Last updated: 27 March 2026
Before anything else, here is what we will never do:
If Kolab Social Ltd is ever acquired, the acquiring entity will be bound by this policy until they provide you with a new one (see Section 9).
Kōlab Social Ltd (“we”, “us”, “our”) is the data controller responsible for your personal data.
We are registered in England and Wales.
This policy explains how we collect, use, and protect your personal data when you use the Kōlab mobile application, the website at kolab.social, and any additional services we notify you about.
For any questions about this policy or how we handle your data, contact us at support@kolab.social. We are not required to appoint a Data Protection Officer under UK GDPR and have not done so. All data protection queries should be directed to the email address above.
Providing your personal data is not a statutory requirement. It is necessary to create an account and use the service. If you choose not to provide the required information, you will not be able to use the service.
We want you to feel confident about how your data is used. Here is what you can do at any time:
Marketing communications. You can opt out of marketing emails and messages at any time by using the unsubscribe link in any message or adjusting your notification settings within the app. Opting out of marketing does not affect service-related communications (such as security notices or policy updates).
AI analysis of your photos. Our service uses AI to analyse your photos and provide personalised technique feedback. If you object to this processing under Article 21 of UK GDPR, contact us at support@kolab.social. Because AI-powered feedback is integral to how the service works, objecting may mean that certain features will not be available to you, and in some cases the service may no longer be able to function as intended for your account. We will discuss what this means for you before taking any action.
Withdrawing consent. Where we rely on your consent to process data (such as marketing communications), you can withdraw it at any time through the same mechanism you used to give it, or by contacting us at support@kolab.social. Withdrawing consent does not affect the lawfulness of any processing carried out before you withdrew it.
Your full legal rights under UK GDPR are set out in Section 13.
When you create an account, we collect your:
Any additional information you choose to add to your profile, such as a biography or profile photo.
Photos you upload and any captions or descriptions you provide. Your photos are a distinct category of personal data - see Section 6 for how we treat them.
Photos contain embedded metadata. We handle this as follows:
Data we generate from your use of the service:
This data is personal data derived from your content and activity. It is deleted when you delete your account (see Section 11).
We collect data about how you use the service, including:
We collect:
The table below sets out each purpose for which we process your data and the legal basis we rely on under UK GDPR.
| Purpose | What this means | Legal basis |
|---|---|---|
| Provide and operate the service | Creating your account, displaying your profile, hosting and showing your photos, delivering feedback, running Missions | Performance of a contract (Art 6(1)(b)) |
| AI-powered technique analysis | Analysing your photos across various technique areas to generate personalised feedback and build your technique profile | Legitimate interests (Art 6(1)(f)) - providing the core value of the service. See Section 7 for your right to object |
| Promote the community | Featuring your photos and username on our social media channels, emails, website, and other marketing materials | Legitimate interests (Art 6(1)(f)) |
| Communicate with you about the service | Sending service-related messages such as security alerts, policy updates, and account notifications | Performance of a contract (Art 6(1)(b)) |
| Marketing communications | Emails or messages about new features, Missions, or community activity | Consent (Art 6(1)(a)) |
| Improve the service | Understanding which features and feedback types are most useful, identifying problems, and refining the platform | Legitimate interests (Art 6(1)(f)) |
| Reporting to brand partners | Sharing aggregated, de-identified engagement data with brands that sponsor Missions (see Section 8) | Legitimate interests (Art 6(1)(f)) |
| Connecting you with relevant creative opportunities | Using insights from your photographic activity and technique profile to recommend relevant brand-sponsored Missions | Legitimate interests (Art 6(1)(f)) |
| Ensure safety and security | Detecting fraud, abuse, and violations of our terms; protecting the community and the platform | Legitimate interests (Art 6(1)(f)) |
| Comply with legal obligations | Responding to lawful requests from regulators, law enforcement, or courts | Legal obligation (Art 6(1)(c)) |
| Age verification | Confirming that users meet our minimum age requirement of 16 | Legitimate interests (Art 6(1)(f)) |
Where we rely on legitimate interests, we have carried out a balancing assessment to ensure our interests do not override your rights and freedoms. You can request details of these assessments by contacting us at support@kolab.social.
You own your work. We never claim ownership of any photo or creative content you upload.
Licence. By uploading content to the service, you grant us a limited, non-exclusive, non-sublicensable licence to:
This licence exists solely to let us run and promote the platform and ends when you delete your content or your account. We never sell or commercially license your photos to third parties.
Promotion of your work. We may share your photos and username across our social media channels, email newsletters, website, and marketing materials to celebrate the community's work. If you do not want your work featured in this way, contact us at support@kolab.social and we will exclude your content from future promotional use.
What we never do with your photos:
EXIF data. Your photos may contain GPS or location data, which we may store as part of the service but do not share publicly or with third parties.
When you delete content:
Law enforcement. In rare circumstances, we may be required to disclose your content in response to a valid legal request (see Section 9).
Copyright. We take intellectual property seriously. If you believe your copyright has been infringed, please see our Terms of Service or contact us at support@kolab.social.
Our service uses AI to analyse the photographs you submit. Here is how it works in plain terms.
What it analyses. When you submit a photo, our AI examines it across a number of photographic areas. This analysis generates personalised feedback to help you develop your photography.
Technique profiles. Over time, as you submit more work, we build a profile of your strengths and areas for growth. The technique profiles we build constitute profiling as defined in Article 4(4) of UK GDPR. This profiling is used solely to provide you with personalised feedback on your photography.
No generative AI training. Your photos are never used to train generative AI models. The analysis is about understanding your photography, not creating new images.
No automated decisions with legal or significant effects. The AI analysis does not produce decisions that have legal effects on you or similarly significantly affect you.
Your right to object. Under Article 21 of UK GDPR, you have the right to object to the processing of your data for AI analysis and profiling. Contact support@kolab.social to exercise this right.
Third-party processing. Photos are processed using third-party cloud-based AI services under data processing agreements. These providers are required to process your data only on our instructions, maintain appropriate security measures, delete your data after processing is complete, and not use your data for their own purposes.
From time to time, brand partners may sponsor Missions on the platform.
We share your personal data only with the following categories of recipients, and only to the extent necessary:
| Category | Purpose |
|---|---|
| Cloud infrastructure providers | Hosting the service, storing data securely |
| Cloud-based AI services | Analysing photos to generate technique feedback (data deleted after processing) |
| Analytics providers | Understanding how the service is used (pseudonymised usage data) |
| SMS and authentication providers | Verifying your phone number and securing your account |
| Email service providers | Delivering service communications and marketing emails |
| Professional advisors | Legal, accounting, or audit services where required |
We never share your data with advertisers. We never sell your data. We do not share data with data brokers.
Law enforcement and legal requests. We may disclose your data where required by law or by a court of competent jurisdiction.
Business transfers. If Kolab Social Ltd is involved in a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity. We will notify you before your data is transferred.
Third-party links. The service may contain links to third-party websites or services. We are not responsible for their privacy practices.
We take the security of your data seriously and implement appropriate technical and organisational measures, including:
Breach notification. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours, as required by Article 33 of UK GDPR.
Honest caveat. No system is completely secure. We will always be transparent with you if something goes wrong.
| Scenario | Retention period |
|---|---|
| Active account | Data retained for as long as you continue to use the service |
| Inactive account | We may delete accounts after an extended period of inactivity, with prior email notice |
| Deleted content (while account is active) | Removed from public display promptly; deleted from active systems within a reasonable timeframe |
| Deleted account | Personal data removed from active systems; derived data queued for deletion |
| Technical logs and IP addresses | Retained for up to 90 days for security purposes, then deleted |
| Analytics data | Pseudonymised at collection; anonymised and retained in aggregated form |
Legal override. We may retain data for longer where required by law, regulation, or to establish, exercise, or defend legal claims.
The service is intended for users aged 16 and over. We collect date of birth at registration to verify this.
We do not knowingly collect personal data from anyone under 16. If we discover that a user is under 16, we will:
If you believe someone under 16 is using the service, please contact us at support@kolab.social.
You have the following rights in relation to your personal data:
How to exercise your rights. Contact us at support@kolab.social. We will respond within 30 days (up to 90 days for complex requests).
Supervisory authority. You have the right to lodge a complaint with the Information Commissioner's Office:
Your personal data is primarily processed and stored within the United Kingdom and the European Economic Area.
Where we transfer data to countries outside the UK, we ensure it is protected by appropriate safeguards, including:
You can request copies of the relevant safeguards by contacting us at support@kolab.social.
Mobile analytics. The app uses mobile analytics SDKs to collect usage data as described in Section 4. In accordance with PECR 2003, these SDKs may access information stored on your device.
Push notifications. If you enable push notifications, we store a device token to deliver them. You can disable push notifications at any time through your device settings.
No cookies in the app. The app does not use cookies.
Website (kolab.social). Our website may use cookies or similar technologies for essential site functionality and analytics. When you visit kolab.social, the following may apply:
You can control cookies through your browser settings. Disabling cookies may affect your experience of the website but will not affect the Kōlab app.
We may update this policy from time to time.
We will never assume your agreement to new terms simply because you continue using the service.
For any questions about this privacy policy, your personal data, or to exercise any of your rights:
This policy is governed by the laws of England and Wales.