LAB.CLUB

Privacy Policy

Effective date: 01.08.2026

 Lab.club is the data controller responsible for your personal data collected through the Lab.club mobile application.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.


1. Data We Collect

1.1 Data you provide directly

  • Phone number (used for SMS verification at sign-up);
  • Email address (optional, set via profile or onboarding);
  • Name or display name;
  • Profile information (bio, profile photo if applicable);
  • Genre preferences and music tastes;
  • Location (city or region, set by you);
  • Reviews, ratings, discussion posts and replies;
  • Private feedback submitted to venues.

1.2 Data collected automatically

  • Device information (device type, operating system, app version);
  • Usage data and analytics events (via Mixpanel) — screens viewed, actions taken, feature interactions;
  • Log data (IP address, timestamps, error reports).

1.3 Data from third-party integrations

  • If you connect your Spotify account: Spotify username, linked artists, listening history used to derive genre preferences. This connection is optional and can be disconnected at any time via Profile Settings;
  • If you use Contact Sync: your device contacts list is uploaded to our servers to identify other Lab.club users. This is used solely to suggest connections and is not shared with third parties. Your contact list is deleted when you remove your account.

2. Lawful Basis for Processing

We process your personal data under the following lawful bases:

  • Contract: to provide you with the App and its core features, including account creation, event discovery, and social features;
  • Legitimate interests: to improve the App, detect fraud and abuse, and ensure platform safety — where these interests are not overridden by your rights;
  • Consent: for Contact Sync, Spotify integration, and marketing communications — you may withdraw consent at any time;
  • Legal obligation: where we are required to retain or disclose data by law.

3. How We Use Your Data

  • To create and manage your account;
  • To provide event discovery, personalised recommendations (the For You feed), and social features;
  • To enable reviews, discussion board participation, and community features;
  • To share your private venue feedback with the relevant venue operator (in identified form — your name will be visible to the venue);
  • To send transactional notifications (event reminders, social activity) — you can manage notification preferences in the App;
  • To send marketing communications where you have opted in — you may opt out at any time;
  • To analyse usage patterns via Mixpanel to improve the App;
  • To detect and prevent fraud, abuse, and violations of our Terms;
  • To comply with legal obligations.

4. Data Sharing and Third-Party Processors

We do not sell your personal data. We share data only with the following categories of third-party processors, under appropriate data processing agreements:

  • Twilio — SMS delivery for account verification;
  • Spotify — integration for music preferences (where you have authorised the connection);
  • Payload CMS — content management system used to manage platform content and back-office operations;

•  Vercel — hosting and infrastructure. 

  • Mixpanel — product analytics.

We may also disclose data to law enforcement or regulatory authorities where required by applicable law.

5. International Data Transfers

Some of our third-party processors are based outside the UK. Where data is transferred to countries not recognised as providing adequate data protection, we ensure appropriate safeguards are in place (typically the UK International Data Transfer Agreement or equivalent). 

6. Data Retention

  • Account data: retained for as long as your account is active;
  • Usage and analytics data: retained for 24 months before aggregation or deletion;
  • Contact sync data: deleted upon account deletion;
  • Reviews and discussion posts: will be anonymised rather than deleted to preserve community integrity 
  • Legal/compliance data: retained as required by applicable law.

7. Account Deletion

You may request deletion of your account at any time via the in-app account deletion option. Upon confirmed deletion, your personal data will be hard-deleted from our systems within 30 days, except where retention is required by law or legitimate interest (e.g., abuse prevention records).

8. Your Rights Under UK GDPR

You have the following rights in relation to your personal data:

  • Right of access: to request a copy of the personal data we hold about you;
  • Right to rectification: to request correction of inaccurate or incomplete data;
  • Right to erasure ("right to be forgotten"): to request deletion of your data, subject to legal retention obligations;
  • Right to restriction: to request that we restrict processing of your data in certain circumstances;
  • Right to data portability: to receive your data in a structured, machine-readable format;
  • Right to object: to object to processing based on legitimate interests or for direct marketing;
  • Rights related to automated decision-making: we do not make solely automated decisions with legal or significant effect on you.


To exercise any of these rights, contact us at: . We will respond within one calendar month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at www.ico.org.uk.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These include encrypted data transmission (HTTPS), access controls, and secure hosting infrastructure.

No method of transmission or storage is completely secure. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the ICO as required by law.

10. Children

The App is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected data from a minor, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the App or by email. The current version will always be accessible within the App.

12. Contact and Data Controller Details

Data controller: Lab.club support team

Privacy contact: support@lab.club

Data Protection Officer: