Data and privacy
How we keep your data
This is ClubCP's privacy notice. It explains what personal information we collect, why we need it, who else handles it, where it is stored, how long we keep it, and what you can ask us to do with it. It is written to be read, not to be survived.
Last updated September 3, 2026
The short version. We collect what a club needs to run and what an account needs to work, and not much else. We do not sell your data, we do not use it to train AI models, we run no advertising and no advertising trackers, and there is no third-party analytics on this site. Our servers are in Germany. You can ask us for a copy of your data or for it to be deleted, at any time, by emailing support@clubcp.app.
Use accurate information. Clubs rely on your name, age eligibility and contact details when they run activities and when they respond to a safety incident. ClubCP is not an emergency service and does not independently verify profiles.
Who is responsible for your data
ClubCP is built and run by the ClubCP team, working from the United Kingdom. For your account itself, meaning your login, your profile, your payments and the platform's own logs, we are the data controller.
For the information a club collects about its own members, the club is the controller and we are its processor. A club decides what it asks its members for, what it does with it and how long it needs it, and we hold and process that data on the club's instructions. If your question is about why a club asked you for something, the club is the right first stop; if it will not answer, tell us and we will try.
For anything at all, including access, correction, deletion and complaints, email support@clubcp.app. Our postal address is ClubCP, Unit 1202, Conington Road, London SE13 7GX, United Kingdom.
What we collect, and why
Everything below is either something you gave us, something a club asked you for, or something your browser sends when it loads a page. The last column is the lawful basis we rely on under UK and EU data protection law.
| What | Why | Lawful basis |
|---|---|---|
| Your name and email address | To create and secure your account, sign you in, send service messages, and let a club identify the right person. | Performance of our contract with you |
| Your password, stored only as a one-way hash | To sign you in without anyone, including us, being able to read your password. | Performance of our contract with you |
| Your year of birth, and your full date of birth if a club asks for it | So a club can check age eligibility for an activity, including activities limited to adults. Year of birth is the default and is all most clubs need. A club can ask for a full date of birth where its own activity or its insurer requires one; you will see it marked as required on the form when it does. Neither is shown on your public profile. | Legitimate interests, in running age-appropriate activities safely, or the club's own basis where the club asked for it |
| Profile details you choose to add, such as a photo, bio and social links | To show the profile you want other members to see. Everything here is optional. | Consent, which you can withdraw by deleting the field |
| Club membership, event registrations, tickets and attendance | To run the club you joined: your membership status, what you booked, and whether you turned up. | Performance of our contract with you, and the club's legitimate interests in running itself |
| Extra details a club asks you for, such as a phone number, emergency contact or dietary needs | Whatever that club needs it for. The form tells you when a club is asking, and the club decides what it asks for. | The club's basis, usually its legitimate interests or your consent. We hold it for the club as its processor |
| Payment records: the club, the amount, the currency, the status, the provider and the transaction reference | To show you and the club what was paid, to reconcile payouts and fees, and to meet our own record-keeping obligations. | Performance of our contract, and legal obligation for financial records |
| Posts, comments, photos and messages you send inside a club | To show them to the people you sent them to. | Performance of our contract with you |
| Technical logs: IP address, browser and device type, pages requested, timestamps and error reports | To keep the platform running, investigate errors, and detect abuse, scraping and fraud. | Legitimate interests, in the security and reliability of the platform |
| Emails you send to support | To answer you, and to keep a record of what was asked and what we did about it. | Legitimate interests, in supporting our users |
We do not ask for special category data such as health, religion or ethnicity. A club may ask you for something like a dietary requirement or a medical note for its own activity. If it does, it is asking you for it, you can decline, and the club is responsible for having a proper reason to hold it.
Passwords and account security
Your password is never stored as readable text. It is put through a one-way hash, and neither our team nor a club administrator can recover it. Use a password you do not use anywhere else.
We use rate limiting, an anti-bot check on sign-up, encrypted connections and access controls to protect the platform. No online service can promise absolute security, and we do not.
Payments and financial information
Card numbers and bank details are handled by Stripe and are never stored in ClubCP's database. We do not have access to your full card number or your bank login.
We do store the record of a payment: which club, which member, the amount, the currency, the status, the provider and the transaction reference. We keep those records because both you and the club need to be able to look up what was paid, and because financial records have to be kept.
Stripe processes your payment under its own privacy policy, as the payment processor for the club you are buying from.
Who can see your information
Your public profile shows what your privacy settings allow. Administrators of a club you have joined can see what they need to manage your membership, your bookings and your attendance. Emergency contact details are for authorised club leaders responding to an incident and are never shown on a public profile.
We do not sell your personal information, we do not share it with advertisers, we do not use it to train AI models, and we do not disclose it to anyone except the processors listed below, the club you joined, and where we are legally required to.
Who processes data for us
| Who | What they do | Where |
|---|---|---|
| Hetzner Online GmbH | Hosting. Our servers, application databases and backups run here. | Germany |
| Stripe | Payment processing and payouts to clubs. Stripe handles card details directly; we never receive them. | Ireland, United States, Australia |
| Cloudflare | Content delivery, uploaded images and files, and the Turnstile anti-bot check on our sign-up and contact forms. | Global network, including the EU and the United States |
| Amazon Web Services | Sending the emails ClubCP and clubs send you, and some file storage. | United States and the EU |
| Optional Sign in with Google. Only used if you choose that button; we receive your name, email and Google account identifier. | United States | |
| Telegram | Optional club integration. Only used by clubs that connect it, and only for the notifications they send through it. | Global |
| Open-Meteo | Turning an event's place name into coordinates for the weather forecast on an event page. We send the place name, never anything about you. | Germany |
Our error monitoring, our product analytics and our feature flags all run on our own servers rather than on a third party's. Nothing about your visit is sent to an analytics company, an advertising network or a data broker.
Where your data is stored, and when it leaves the country
ClubCP's servers, databases and backups are hosted in Germany. If you are in Australia, that means your personal information is stored overseas, and we are telling you so because the Australian Privacy Principles require it. Germany is in the European Union and is covered by the EU General Data Protection Regulation.
Some of the processors above operate in other countries, including the United States. Where personal data is transferred out of the UK or the EU, we rely on the receiving organisation's standard contractual clauses or an adequacy decision, whichever applies to them.
Emails we send you
Service emails, such as verifying your address, resetting your password, confirming a ticket, and telling you an event you booked has changed, are part of the service. They are not marketing and you cannot opt out of them while you have an account, other than by closing the account.
Club emails, such as announcements, reminders and offers, come from a club you joined. Every one of them carries a way to stop receiving that kind of message, and you can also ask the club or us directly. We do not send you marketing about ClubCP itself, and we never pass your address to anyone for marketing.
Keeping information accurate
You are responsible for giving information that is accurate and keeping it current. False or incomplete information can make an age or safety assessment unreliable, and may result in a booking, a membership or an account being restricted.
ClubCP and clubs may rely on what you tell them, and cannot guarantee that user-submitted details are correct. This does not exclude any responsibility that cannot lawfully be excluded.
How long we keep things
Account and profile data is kept while your account is open. If you close it or ask us to delete it, we remove your profile and your personal details.
Payment and transaction records are kept for seven years after the payment, because tax and financial-record rules require it. A deletion request does not remove those, but we reduce them to what the record actually needs.
Posts, comments and messages you put in a club stay with that club unless you or the club deletes them, because they are part of the club's own record of what it did.
Technical logs and error reports are kept for up to 90 days. Backups are kept on a rolling cycle and are overwritten in the ordinary course, so deleted data can persist in a backup for a short period after it is removed from the live system.
Your rights, and how to use them
You can ask us to:
- give you a copy of the personal data we hold about you;
- correct anything that is wrong;
- delete your account and your personal data;
- give you your data in a portable form, or send it somewhere else;
- stop or restrict a particular use, including any use we base on legitimate interests;
- withdraw consent you gave for something optional, at any time.
You can do the two big ones yourself, straight away, from your profile settings: Download my data gives you a copy of everything we hold about your account, and Delete my account removes your profile and your personal details. Most profile information you can also just edit there.
For anything else, email support@clubcp.app with enough detail for us to find your account. We will respond within one month. There is no charge.
We do not make any decision about you by automated means that has a legal or similarly significant effect.
Children
You must be at least 16 to hold a ClubCP account. We do not knowingly collect personal information from anyone younger, and if we find that we have, we delete it.
A club may record a child as a participant in its own activities, through a parent or guardian's account. That information belongs to the club, which is responsible for having the right consent for it. If you are a parent and want to know what a club holds about your child, ask the club, and tell us if it will not answer.
If you are not happy with our answer
Tell us first, at support@clubcp.app, and we will look at it again properly.
You can also complain to a regulator. In the United Kingdom that is the Information Commissioner's Office at ico.org.uk. In Australia it is the Office of the Australian Information Commissioner at oaic.gov.au. You do not have to come to us first, but it usually gets you an answer faster.
If something goes wrong
If there is a data breach that is likely to put people at risk, we will report it to the relevant regulator within the time the law allows, and we will tell the people affected directly where the law requires it or where telling them helps them protect themselves.
Changes to this notice
We will update this page when what we do changes, and the date at the top will tell you when. If a change is material, we will email account holders before it takes effect.
Read this alongside the Terms and Conditions.