Privacy Policy

1. Who we are

Ckrit Labs Ltd ("we", "us", "our") operates the ISLA mobile application. We are registered in England and Wales.

If you have any questions about this policy, contact us at: Contact — info@ckritlabs.com

2. What data we collect

2.1 Account data

• Email address
• Display name (optional)
• Date of birth (age verification — we confirm 18+ only, we do not store the exact date)
• Apple Sign In identifier (if you use Sign in with Apple)

2.2 App activity data

• DJs you follow
• Events you view or save
• Clubs you visit or check in to
• Reviews and posts you submit
• Referral code usage
• Rewards points balance and transaction history

2.3 Technical data

• Device type and operating system
• App version
• Crash reports and error logs
• General location (country/region — not precise GPS unless you grant map permission)

2.4 Data we do NOT collect

• Payment card details (we do not process payments)
• Precise GPS location without your explicit permission
• Contacts or address book
• Microphone or camera data

3. How we use your data

• To create and manage your ISLA account
• To operate the Rewards programme and track referrals
• To personalise your experience (e.g. showing followed DJs)
• To send transactional emails (password reset, account verification)
• To improve the app based on usage patterns
• To comply with our legal obligations

We do not use your data for advertising profiling, sell it to third parties, or share it with venues without your consent.

4. Legal basis for processing

We process your data under the following legal bases (UK GDPR):

• Contract — processing necessary to provide the ISLA service you signed up for
• Legitimate interests — improving the app, preventing fraud, ensuring security
• Consent — push notifications (you can withdraw at any time in Settings)
• Legal obligation — retaining records where required by law

5. Data storage and security

Your data is stored on Supabase servers located in the EU (Paris, France). Supabase is SOC 2 compliant and encrypts data at rest and in transit.

We use Row Level Security (RLS) on all database tables — you can only access your own data.

Transactional emails are sent via Resend from isla@ckritlabs.com.

6. Data sharing

We share data only with:

• Supabase — database and authentication provider (EU servers)
• Resend — transactional email provider
• Expo / EAS — app build and push notification infrastructure
• Apple / Google — app distribution platforms

We do not share your data with clubs, venues, DJs, or any other third parties without your explicit consent.

7. Your rights

Under UK GDPR you have the right to:

• Access — request a copy of the data we hold about you
• Rectification — correct inaccurate data
• Erasure — delete your account and all associated data
• Portability — receive your data in a machine-readable format
• Restriction — limit how we process your data
• Object — object to processing based on legitimate interests
• Withdraw consent — turn off notifications in Settings at any time

To exercise any of these rights, contact us: Contact — info@ckritlabs.com

You may also lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have mishandled your data.

8. Data retention

• Active account data: retained while your account is active
• Deleted accounts: all personal data permanently deleted within 30 days of account deletion
• Anonymised usage data: may be retained indefinitely for analytics
• Legal records: retained for up to 7 years where required by law

9. Children

ISLA is strictly for users aged 18 and over. We do not knowingly collect data from anyone under 18. If we become aware that a user is under 18, we will immediately delete their account and all associated data.

10. Cookies and tracking

The ISLA mobile app does not use browser cookies. The ISLA website (theibizaapp.com, ckritlabs.com) may use essential cookies for analytics. See our Cookie Policy for details.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via the app. The "last updated" date at the top of this page will always reflect the most recent version.

12. Contact

Ckrit Labs Ltd
London, United Kingdom
Registered in England & Wales