Legal
PurpletGo Privacy Policy
Last updated: October 2026
1. Who we are
PurpletGo ("we", "us", or "our") operates the employee offboarding platform available at purpletgo.com. For the purposes of the General Data Protection Regulation (GDPR) and applicable European data protection law, PurpletGo acts as a data processor on behalf of its business customers (controllers) with respect to employee offboarding data, and as a data controller for data relating to its own customers and website visitors.
Data protection enquiries: support@purpletgo.com
2. What data we collect and why
| Category | Examples | Lawful basis |
|---|---|---|
| Account data | Name, email, hashed password, organisation name | Contract (Art. 6(1)(b)) |
| Usage data | Audit log actions, feature usage, IP address | Legitimate interests (Art. 6(1)(f)) |
| Session and security data | IP address, browser user agent, approximate location derived from the IP address, sign-in and two-factor events | Legitimate interests (Art. 6(1)(f)) |
| Employee offboarding data | Departing employee name, email, role, exit date, and a phone number where your organisation uses SMS notifications | Contract / legal obligation on behalf of controller |
| Payment data | Billing email, Stripe customer ID (card data held by Stripe) | Contract (Art. 6(1)(b)) |
| Support communications | Email content when contacting us | Legitimate interests (Art. 6(1)(f)) |
| Demo request data | Name, work email, company size, and message submitted through the website demo form; IP address for rate limiting | Legitimate interests (Art. 6(1)(f)) / steps prior to a contract (Art. 6(1)(b)) |
Demo requests from our website
When you submit the "Get a Demo" form, the website passes your submission to our servers, where we store your name, work email, company size, and message so our sales team can follow up. We email the details to our sales team and send an acknowledgement to the email address you entered. Your IP address is used to limit how many requests can be submitted from one address, to prevent spam. To have a demo request deleted, email support@purpletgo.com.
3. Your rights under GDPR
If you are located in the EEA, UK, or Switzerland, you have the following rights:
- Right of access (Art. 15) - Request a copy of all personal data we hold about you.
- Right to rectification (Art. 16) - Correct inaccurate personal data directly from your account settings, or by contacting us.
- Right to erasure (Art. 17) - Request deletion of your account and all associated personal data. Exercisable from Settings → Account, or by email.
- Right to data portability (Art. 20) - Request a structured, machine-readable export of your data via Settings → Account → Export My Data.
- Right to restrict processing (Art. 18) - Ask us to pause processing of your data in certain circumstances.
- Right to object (Art. 21) - Object to processing based on legitimate interests.
- Right to lodge a complaint - You may lodge a complaint with your local supervisory authority (e.g. the ICO in the UK, or the relevant DPA in your EU member state).
To exercise any right, email support@purpletgo.com. We will respond within 30 days.
4. Your rights under the CCPA/CPRA (California residents)
If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:
- Right to know - Request the categories and specific pieces of personal information we have collected about you, and the purposes for collecting it.
- Right to delete - Request deletion of your personal information, exercisable from Settings → Account, or by email.
- Right to correct - Request correction of inaccurate personal information we hold about you.
- Right to opt out of sale or sharing - We do not sell or share your personal information for cross-context behavioural advertising, so there is nothing to opt out of.
- Right to limit use of sensitive personal information - We do not use sensitive personal information for purposes beyond providing the Service.
- Right to non-discrimination - We will not deny you goods or services, charge different prices, or provide a different level of service for exercising any of these rights.
To exercise any right, email support@purpletgo.com. We will verify your identity before fulfilling your request and respond within 45 days. You may also designate an authorised agent to make a request on your behalf.
5. Data retention
We retain account data for as long as your organisation's account is active. Offboarding records are subject to the retention policy configured by your organisation (minimum 30 days, configurable on Team and Enterprise plans).
If a free trial or subscription ends without a paid plan, the account becomes read-only: you can still sign in, view your data, and export it, but not make changes. Data in a read-only account is deleted 12 months after it became read-only, and we send warning emails before that happens. Choosing a plan before then restores full access.
A Super Admin can schedule deletion of the whole organization. Deletion takes place after a 30-day grace period, during which it can be cancelled, and cannot be scheduled while records are under legal hold. When an individual user deletes their own account, they lose access immediately and their user record is permanently deleted after 30 days; entries about their actions in an organization's audit log remain part of that organization's data.
Archived copies of the audit log, which Team and Enterprise plans keep in cloud storage, are retained as part of the audit trail, for accountability and the establishment or defense of legal claims, and are not deleted with the account data above. Database backups are kept for about 7 days and then roll off, so deleted data can remain in a backup for up to about 7 days after it is deleted. In every case we keep data longer where your organization has placed records under legal hold, or where retention is required by law (e.g. financial records for tax purposes).
6. Data transfers outside the EEA
Our infrastructure currently operates in Google Cloud Platform and may include regions outside the EEA (e.g. us-central1). Where personal data is transferred outside the EEA, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission (2021/914) to ensure an adequate level of protection. Contact support@purpletgo.com for a Data Processing Agreement (DPA).
7. Cookies
The PurpletGo app uses strictly necessary cookies only. They keep you signed in and protect your account, are essential for the service to function, and do not require separate consent under ePrivacy rules:
| Cookie | Purpose | Lifetime |
|---|---|---|
access_token | Keeps you signed in (HttpOnly). | Up to 7 days |
session_id | Identifies your session so it can be listed and revoked (HttpOnly). | Up to 7 days |
csrf_token | Protects against cross-site request forgery. Readable by the app so it can be sent back with each request. | Up to 7 days |
twofa_challenge | Holds a pending two-factor sign-in between the password and code steps (HttpOnly). | 5 minutes |
step_up_token | Confirms you recently re-entered your credentials before a sensitive action (HttpOnly). | 5 minutes |
google_oauth_state, oauth_nonce | Protect the Google sign-in and integration connection flows against forged requests (HttpOnly). | 10 minutes |
This marketing website sets no cookies and stores nothing in your browser. We do not use advertising, analytics, or third-party tracking cookies.
8. Sub-processors
We use the following sub-processors to deliver our service:
- Google Cloud PlatformHosting, PostgreSQL database, file storage, and key management - USA (us-central1)
- Google FontsWeb fonts for the app and the docs site, which receive your IP address when a page loads - Global
- CloudflareDNS, proxy, and content delivery in front of the app; all traffic to the app passes through it - Global network
- VercelHosting of the marketing website and the docs site, including passing demo request form submissions to our servers - Global edge network
- StripePayment processing and billing - USA
- Resend or an SMTP email providerTransactional email (the provider depends on the deployment) - Resend: USA; SMTP: varies
- TwilioSMS notifications, only when an organization connects its Twilio account - USA
- AI model providerAI assistant and exit interview sentiment, only when these features are enabled and used: an OpenAI-compatible provider by default, or Google Vertex AI, as configured for the deployment - Varies
- Dropbox Sign, DocuSign, Adobe Acrobat SignE-signature: the documents sent for signature and the signers' names and contact details, only when your organization uses e-signature. Dropbox Sign can run on our platform account; DocuSign and Adobe Acrobat Sign use your organization's own account - USA, or your account's region
- FedEx, UPS, DHL, USPSShipping carriers: a departing employee's name and home address when an equipment return label is created through PurpletGo, and tracking numbers for status updates - USA and the shipment's route
Where sub-processors outside the EEA receive personal data, the safeguards in section 6 apply. When your organization connects its own identity provider or apps (for example Okta, Slack, or AWS), we exchange with those services only the data needed to carry out the actions your organization requests. The current list of sub-processors is available on request from support@purpletgo.com.
9. Security
Data is encrypted in transit with TLS. The database and file storage are encrypted at rest by our cloud provider, and integration credentials and two-factor authentication secrets are additionally encrypted by the application with AES-256-GCM before they are stored. Other controls include bcrypt password hashing (cost factor 12), TOTP two-factor authentication, HttpOnly session cookies, PostgreSQL row-level security that separates each organization's data in addition to checks in the application, and short-lived signed URLs for stored files. The audit log records changes, sign-ins, exports and report downloads, and access revocations in your organization; it does not record every time data is viewed. On Team and Enterprise plans its entries are hash-chained, and PurpletGo verifies the chain, on request from the audit log page, to detect entries that were altered or removed.
10. Data breach notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it (GDPR Art. 33) and affected individuals without undue delay (GDPR Art. 34) where required.
Where we process personal data on behalf of your organization, we notify your organization of a personal data breach without undue delay, and no later than 72 hours after becoming aware of it, with what we know at that point, so it can meet its own obligations. Our Data Processing Agreement sets this out.
11. Changes to this policy
We may update this policy from time to time. Material changes will be notified by email to registered account holders at least 14 days before taking effect. The "Last updated" date at the top of this page reflects the most recent revision.
Contact us
Privacy enquiries: support@purpletgo.com
Data Processing Agreements: support@purpletgo.com