Privacy Notice

Overview

Clhub operates as the shared identity platform for clubs, community organisations, and activity hubs. This notice explains how your personal data is handled across two distinct scopes:

• Clhub account data — controlled by Clhub
• Hub profile & membership data — controlled by the Hub's organisation; Clhub acts as a data processor

1. Clhub account data

Data controller: Clhub

What we collect: email address, first name, last name, date of birth, gender, phone number, postal address fields, login identifiers (e.g. Google account ID), and security & audit logs (login timestamps, IP addresses).

Purpose: to authenticate you, manage your account, and provide the single sign-on service across Hubs, including profile eligibility checks where required (for example, age-based event access or scoring categories).

Lawful basis: performance of a contract (providing the Clhub service you signed up for) and legitimate interests (security, fraud prevention).

Special category data: for MVP1, Clhub does not collect or process GDPR special category data in account profile flows. This includes data concerning health, political opinions, religious or philosophical beliefs, trade union membership, biometric/genetic data, and sex life or sexual orientation.

Retention: account data is retained for as long as your account is active. If you delete your account, we remove identifiable data within 30 days, except where we are legally required to retain it.

2. Hub profile & membership data

Data controller: the Hub's organisation (the club or community group you join)

Data processor: Clhub (we store and process this data on behalf of the Hub)

What is stored: membership details, bookings, event participation, results, role assignments, and any information you provide as part of your hub profile.

Purpose: to manage your membership, facilitate activities, and fulfil the Hub's operational needs.

Lawful basis: performance of a contract (your membership agreement with the Hub) and the Hub's legitimate interests in running its activities.

3. Marketing, photos & data sharing

Clhub does not send marketing communications to users. Any marketing, photo consent, or data-sharing preferences are managed at the Hub level by the Hub's organisation.

Lawful basis: consent (explicit opt-in managed per Hub via your hub profile settings). You can update or withdraw these consents at any time through your hub profile.

4. Cookies

Clhub uses essential cookies only for authentication, session management, and security. These cookies are strictly necessary for the service to function and do not require consent under applicable privacy laws.

We do not use advertising cookies, analytics tracking cookies, or third-party marketing cookies.

5. Who we share data with

• Hub organisations: receive your hub profile data for the Hubs you join.
• Infrastructure providers: hosting (Vercel), database (Supabase), authentication (Supabase Auth / Google OAuth) — all under data processing agreements.
• Payment processors: Stripe, only when payments are involved in Hub membership or bookings.

We do not sell your data to third parties.

6. International data transfers

Your data may be processed in countries outside the UK/EEA where our infrastructure providers operate. Where this occurs, appropriate safeguards (such as Standard Contractual Clauses) are in place.

7. Your rights

Under applicable data protection laws (including UK GDPR, EU GDPR, and equivalent regulations), you have the right to:

• Access your personal data
• Rectify inaccurate data
• Request erasure of your data
• Restrict or object to processing
• Data portability
• Withdraw consent (where consent is the lawful basis)

For Clhub account data, contact privacy@clhub.dev. For Hub profile data, contact the Hub's organisation directly — they are the data controller for that information.

8. Children and minors

Users under 16 may have a Clhub account only under the supervision and consent of a guardian who holds their own Clhub account. The guardian is responsible for managing the minor's account and providing consent on their behalf.

9. Changes to this notice

We may update this privacy notice from time to time. Material changes will be communicated via email or in-app notice.

10. Contact us

For privacy-related questions, contact privacy@clhub.dev.