Legal
Privacy Policy
Last updated 13 July 2026
This policy explains how Hamburger Labs collects, uses, shares, and protects personal data across our websites, our waitlists, and every product we operate. We have written it to be readable — where we use a legal term, we explain what it means in practice.
1. Who we are
HAMBURGERLABS LIMITED (“Hamburger Labs”, “we”, “us”) is a company registered in England and Wales under company number 17211878, with its registered office at 5 Temple Road, Croydon, England, CR0 1HU.
For the purposes of the UK GDPR and the Data Protection Act 2018, we are the data controller for personal data we collect about visitors to our sites and users of our products — meaning we decide why and how that data is used. Where we process data on behalf of a business customer, we act as a data processor instead; see section 11.
You can reach us about anything in this policy at ben@hamburgerlabs.com.
2. What this policy covers
Hamburger Labs builds and operates a range of software products. This policy applies to all of them, together with our marketing sites, waitlists, and any other service that links to it (collectively, the “Services”).
An individual product may add a short, product-specific privacy notice where it does something this policy doesn’t describe — for example, if it processes a category of data unique to that product. Any such notice supplements this policy rather than replacing it. Where the two genuinely conflict, the product-specific notice governs for that product.
3. The personal data we collect
Data you give us
- Waitlist and marketing data — your email address when you join a waitlist or ask to hear from us. Today, this is the only personal data our waitlist collects.
- Account data — name, email address, password credentials, and any profile details you add when you register for a product.
- Billing data — billing name, address, VAT details, and subscription history. Card details are entered directly with our payment processor and are never stored on our systems.
- Content you submit — the files, text, and other material you upload to or create in a product (“Customer Content”).
- Support and correspondence — the contents of messages you send us and any information you choose to include in them.
Data we collect automatically
- Usage data — pages and features viewed, actions taken, timestamps, and referring pages.
- Device and connection data — IP address, browser type, operating system, device identifiers, and approximate (city-level) location derived from IP.
- Cookies and similar technologies — see section 5.
Data from third parties
- Authentication providers, if you sign in with a third-party account — typically your name, email address, and account identifier.
- Payment processors — confirmation of payment status, and the last four digits and expiry of your card.
We do not deliberately collect special category data (such as data about health, ethnicity, or political opinions), and we ask you not to submit it to our Services unless a product specifically invites you to.
4. Why we use it, and our lawful basis
Under UK GDPR we must have a “lawful basis” for each use of your personal data. Ours are:
| What we do | Lawful basis |
|---|---|
| Provide, maintain, and support the Services, and manage your account | Performance of a contract with you |
| Take payment and manage subscriptions | Performance of a contract; legal obligation (tax and accounting records) |
| Add you to a waitlist and tell you when the product you asked about is available | Consent — given when you submit your email. You can withdraw it at any time |
| Send marketing emails about our other products | Consent, or our legitimate interest in marketing to existing customers about similar products. Every email has an unsubscribe link |
| Secure the Services, prevent fraud and abuse, and debug problems | Our legitimate interest in keeping the Services safe and working |
| Understand how the Services are used so we can improve them | Our legitimate interest in improving our products; consent where analytics cookies require it |
| Comply with law and enforce our terms | Legal obligation; our legitimate interest in establishing and defending claims |
Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and concluded they are not. You may object to that processing at any time — see section 12.
5. Cookies
We use three kinds of cookie and similar technology:
- Strictly necessary — required to sign you in, keep your session, and protect against abuse. These cannot be switched off.
- Analytics — help us understand which pages and features are used, so we can improve them.
- Preference — remember choices such as your theme or language.
We only set analytics and preference cookies with your consent, and you can change or withdraw that consent at any time through the cookie controls on our site or your browser settings. We do not use advertising or cross-site tracking cookies.
6. When we share personal data
We do not sell your personal data, and we never will. We share it only in these circumstances:
- Service providers (sub-processors) who run parts of our infrastructure on our behalf — hosting, databases, email delivery, payment processing, analytics, and customer support. They may only process your data on our documented instructions, and are bound by written contracts requiring appropriate security.
- Professional advisers — lawyers, accountants, insurers, and auditors, where they need the data to advise us.
- Authorities — where we are required to disclose by law, court order, or a valid request from a regulator or law enforcement.
- A buyer or successor — if we are involved in a merger, acquisition, financing, or sale of assets, personal data may be transferred as part of that deal. We will tell you before your data becomes subject to a materially different privacy policy.
We maintain a current list of our sub-processors and will provide it on request to ben@hamburgerlabs.com.
7. International transfers
Some of our service providers are based outside the UK, including in the United States. When we transfer personal data outside the UK, we make sure it is protected by one of the safeguards UK law recognises: an adequacy decision covering the destination country, the UK’s International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with any additional measures the transfer requires. You can ask us for a copy of the safeguard we rely on for a particular transfer.
8. How long we keep it
We keep personal data only as long as we need it for the purpose we collected it for.
- Waitlist emails — until the relevant product launches and we have contacted you, or until you unsubscribe, whichever is sooner. If a product is cancelled, we delete the associated list.
- Account and Customer Content — for as long as your account is active, and then for up to 90 days after closure so you can change your mind and we can complete deletion across our backups.
- Billing and tax records — six years after the end of the relevant financial year, as UK tax law requires.
- Support correspondence — up to three years after the matter is closed.
Where we are required to keep data longer by law, or need it to establish or defend a legal claim, we will retain it for that period and no longer.
9. Security
We take appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, access controls on a need-to-know basis, logging, and regular review of our providers. No online service can be completely secure, so we cannot guarantee absolute security — but if a breach affects your personal data and poses a risk to your rights, we will notify the Information Commissioner’s Office within 72 hours and tell you without undue delay where the risk is high.
10. Children
Our Services are not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.
11. When a business customer is the controller
If you use one of our products because your employer or another organisation gave you access, that organisation is the controller of the Customer Content and account data processed in it — not us. We process that data as their processor, on their instructions, under a data processing agreement. Direct your privacy requests to them; if you send them to us, we will pass them on. This policy still describes how we handle data we control in our own right, such as our marketing site and waitlists.
12. Your rights
Under UK data protection law you have the right to:
- be told how your data is used, and get a copy of it (a “subject access request”);
- have inaccurate data corrected, and incomplete data completed;
- have your data deleted where we no longer have a good reason to keep it;
- restrict how we use your data while a concern is being resolved;
- receive data you gave us in a portable, machine-readable format, and have it sent to another provider where technically feasible;
- object to processing we base on legitimate interests;
- object to direct marketing at any time — this one is absolute, and we will always stop;
- withdraw consent at any time, where we relied on it. This doesn’t affect processing we did before you withdrew.
To exercise any of these, email ben@hamburgerlabs.com. We will respond within one month. Exercising your rights is free, and we will not treat you differently for doing so.
If you are unhappy with how we have handled your data, we would like the chance to put it right — but you can also complain to the Information Commissioner’s Office, the UK supervisory authority, at ico.org.uk or on 0303 123 1113.
13. Automated decision-making
We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Where a product uses automated systems to filter, rank, or flag content, a person reviews any decision that materially affects your access to the Services.
14. Changes to this policy
We may update this policy as our products change. If a change is material, we will tell you by email or an in-product notice before it takes effect. The “last updated” date at the top always reflects the current version.
15. Contact us
Privacy questions and rights requests: ben@hamburgerlabs.com
Everything else: ben@hamburgerlabs.com
Post: HAMBURGERLABS LIMITED, 5 Temple Road, Croydon, England, CR0 1HU