Privacy Policy

Last updated: 18 September 2026

Published by Roast Lab.

This Privacy Policy is the main privacy notice for Roast Lab. For a shorter UK GDPR summary see our GDPR Policy. Cookies are covered in our Cookie Policy. Use of the service is also governed by our Terms of Service.

1. Who we are and how to contact us

The data controller is Roast Lab, operating at https://roastlab.co.uk from the United Kingdom.

For privacy questions, take-down requests, or to exercise your rights, email hello@roastlab.co.uk.

We do not appoint a Data Protection Officer. Privacy enquiries come to us directly.

2. The law that applies

We process personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Electronic communications and cookies are also covered by the Privacy and Electronic Communications Regulations 2003 (PECR), as explained in our Cookie Policy.

3. Who this covers

This notice covers:

• Creators - people who submit the create form
• Subjects - people named on a roast or shown in an uploaded photograph
• Visitors - people who open a roast URL or browse the site

Creators must only upload photographs and names with clear permission. See the Terms of Service.

4. What personal data we collect

4.1 Data provided when a roast is created

• Subject name - the name typed onto the roast
• Headshot - the photograph uploaded (re-encoded and resized; EXIF metadata stripped where processing succeeds)
• Open Graph card - a cropped derivative of the photograph used for link previews
• Prank type - which roast template was chosen
• Consent acknowledgement - that the creator confirmed permission to use the photograph and that the use is a joke, not harassment

4.2 Data collected automatically

• Technical security data - IP address and related signals used for rate limiting and abuse prevention
• Session data - a first-party session cookie and CSRF token on the create form (see the Cookie Policy)

Do not upload photographs of children, special-category data (for example health, politics, religion, sexual life), or anyone who has not agreed to the joke.

5. How and why we use it

• Creating and hosting the roast page and preview image - Lawful basis for the creator: Article 6(1)(b) (steps at the creator’s request to provide the service). Lawful basis for hosting the subject’s name and image for the short fuse period: Article 6(1)(f) legitimate interests in operating a short-lived entertainment service, relying on the creator’s warranty of permission, strict retention, and an easy take-down route.
• Security, rate limiting and abuse prevention - Lawful basis: Article 6(1)(f) legitimate interests.
• Take-down, complaints and legal compliance - Lawful basis: Article 6(1)(c) legal obligation where applicable, otherwise Article 6(1)(f) legitimate interests in preventing harm and misuse.

We do not sell personal data, run marketing lists, profile people for advertising, or use automated decision-making that produces legal or similarly significant effects.

6. People shown in photographs (subjects)

If your name or photograph appears in a roast, you are a data subject even if you did not create the page.

Creators must confirm they have your permission. If they did not, that is a breach of our Terms by the creator. You can ask us to delete the roast early by emailing hello@roastlab.co.uk with the roast URL. We treat missing-consent and harassment reports as priority take-downs.

You also have the UK GDPR rights listed below, including objection and erasure, subject to the limits of the law.

7. Who we share it with

We do not sell personal data. Recipients are limited to:

• Hosting, infrastructure and email providers acting as processors on our instructions
• Anyone who receives the roast URL - they can view the name and photograph until the page expires or is removed
• Social and messaging platforms - if a creator or recipient shares the link, those platforms may fetch title, description and preview image to build a link preview
• Authorities or advisers where UK law requires or permits disclosure, or where needed to defend legal claims

8. Copies we cannot control

Roast Lab can delete data stored on our systems. We cannot delete:

• screenshots, downloads or recordings made by users
• copies forwarded in chats or emails
• caches or previews stored by Facebook, WhatsApp, X, Instagram, Telegram, Google or other third parties
• search engine results that may briefly reference a URL

Creators and sharers should assume that once a link is sent, recipients may keep a copy even after our 24-hour fuse ends.

9. International transfers

We aim to keep primary hosting and email processing in the United Kingdom or in countries covered by UK adequacy arrangements. If a provider processes data outside the UK, we use appropriate UK GDPR transfer tools (such as the UK International Data Transfer Agreement or Addendum, or another lawful mechanism).

If you share a roast URL with a platform based outside the UK, that share is your disclosure to that platform under their terms and privacy notice.

10. How long we keep it

• Roast records, headshots and OG cards - up to 24 hours from creation, then removed by automated purge (and hidden earlier if expired or taken down)
• Rate-limit and security events - a short window, typically under 24 hours
• Take-down and complaint emails - as long as needed to handle the request, show we acted, and meet legal obligations; then deleted or minimised

11. Your rights

Under UK GDPR you may have the right to request access, rectification, erasure, restriction, objection, and (where applicable) portability. You may also complain to the Information Commissioner’s Office at ico.org.uk.

To exercise rights, email hello@roastlab.co.uk. We may need to verify the request is legitimate (for example that you are the person shown, or are authorised to act for them). We respond within the time limits UK GDPR requires, usually one month.

Because roasts already expire within 24 hours, erasure is often already underway. We can still delete sooner on a valid request.

12. Take-down requests

Email hello@roastlab.co.uk with:

• the full roast URL
• why it should be removed (for example no consent, under-18, harassment, illegal content)
• your relationship to the content (creator, person shown, parent/guardian, or authorised representative)

We may remove content first and ask follow-up questions afterwards where risk appears high.

13. How we protect it

We use HTTPS, HSTS, a Content Security Policy and related browser hardening headers. The create form uses a CSRF token, honeypot and per-IP rate limits. Uploads are type-checked, size-capped, resized and re-encoded. Roast records are not meant to remain after the fuse period. No security measure is perfect; please report concerns to hello@roastlab.co.uk.

14. Children

Roast Lab is not directed at children. Do not create roasts about anyone under 18. We will remove such content when we become aware of it.

15. Changes

We will update this page when the notice changes. The date above is the editorial “last updated” date. Significant changes may also be highlighted on the site where practical.

Return to home