1. Information We Collect
We may process:
- email addresses;
- IP addresses;
- browser/device information;
- payment metadata;
- moderation reports;
- technical diagnostics;
- cookie/session data.
We do not record or permanently store private video conversations. Authorised moderation personnel may observe a live session in real time for safety, compliance or enforcement purposes; such observation is logged as a moderation access event (moderator, session, time and reason) and does not capture, store or replay any video or audio.
2. Purpose of Processing
We process data for:
- account management;
- fraud prevention;
- payment processing;
- moderation;
- security;
- legal compliance;
- analytics;
- service optimization.
3. Legal Basis (GDPR)
Processing may occur under:
- contractual necessity;
- legitimate interests;
- legal obligations;
- consent where applicable.
4. Payments
Payments are processed by third-party providers including:
- Stripe;
- Apple Pay;
- Google Pay.
We do not store full payment card details.
6. User Rights
Under GDPR, users may request:
- access;
- correction;
- deletion;
- restriction;
- portability;
- objection to processing.
Requests: support@shufflecrush.com
7. Security
We implement reasonable technical and organizational security measures.
However, no online system can be guaranteed 100% secure.
8. Retention
Data is retained only as long as reasonably necessary for:
- operational purposes;
- legal obligations;
- fraud prevention;
- dispute handling.
Moderation records — reports, enforcement decisions, appeals, moderator audit logs, and transient technical session data — are deleted or anonymised automatically by a scheduled daily job according to a per-category retention schedule. Enforcement and audit records are kept longer than technical session data; in-call chat content is purged on a short cycle.
Where a report is escalated through our illegal-content and child-safety process, the associated report, evidence, and enforcement records are placed under a preservation hold. Records under a hold are exempt from automated deletion and are kept until the hold is released by a moderator, or for as long as a legal, regulatory, tax, or chargeback obligation requires.
Host verification evidence — identity-document images and live gesture images — is kept while it is legitimately required for the active verification and compliance relationship, and is then eligible for scheduled deletion under one central retention configuration. The applicable retention period is not yet finally determined, so automated deletion is currently switched off rather than run against an arbitrary period; the minimal verification metadata (submission reference, result, document type, review timestamp, reviewer reference, retention or hold state) is kept for longer. Deleting your account removes this evidence, unless it is covered by a documented legal or compliance hold — a legal or regulatory request, a fraud investigation, a chargeback or dispute, or a complaint or investigation — in which case that evidence alone is preserved while the hold is open and the rest of your account data is still deleted or anonymised.
9. International Access
Users access the Platform globally and understand internet communications may cross international networks.