Privacy Policy

Who we are

Flub ("us", "we", or "our") is operated by [PLACEHOLDER: registered company name], company number [PLACEHOLDER: company number], registered office [PLACEHOLDER: registered address]. This page explains our policies regarding the collection, use, and disclosure of personal data when you use the Service, and the choices you have about that data.

Flub plays two different roles depending on whose data is involved. For an operator's own account data (the person who signs up their club for Flub), Flub is the data controller. For a club's members' data, Flub is a data processor acting on that club's instructions — the club is the controller and is responsible for its own privacy notice. If you are a member of a club that uses Flub, the privacy notice that applies to you is the one shown on your club's join page, not this one; you should read that first and contact your club with any questions about your own data.

Definitions

Personal Data means data about an identifiable individual. Usage Data is data collected automatically by the use of the Service (for example, the duration of a page visit). Cookies are small pieces of data stored on a user's device. Data Controller means the party that determines the purposes and means of processing personal data; Data Processor means a party that processes data on the Controller's behalf and instructions.

Operator data we collect

When you create a Flub account for your club, we collect information such as your name, email address, password (stored as a salted hash, never in plain text), and details about your club. We use this to provide and improve the Service, to communicate with you about your account, and — unless you opt out — to send you product updates. You may opt out of marketing communications at any time using the unsubscribe link in any email we send.

Members' data we process for clubs

On a club's instructions, Flub processes data about that club's members in order to run their membership scheme — for example, mobile number, email address, first name, date of birth, offer and redemption history, and wallet pass identifiers (for Apple and Google digital passes). We process this data only as instructed by the club that collected it, and only for the purpose of operating the Service on that club's behalf.

Usage data

We may also collect information about how the Service is accessed and used — for example IP address, browser type and version, the pages visited, the time and date of a visit, and other diagnostic data.

Cookies

We use cookies to operate the Service. This includes session cookies (to keep you signed in), preference cookies (to remember your settings), and security cookies (to help protect your account). We do not currently use advertising or remarketing cookies.

You can instruct your browser to refuse cookies or to alert you when a cookie is sent, but some parts of the Service may not work correctly without them.

Payments

Where a club is on a paid plan, we use a third-party payment processor, Stripe, to handle billing. We do not store or collect full payment card details ourselves — that information is provided directly to Stripe, whose use of it is governed by Stripe's own privacy policy.

Retention

We retain Personal Data only for as long as necessary for the purposes set out in this policy, including to comply with our legal obligations, resolve disputes, and enforce our agreements. For members' data processed on a club's behalf, retention follows the instructions and retention period set by that club.

Transfers

Your information may be transferred to and maintained on computers located outside your own state, province, country, or other jurisdiction, where data protection laws may differ. We take reasonable steps to ensure your data is treated securely and in accordance with this policy wherever it is processed.

Security

We use commercially reasonable measures to protect Personal Data, but no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

Disclosure

We may disclose Personal Data where required to do so by law, in response to valid requests by public authorities, or where we believe in good faith that disclosure is necessary to comply with a legal obligation, protect our rights or property, prevent or investigate wrongdoing, or protect the safety of users or the public.

Business transfer

If Flub is involved in a merger, acquisition, or asset sale, Personal Data may be transferred as part of that transaction. We will provide notice before your Personal Data is transferred and becomes subject to a different privacy policy.

Your rights

Subject to applicable law, you have rights over your Personal Data, including to access a copy of it, to have inaccurate data corrected (rectification), to have it deleted (erasure), to receive it in a portable format, and to object to certain processing.

If you are an operator, you can exercise these rights over your own account data by contacting us directly. If you are a club member, these rights apply to your data too, but because the club — not Flub — is the controller of that data, please contact your club first; we will assist the club in responding to your request.

Children

The Service is not directed at children, and we do not knowingly collect Personal Data from anyone under the age of 13. If you believe a child has provided us with Personal Data, please contact us so we can remove it.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and, where appropriate, by email or a notice within the Service, before the change takes effect.

Contact us

If you have any questions about this Privacy Policy, please contact us at support@useflub.com.