Effective date: 12 May 2026 · Last updated: 30 September 2026
Plain-English summary: We collect only the data needed to run VocaLab. VocaLab is for adults: you must be 18 or over. Your voice audio is processed on your device in real time and is not uploaded — only the resulting metrics are saved to your account. The one exception is opt-in: if you explicitly choose to save a take to your private Vault, that recording is uploaded to your account so you can play it back, and you can delete it at any time. We use Supabase to store your data, RevenueCat for subscriptions (with Stripe taking card payments on the web), Sentry for crash reports, and PostHog for pseudonymous usage analytics. You can delete your account and all data at any time.
The data controller for VocaLab is:
Lydia Pallot, trading as VocaLab
Email: vocalab.app@gmail.com
Website: vocalab.ai
This policy explains how we collect, use, store, and protect your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Information you choose to publish (routine names and descriptions) is visible to anyone, including people without an account.
When you create an account, we collect:
When you use recording or analysis features, your microphone audio is processed in real time on your device to calculate metrics such as pitch, range and voice-quality scores. This real-time analysis audio is never uploaded to or stored on our servers, and we have no access to it. Only the resulting metrics are saved to your account.
The one exception is described in section 2.7 below: audio you explicitly choose to save to your Vault. Everything else remains on your device.
VocaLab does not create a biometric identifier and cannot identify you from your voice.
The real-time analysis in every feature that uses your microphone processes the audio on your device. This analysis audio is not transmitted to our servers. Examples include:
This real-time analysis audio does not leave your device, and we do not store it. The only audio that is uploaded is a recording you deliberately save to your Vault, covered in section 2.7.
Special category data: Some vocal health metrics may constitute health-related data under UK GDPR (Article 9). We process this data on the basis of your explicit consent, which you provide when opting in to vocal health features during onboarding or app use.
Vocal health data we may collect and store includes:
We automatically collect:
We do not directly collect or store payment card details. Subscriptions bought in the iOS app are processed by the Apple App Store. Subscriptions bought on vocalab.ai are processed by Stripe through RevenueCat's hosted checkout: you enter your card details there, and they go to Stripe, not to us. RevenueCat manages subscription status on our behalf and provides us with:
For web subscriptions, RevenueCat also runs the billing portal where you can change plan, cancel, update your card and download receipts, and holds your email address and payment history for that purpose.
RevenueCat may email you receipts and billing notices about your web subscription.
We never have access to your card number or bank details. We see only the billing country you select at checkout.
Saving voice recordings is optional and off by default. When you explicitly tap "Save to Vault" on a take, that specific recording's audio is uploaded to and stored in VocaLab's private cloud storage (Supabase), linked to your account. Unlike the real-time analysis above, this audio does leave your device — but only for the recordings you choose to keep.
We keep a record of the choices you make, so we can show what you agreed to and when: your acceptance of our Terms and Privacy Policy (with the version and date), your vocal-health and recording consents, your marketing preference, and, for web purchases, your request to start your subscription straight away and the billing country you selected at checkout.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Provide the Service | Account, voice metrics, sessions | Contract (Art. 6(1)(b)) |
| Vocal health features | Vocal health data | Explicit consent (Art. 9(2)(a)) |
| Manage subscriptions | Payment data, account | Contract (Art. 6(1)(b)) |
| Fix bugs and crashes | Error logs, device info | Legitimate interest (Art. 6(1)(f)) |
| Improve the product | Pseudonymous usage events | Legitimate interest (Art. 6(1)(f)) |
| Service emails | Email address | Contract (Art. 6(1)(b)) |
| Keep records of your agreements and consents | Consent and agreement records | Legitimate interests (Art. 6(1)(f)): being able to show what you agreed to and defend legal claims |
| Check you're 18 or over | Date of birth (not stored), age confirmation | Legitimate interest (Art. 6(1)(f)) |
| Marketing emails (only if you opt in) | Email address | Consent (Art. 6(1)(a)) |
| Legal obligations | As required | Legal obligation (Art. 6(1)(c)) |
Giving us your email and age confirmation is needed to create an account. Everything else is optional unless a feature needs it.
We don't use your data for advertising and don't sell it. The app analyses your data automatically to give you scores and suggestions, such as your readiness score, but no decision with legal or similarly significant effects is made about you by automated means alone.
We share data with the following processors, each under a data processing agreement:
| Service | Purpose | Data shared | Location |
|---|---|---|---|
| Supabase | Auth, database, storage | Account, voice metrics, health data | Europe (Ireland) |
| Lovable | App hosting; delivery of account emails (sign-up confirmation, sign-in links, password reset) | IP address and request data when you use the app; email address and the content of account emails | EU (Sweden); its sub-processors may be outside the UK and EU |
| RevenueCat | Subscription management | App user ID, subscription status and history; for web subscriptions, email address, payment records and billing country | US |
| Stripe | Card payments for web subscriptions | Card and billing details you enter at checkout, email address, subscription and payment records | US |
| Sentry | Error monitoring | Error logs, device info | EU (Germany) |
| PostHog | Product analytics | Pseudonymous usage events | EU |
| ipapi.co | Checks which country you're in at sign-up | IP address (not stored by us) | US |
| Apple | App distribution, in-app payments | Per their policies | US |
Apple and Stripe also act as independent controllers for payments they process; their own privacy policies apply.
We do not share your data with any other third parties unless required by law.
Some of our processors are based in the United States. Where personal data is transferred outside the UK, we ensure adequate safeguards are in place, including:
| Data type | Retention period |
|---|---|
| Account data | Until you delete your account |
| Voice metrics (pitch, range, scores) | Until you delete your account |
| Vocal health data | Until you delete your account |
| Exercise session logs | Until you delete your account |
| Saved voice recordings (opt-in) | Until you delete them or delete your account |
| Email delivery log (your address, which email was sent, and whether it was delivered) | 12 months, then deleted automatically |
| Error logs (Sentry) | 90 days |
| Analytics events (PostHog) | 12 months |
| Consent and agreement records | 6 years after your account is closed, to deal with any legal claims (kept separately from your account) |
| Accounts closed because the holder is under 18 | Deleted within 30 days of closure, except records we must keep by law |
| Subscription records | 6 years after expiry (UK tax) |
When you delete your account, we delete your account, voice metrics, vocal-health data, practice history and saved recordings from our database and storage straight away. Our processors delete what they hold under their own retention periods (listed above). We keep subscription and payment records for 6 years for tax, and the email delivery log for up to 12 months. Anonymised, aggregated data that can't identify you may be kept for product improvement.
Under UK GDPR, you have the right to:
To exercise any of these rights, email vocalab.app@gmail.com. We will respond within one month.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint.
The VocaLab app requests the following device permissions:
We do not request access to your contacts, camera, location (GPS), or photo library.
The VocaLab website (vocalab.ai) uses:
The mobile app doesn't use cookies. It uses PostHog to measure which features are used, with a pseudonymous ID stored on your device. You can turn this off at any time in Account settings under Privacy.
VocaLab is only for people aged 18 or over. We check age at sign-up by asking for a date of birth, which we don't store, and we block sign-up for anyone under 18. We don't knowingly collect personal data from anyone under 18. If we find an account belongs to someone under 18, we'll close it and delete its data within 30 days, except records we must keep by law. If you think someone under 18 is using VocaLab, contact us at vocalab.app@gmail.com.
We take reasonable technical and organisational measures to protect your data, including:
No system is 100% secure. If we become aware of a data breach that poses a risk to your rights, we will notify you and the ICO in accordance with UK GDPR requirements.
We may update this policy from time to time. If we make material changes to how we handle your data, we will notify you via the app or email at least 14 days before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision. For material changes we'll also ask you to accept the updated policy in the app.
For any questions about this Privacy Policy or to exercise your data rights:
Lydia Pallot, trading as VocaLab
Email: vocalab.app@gmail.com
Website: vocalab.ai
UK supervisory authority: Information Commissioner's Office (ICO)