Effective date: 10 July 2026
We've written this in plain English on purpose. WhatsOn is a warm, human product and we think a privacy policy should be readable, not a wall of legalese. It's still a serious document — it tells you exactly what personal data we collect, why, and what you can do about it — but you shouldn't need a law degree to follow it.
WhatsOn is a live event-map app. Anyone can drop a pin on the map for their own event, and anyone can browse what's happening near them.
For the purposes of UK data protection law, the data controller is WhatsOnApp Ltd, a company registered in Scotland (company number SC895690), registered office 48 West George Street, Glasgow, Scotland, G2 1BP ("WhatsOn", "we", "us", "our"). We operate from the United Kingdom market.
If you have any question about this policy or your data, contact us at support@getwhatson.app. Our website is getwhatson.app.
This policy applies to everyone who uses the WhatsOn app or visits our website. WhatsOn is for adults aged 18 and over only (see section 11). We do not knowingly collect or process the personal data of anyone under 18.
Under UK GDPR we must have a lawful basis for every category of personal data we process. Here is the full picture, category by category.
We do not sell your personal data, we do not run third-party advertising inside the app, and we do not use your content to train AI models.
WhatsOn is for adults 18 and over only. We do not knowingly collect or process children's personal data. We collect date of birth solely to enforce this age restriction and reject under-18 accounts at database level. If we learn that an under-18 holds an account, we will delete it. As a matter of good practice we also apply privacy-protective defaults, minimise the data we collect, don't run profiling to target content or ads, and don't use nudge techniques to push anyone into over-sharing.
We use a small set of trusted service providers ("processors") to run WhatsOn. Each only processes your data on our instructions and for the purposes above:
On our website, the consent-gated Meta pixel shares data with Meta only after you accept it via our banner.
Law enforcement and safety. We may disclose personal data (including the security logs described in section 3.11) to the police or other authorities where the law requires or permits it — for example, in response to a valid, verified request, a court order, or where someone's safety is at risk. UK law also places a duty on services like ours to report child sexual exploitation and abuse content to the National Crime Agency; where we make such a report, we include the information the law requires and retain the related records for the period the law sets. We only ever share the minimum necessary, and we keep a record of every disclosure we make.
Some of these providers process data outside the UK. Where that happens, we rely on the appropriate UK safeguards — the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses (SCCs), or a country covered by UK adequacy regulations. Sentry data is deliberately routed to an EU (German) endpoint. You can ask us for detail on the safeguards for any specific provider.
We keep your account data for as long as you have an account. You can delete your account at any time inside the app, which permanently removes your profile, pins, comments, and associated content. Crash and diagnostic data is kept for roughly 30 to 90 days and then discarded. Waitlist emails are kept until launch plus a reasonable period, after which we delete them if you haven't become a user. We may retain limited records longer where we must for legal, safety, or fraud-prevention reasons (for example, a record that an account was banned). Security and safety logs (section 3.11) are kept for 12 months. If we are legally required to preserve specific records — for example following a report to law enforcement — deleting your account still removes your public presence, but those specific records are kept for as long as the law requires and no longer.
Under UK GDPR you have the right to access a copy of your data, to have it corrected, to have it deleted, to restrict or object to how we use it, to data portability, and to withdraw any consent you've given (without affecting processing that already happened). The quickest route for deletion is the in-app delete-account button. For any other request, email support@getwhatson.app and we'll respond within the legal timeframe.
If you're unhappy with how we've handled your data, please tell us first so we can put it right. You also have the right to complain to the UK's Information Commissioner's Office (ICO) at ico.org.uk, or by calling their helpline.
Our website uses only what's necessary to function until you tell us otherwise. Advertising and analytics pixels (Meta, X) are consent-gated — they don't load unless you accept them via our banner, and you can change your mind at any time. This is in line with the Privacy and Electronic Communications Regulations (PECR).
WhatsOn is strictly for adults aged 18 and over. We enforce this with a date-of-birth gate at sign-up. If we learn that someone under 18 has created an account, we will remove it.
We'll update this policy as the product evolves. If we make a meaningful change we'll update the effective date at the top and, where the change is significant, tell you in the app or by email. Continuing to use WhatsOn after a change means you accept the updated policy.
Data controller: WhatsOnApp Ltd, a company registered in Scotland (company number SC895690), registered office 48 West George Street, Glasgow, Scotland, G2 1BP.
Email: support@getwhatson.app