Lounge & Mingle

Privacy Policy

Pre-publication draft technically reviewed: 14 August 2026

PLEASE READ THIS PRIVACY POLICY CAREFULLY.It explains what personal data Lounge & Mingle uses, why we use it, who may receive it, how long we keep it, and the choices and rights available to you.

Read our Terms of Service and Cookie Policy.

In short

• We do not sell your personal data, and we never share it for advertising.
• We run no analytics or advertising trackers. No Google Analytics, no Meta Pixel, nothing that follows you around the web.
• Some profile information is legally sensitive, including genotype, blood group, ethnicity and religion. Public collection is conditional on separate explicit-consent, withdrawal and consent-record controls. Accepting the Terms is not consent.
• Nearby discovery is off unless you turn it on. Even then your position is deliberately blurred, and only people who have also turned it on can see you.
• We analyse messages to generate conversation insights, but that analysis runs on our own servers. Your messages are never sent to an outside AI service.

1. Who We Are

LoungeMingle is a trading name of Lounge and Mingle Ltd, registered in England and Wales, company number 15163115, registered office 5 Brayford Square, London, England, E1 0SG.

We are the data controllerfor the personal data described here. That means we decide why and how your data is used, and we answer to you and to the Information Commissioner's Office for it.

Data controller and privacy contact

2. Where This Privacy Policy Applies

This Privacy Policy applies to the Lounge & Mingle websites, apps, events and other services we operate under the LoungeMingle brand. We use “service” as a short name for all of them. If a particular service has its own privacy policy, that policy will be shown to you and will apply to that service.

What is personal data?

Personal data means information relating to an identified or identifiable living person. A person may be identified directly, such as by a name or email address, or indirectly, such as through an account, device, location or activity identifier.

US readers: this UK main Privacy Policy applies alongside our supplemental US State Privacy Notice. If the two differ, mandatory US state law and the US supplement control for the relevant request.

3. What We Collect

Information you give us

• Account and identity.Email address, password (stored only as a secure hash), and — if you sign in with LinkedIn — your LinkedIn profile, name, headline, photo and employer.
• Profile. Name, age and date of birth, gender, photographs, bio, interests, height, education, job title, employer, occupation sector, income bracket, marital status, and your matching preferences and relationship goals.
• Identity and heritage, all optional. Skin tone, eye colour, ethnicity, religion, genotype, blood group, and citizenship or residency status. See section 4.
• Location.Your home area, hometown, and the location of schools you list. If you enable Nearby discovery, your device's approximate position.
• Your content. Messages, likes, matches, connection journeys, date plans, private date reviews, personality and attachment test results, Good Deeds, and anything you send support.
• Payments.Stripe collects your card details directly — we never see or store your full card number. We do keep a record of each transaction: what you bought, the amount, the date, whether it was a payment or a refund, and your subscription status. That record also holds the country, state and postcode used to work out the tax on the sale, and a tax registration number if you give us one. We keep these for 7 yearsbecause tax law requires it, so they survive deletion of your account — see Data Retention.

Information we collect automatically

• Device and browser type, IP address, session activity, and authentication events including provider, IP address and user agent.
• Push notification tokens, and error and performance diagnostics.

Web logs and technical data

Our web and API infrastructure may record technical logs when you visit or use the service. These can include your IP address, browser and operating-system details, referring page, requested route, date and time, session and authentication events, and error or performance information. We use them to deliver the service, keep accounts secure, investigate abuse, diagnose faults and meet legal obligations. We do not use web logs for advertising or cross-site tracking, and we do not run analytics trackers. Logs are retained only for as long as reasonably needed for those purposes, security investigations, legal claims or required financial and safety records; the exact operational expiry depends on the relevant service and deployment.

Information kept in this browser

Our self-hosted cookie manager stores your Essential and Personalisation choices, the policy version, and the time of your decision in local storage. Those records stay in this browser and are renewed after 180 days or when the policy version changes. The manager's runtime files are served by us and do not send your choice to Silktide.

Information from others

• From LinkedIn if you sign in with it, and from Stripe for payment outcomes.
• From other members — if someone reports you, blocks you, or writes a private review of a date with you, that record concerns you and forms part of your data.

4. Special Category Data — the Sensitive Fields

Some of what we ask for is special category data under UK GDPR Article 9. This is the most protected class of personal data, and we treat it accordingly.

• Genotype (AA, AS, SS, AC, SC) — genetic and health data
• Blood group — health data
• Skin tone and ethnicity — racial or ethnic origin
• Religion — religious belief
• Gender, matching preferences and relationship intent— sex life and sexual orientation

Why we ask about genotype.Haemoglobin genotype compatibility matters to many people considering a serious relationship — where both partners carry the sickle cell trait, there is a one-in-four chance of a child with sickle cell disease. We collect it so that members for whom this matters can make informed choices.

Our intended Article 9 condition is your explicit consent (Article 9(2)(a)). Our implementation makes heritage and religion optional in onboarding, presents profile and matching as separate choices, records the wording and time, and provides withdrawal controls. It remains a public-launch condition until the database migration and deployed flow have been reviewed and verified. Accepting our Terms is not explicit consent.

The lawful-basis and consent design for gender-based eligibility, sexual-orientation inference and analysis involving both participants in a conversation remains unresolved. Those are launch blockers for the DPIA and solicitor review.

We never use these fields for advertising, and we never disclose them to anyone beyond the infrastructure providers in section 9 who store data on our behalf.

5. Our Lawful Bases

• Contract— running your account, matching, messaging, events, and taking payment.
• Legitimate interests— keeping the platform safe, moderation, fraud and bot prevention, diagnosing faults, securing our systems.
• Consent— special category fields, location and Nearby discovery, optional marketing email, and optional Personalisation storage.
• Legal obligation — records we must keep, including financial records.
• Vital interests— responding to a genuine risk to someone's life or safety.

Where we rely on legitimate interests you can object — see section 12.

6. Location and Nearby Discovery

This is the part of the service with the most privacy risk, so here is exactly how it works.

• It is off unless you turn it on. Nothing about your location is shown to other members until you actively enable it.
• It is time-limited. Turning it on starts a session that expires automatically after 4 hours.
• It is mutual. You only see people who have also enabled it and have an active session. If either of you has it off, neither appears to the other.
• Your position is deliberately blurred.We never send your true coordinates to another member's device. What they see is offset by up to roughly 200 metres, generated so it stays consistent — which stops anyone averaging repeated observations to work out where you really are.
• It is limited in reach. By default we show people within 25 miles and never more than 50, and 8 people at a time and never more than 30. Only locations updated in the last 2 hours are used.
• People you have blocked never appear, and you never appear to them.

What other members see. Nearby shows your first name, last name, job title and occupation sector, with your blurred position and an approximate distance. Please bear that in mind when deciding whether to enable it.

Important: turning Nearby discovery off hides you, but does not delete your stored location. We keep your most recent location so the feature works immediately when you switch it back on. To have it erased, email privacy@loungeandmingle.com and we will delete it.

7. Messages and Automated Analysis

Messages between members are private. We do not read them routinely. We may access specific messages when investigating a report, responding to a safety concern, or where the law requires it.

If you hold a Social pass, we generate conversation insights by running automated sentiment analysis over your messages. This runs entirely on our own servers.The model is downloaded once and executed on our own infrastructure — your messages are not transmitted to OpenAI, Anthropic, Google, or any other external AI service.

Two things worth knowing. A conversation has two people in it, so analysing yours necessarily involves someone else's messages. And we store a summary of the result, not a running commentary. This is profiling in the technical sense, and you can object to it under section 12.

8. Photographs

Our implemented moderation design uses Google Cloud Vision to check uploaded photographs before they appear. When the provider is enabled, your photograph is sent to Google, which checks content safety, detects how many faces appear so we can confirm the photo shows one person, and returns general labels. If the provider is unavailable or not configured, the photo remains pending rather than being treated as approved.

What we keep. Only the safety ratings, the numberof faces found, and a few descriptive labels. Google's face detection also returns detailed facial measurements — the position of eyes, nose and mouth, and the angle of the head. We do not store or use any of that. It is discarded as soon as the faces have been counted. We do not create a faceprint or any biometric record, and we never use facial data to identify you.

If your photo is rejected, you can ask a person to review it.Automated face detection is not perfect — it can struggle with certain lighting, face coverings, and some disabilities. Email support@loungeandmingle.com and a human will look at it. You should never be shut out of the service by an automated check alone.

Your camera is used only when you choose to take a photo or scan a QR code. Your microphone is disabled entirely.

9. Who We Share Your Data With

Some providers process data only on our instructions. Others may also act as independent controllers for limited purposes described in their own notices. In particular, Stripe may process payment data for payment security, fraud prevention and legal compliance; LinkedIn controls its own sign-in service.

• Supabase — database, authentication and file storage
• LinkedIn — optional sign-in
• Stripe — payments
• Google Cloud Vision — photo moderation
• Google Places — school and university lookup
• Mapbox — maps and address lookup
• Firebase — push notifications
• Resend — service emails
• Upstash — rate limiting and realtime updates
• Cloudflare Turnstile — bot and abuse prevention on authentication

Recipient details

Read Stripe's Privacy Policy and LinkedIn's Privacy Policyfor their independent processing. Our contracts do not override rights they have under applicable law.

We also share your data with other members as your profile is configured, with event hosts when you book their event, where the law requires it, and to protect someone from a genuine risk to their safety. We never sell your data.

10. Sending Data Outside the UK

Some providers process data outside the United Kingdom. Where they do, we rely on a UK adequacy decision, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or the UK–US data bridge where the provider is certified. Ask us and we will tell you which applies to a given provider.

11. How Long We Keep Things

In outline: we keep your account and profile while your account is open. Our target is to erase eligible deleted-account data within 30 days, with backups cycling out within 90 days, once the documented deletion and backup-expiry procedures are operational and tested. Safety and moderation records are kept up to 12 months, because deleting them would let banned members simply return. Financial records are kept for 7 years because tax law requires it.

12. Your Rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Correct anything inaccurate
• Erase your data
• Restrict how we use it while a dispute is resolved
• Object to processing based on legitimate interests, including profiling
• Port your data to another service
• Withdraw consent at any time, including for special category fields and location
• Not be subject to a solely automated decision with significant effects

Email privacy@loungeandmingle.com. We respond within one month. We may ask you to verify your identity — we are not going to hand someone else your data because they asked nicely.

A note on other people's data.Some records involve more than one person — a conversation, a report someone made, a private review of a date. Where we cannot separate your data from someone else's without revealing theirs, we may redact parts of a response, and we will say when we do.

Complaints. Tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

13. How We Protect Your Data

Encryption in transit throughout. Passwords stored only as secure hashes. Row Level Security on our database, with sensitive tables reachable only by privileged server processes. Provider credentials and privileged authentication, photo processing, location verification, email and notification operations remain on our protected server API; browser routes are limited adapters. Your true coordinates are never exposed to another member's device. Partial sign-up answers are held in an encrypted, HTTP-only cookie for up to 24 hours. Rate limiting and bot protection on sign-in. Automated photo moderation. Session management letting you see and revoke active sessions.

No system is perfectly secure. If a breach occurs that is likely to put you at high risk, we will tell you without undue delay and notify the ICO within 72 hours where required.

14. Age Requirement

Lounge & Mingle is for adults aged 27 and over.This is higher than the legal minimum, and it is deliberate — the platform is built for people seeking intentional, relationship-ready connections.

We do not knowingly collect data from anyone under 27, and we never knowingly collect data from a child. If we find an account belonging to someone below the age requirement we close it and delete the data. If you believe a minor is using the platform, contact safety@loungeandmingle.com immediately and we will treat it as urgent.

15. Automated Decisions

We use automated processing to calculate compatibility and match scores, order Nearby results, screen photographs, and detect spam, bots and abuse. Automated screening can restrict an account or reject a photo. You can always ask for a human to review it. We do not use solely automated decision-making that produces legal effects concerning you.

16. Changes

We will update this policy as the service changes. If a change materially affects your rights we will tell you directly before it takes effect, and where the law requires it we will ask for fresh consent.

Other legal documents

This Privacy Policy is part of a wider set of documents. The complete list below makes every current public policy available, including documents that are not linked in the site footer.

17. Contact

• Privacy and your rights — privacy@loungeandmingle.com
• Support and billing — support@loungeandmingle.com
• Safety and abuse — safety@loungeandmingle.com

Lounge and Mingle Ltd, 5 Brayford Square, London, England, E1 0SG. Registered in England and Wales, company number 15163115.

See also our Terms of Service, Cookie Policy, Data Retention Policy, and the full Legal Centre.