GDPR Policy
A short UK GDPR summary for Roast Lab. The full notice is the Privacy Policy. This page does not replace it.
Last updated: 18 September 2026
This page summarises how Roast Lab approaches UK GDPR and the Data Protection Act 2018. Read the Privacy Policy for the full notice, and the Terms of Service for creator responsibilities.
1. Controller
Roast Lab, based in the United Kingdom, is the controller for this service. Contact: hello@roastlab.co.uk.
2. Creators and subjects
The person who uploads a photograph (the creator) and the person named or shown (the subject) may both be data subjects. Creators must have clear permission before uploading. Subjects can request early deletion even if they did not create the roast.
3. Lawful bases we rely on
- Article 6(1)(b) - providing the roast the creator asked us to generate
- Article 6(1)(f) - short-term hosting of subject name and image for entertainment, security, rate limiting, abuse prevention, and operating the site, with a 24-hour retention limit and take-down route
- Article 6(1)(c) - legal obligation where a take-down, preservation or disclosure is required by law
We do not seek to process special-category data. Do not upload it. We do not run marketing based on roast content.
4. Processors and onward sharing
Hosting, infrastructure and email providers process data on our instructions. Anyone who receives a roast URL can view it until expiry or removal. If a link is shared to social or messaging apps, those apps may fetch preview data under their own terms. That onward share is initiated by users, not by us as a sale of data.
5. Retention
Roast records and images are kept for up to 24 hours, then purged. Security logs are short-lived. Complaint emails are kept only as needed to handle the issue and meet legal duties.
6. Your rights
Access, rectification, erasure, restriction, objection, complaint to the ICO, and portability where applicable. Email hello@roastlab.co.uk. We may verify identity or authority before acting. Roast pages already self-destruct after 24 hours; we can delete sooner on a valid request.
Erasure on our systems does not remove screenshots or copies stored by third-party platforms or recipients.
7. ICO
You can complain to the Information Commissioner’s Office: ico.org.uk.