Privacy Policy

Who is responsible

Blushie is operated by Nova Ascendia Ltd, a company registered in England and Wales under number 16943946, with its registered office at 2nd Floor College House, 17 King Edwards Road, Ruislip, London HA4 7AE, United Kingdom. You can reach us at support@blushie.ai. For UK GDPR, Nova Ascendia Ltd is the controller of the personal data described here.

What we collect

Your account: your email address, and the name and profile picture your sign-in provider gives us if you sign in with Google. If you start with just your email, or pay on Fanvue before you have an account, we create your account from the email you give us or the one you paid with on Fanvue. If you choose a password, we store only a one-way hash of it.

Your sessions: a session token, when it was created and when it expires, your IP address and your browser's user-agent string. This is what keeps you signed in and what lets us spot an account being misused.

What you do on the site: which series and episodes you open, how far through an episode you got, what you unlocked, and which parts of the site you came in through. Each event is tied to a visitor id or your account id.

Your payments: an invoice reference from Fanvue, the amount, when it was paid, which checkout link it came from, and what it credited. We do not receive or store your card number, expiry, or security code — those stay with Fanvue and its payment providers.

Your coins: a ledger of every credit and spend, which is how your balance is worked out.

Characters you create: the choices you made in the builder, her name and the portraits made for her. Only you can see her, and she is deleted with your account.

Your chats: the messages you send to characters, and short notes a character keeps about what you told her, so she can remember you next time. They are tied to your account (or, before you sign in, your visitor id) and deleted with your account.

Marketing emails: whether you agreed to receive them, and which ones we sent you, when, and whether you came back to the site from one.

Cookies and similar storage

bl_vid is a first-party cookie holding a random, signed visitor id. It is what lets us count visits and measure whether a change to the site worked. It is not shared with anyone and it does not follow you to other sites.

A sign-in cookie keeps you signed in. It is strictly necessary: without it the site cannot tell who you are.

Your answer to the 18+ confirmation is kept in your browser's local storage, and your cookie choice in a first-party cookie (bl_consent), so you are not asked again on the same browser.

We ask before using analytics and advertising cookies and you can say no. Saying no does not change what the site does for you. If you say yes, Meta's pixel may set its own cookies (_fbp and _fbc) to measure our ads.

Why we are allowed to hold it

To provide the service you asked for, including your account, your unlocks and your coins: performance of a contract with you.

To take and reconcile payments, and to keep records of them: a legal obligation, and our legitimate interest in running the business properly.

To keep the site secure and to stop fraud and abuse: our legitimate interest, and yours.

To measure how the site is used and test improvements, and to measure our ads: your consent, which you give or refuse on the cookie choice and can change at any time.

To send you marketing emails about new episodes and things you left unfinished: your consent, which you can withdraw with the one-click unsubscribe link in every email.

Who else sees it

Fanvue, which takes payments and tells us when one succeeds, fails or is reversed.

Neon, which hosts the database, and Vercel, which hosts and serves the site and stores uploaded media.

Resend, which sends sign-in links to your email address and, if you agreed to them, marketing emails.

xAI, which writes the characters' replies from the messages you send them and the notes kept about you, and checks the portraits of characters you create.

WaveSpeed, which draws the portraits of characters you create, from the choices you make in the builder. It never receives your name or email.

Google, if you choose to sign in with Google.

PostHog, for product analytics, and only if you allow analytics cookies. We use its EU region, we do not use its session recording, and we do not let it capture clicks or form contents automatically — only the specific events we send it.

Meta, only if you allow cookies: its pixel and Conversions API measure our ads. We send a one-way hash of your account id, Meta's own cookies, your browser's user-agent string and, for a purchase, its value. Never your email, name or phone number.

The ad network that sent you, if you arrived from an ad: we tell it that its click became a sign-up or a payment, using only its own click id.

We do not sell personal data. We share the limited data above to measure our ads, and where that involves cookies, only with your consent.

Where it is held

Some of these providers process data outside the UK, including in the United States. Where that happens we rely on the UK's transfer safeguards, such as the International Data Transfer Addendum. We are reviewing each provider's arrangements and will name the safeguard for each here once that is finished.

How long we keep it

Your account and the things attached to it stay until you ask us to delete them. Payment records are kept for six years, because tax law requires it, even after an account is deleted.

Sessions expire on their own. Analytics events are kept in a form tied to a visitor id rather than to you by name.

Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or stop certain uses, and ask for it in a portable form. Where we rely on consent you can withdraw it at any time.

Write to support@blushie.ai and we will answer within one month.

If you are not satisfied you can complain to the Information Commissioner's Office at ico.org.uk, or by telephone on 0303 123 1113.

Children

Blushie is not for anyone under 18 and we do not knowingly hold data about children. If you believe a child has an account, tell us and we will close it and delete the data.