processing where required.

Archived versions should be retained where reasonably practicable so that material changes can be audited.

28. Contact details to complete before launch

Before Herpegram's public commercial launch, this notice must be completed with the controller's legal identity and address, privacy contact, any required Data Protection Officer details, final processor categories or names, production international-transfer information, retention schedule, and any ICO registration/fee information that applies.

Those are not decorative blanks. Until the production facts exist, inventing them would make this notice less compliant, not more.