Who we are

Lavender is operated by Gurdas Singh, trading as Lavender ("Lavender", "we", "us"). For data protection purposes, Gurdas Singh is the controller of the personal information described in this notice.

You can contact us about privacy at getlavender@gmail.com.

Who Lavender is for

Lavender is currently for adults aged 18 and over only. We ask you to confirm you are 18 or over when you create an account, and we record when that confirmation was given.

Information we collect

As part of using Lavender, we collect and hold:

• your email address and authentication details;
• your first name;
• the timestamp of your 18+ age confirmation;
• your onboarding progress, status, and code-of-conduct acceptance;
• the plan interests you tell us about;
• the availability you provide for meeting up;
• how you found out about Lavender (acquisition attribution);
• your plan proposals, acceptances/declines, and plan membership;
• Meeting Pack details for confirmed plans, such as time, venue, and logistics;
• meetup feedback you submit after a plan, including any optional notes;
• your private, directional repeat-connection preferences about people you have met through a plan;
• safety reports you submit, including any optional details you choose to add;
• operational safety exclusions put in place to keep people apart following a report;
• necessary technical and security information (for example, information needed to keep your account secure and the service reliable).

Lavender does not ask for special-category information such as ethnicity, religion, sexual orientation, or health information as part of ordinary profile or onboarding use. Free-text fields - particularly safety reports and optional feedback notes - may sometimes contain sensitive information if a user chooses to include it. See "Sensitive information in safety reports" below.

How we use your information, and our legal bases

We rely on the following legal bases, depending on what the information is used for:

Contract

Where processing is genuinely necessary to provide the Lavender service you've asked for: creating and maintaining your account; arranging Lavender plans you've asked to take part in; processing your proposal responses (accept/decline); and confirmed-plan logistics, including your Meeting Pack.

Legitimate interests

Where we have a legitimate business interest that isn't overridden by your rights: enforcing our 18+ eligibility requirement; acquisition attribution (understanding how people find Lavender); meetup feedback and service quality; operating private repeat-connection preferences to help run future plans; authentication and account security; preventing abuse and misuse of the service; and operational safety, including handling reports and exclusions.

Legal obligation

Where processing is genuinely required by law that applies to us.

Consent

We do not rely on consent for the core Lavender service. We do not currently use third-party advertising or behavioural analytics tools, and we do not use account creation as consent to marketing.

Sensitive information in safety reports

Safety reports are free text, and can sometimes end up containing sensitive personal information about you or someone else (for example, if it's relevant to what happened). We ask that you only include information that is genuinely relevant to your report, and avoid unnecessary sensitive personal information about yourself or other people.

Where a report does contain sensitive information, we minimise our use of it, and only retain or use it where data-protection law permits. This guidance is there to help you write a clear, focused report - it is never a reason for us to refuse or obstruct a genuine safety report.

Repeat-connection preferences

After a confirmed plan, we may ask whether you'd be happy to be in another Lavender plan with someone you met. Your answer is directional and private: the other person never sees it, and it isn't a public rating, review, or reputation score. Authorised Lavender operations may access it, and it may inform how we put together future plans. Answering "prefer not" doesn't itself create or imply a safety report - if something happened that you want to tell us about, that's a separate report at Report a concern.

How long we keep information

• Account, profile, and onboarding data: for as long as your account is active.
• Plan records, meetup feedback, and repeat-connection signals: for 12 months after the relevant plan.
• Acquisition attribution: for 12 months.
• Routine technical and security information: only for as long as necessary for security and reliability - where Lavender controls the retention setting, we aim for no more than 90 days.
• Safety reports and exclusions: for 24 months after the relevant incident, unless a longer period is reasonably necessary for an active safety matter, a dispute, or a legal obligation.

If you ask us to delete your account, we delete or anonymise information we no longer need, subject to any safety or legal reason to keep it for longer. We don't currently offer an automated self-service deletion or export tool - see "Your rights" below for how to make a request.

Who we share information with

We use a small number of service providers to run Lavender:

• Supabase provides our database and authentication infrastructure. Lavender's current primary Supabase project data is hosted in London, UK.
• Vercel provides application hosting and delivery for Lavender. We haven't configured a production deployment yet, so we don't state a specific Vercel region here.

Some service providers may process information outside the UK. Where a restricted international transfer occurs, we will only make it using a transfer mechanism or safeguard permitted under UK data-protection law. We do not currently share personal information with third-party advertising or behavioural analytics providers.

Your rights

Subject to applicable data-protection law, you may have the right to ask us to: confirm what personal information we hold about you and get a copy of it; correct inaccurate information; delete information we no longer have a reason to keep; restrict or object to certain processing; and (where relevant) receive certain information in a portable format.

To make a request, email getlavender@gmail.com. We don't currently have a self-service preference centre or export tool, so requests are handled individually by email.

You also have the right to complain to the UK Information Commissioner's Office (ICO) if you believe your information hasn't been handled in line with data protection law. You can find out how at ico.org.uk.

Changes to this notice

We may update this notice as Lavender develops. This is version 1.0, effective September 2026.