Privacy Policy

Who we are

Flub ("us", "we", or "our") is a trading name of FLUB INDUSTRIES LTD, a company registered in England and Wales (company number 17491066), registered office The Workstation, 15 Paternoster Row, Sheffield, S1 2BX, United Kingdom. This page explains our policies regarding the collection, use, and disclosure of personal data when you use the Service, and the choices you have about that data.

FLUB INDUSTRIES LTD plays two different roles depending on whose data is involved. For a club's members' data, Flub is a data processor acting on that club's instructions — the club is the data controller and is responsible for its own privacy notice. For an operator's own account data (the person who signs up their club for Flub: their login, name and billing details), FLUB INDUSTRIES LTD is the data controller. If you are a member of a club that uses Flub, the privacy notice that applies to you is the one shown on your club's join page, not this one; you should read that first and contact your club with any questions about your own data.

Definitions

Personal Data means data about an identifiable individual. Usage Data is data collected automatically by the use of the Service (for example, the duration of a page visit). Cookies are small pieces of data stored on a user's device. Data Controller means the party that determines the purposes and means of processing personal data; Data Processor means a party that processes data on the Controller's behalf and instructions.

Operator data we collect

When you create a Flub account for your club, we collect information such as your name, email address, password (stored as a salted hash, never in plain text), and details about your club. We use this to provide and improve the Service, to communicate with you about your account, and — unless you opt out — to send you product updates. You may opt out of marketing communications at any time using the unsubscribe link in any email we send.

Members' data we process for clubs

On a club's instructions, Flub processes data about that club's members in order to run their membership scheme — for example, mobile number, email address, first name, date of birth, offer and redemption history, and wallet pass identifiers (for Apple and Google digital passes). We process this data only as instructed by the club that collected it, and only for the purpose of operating the Service on that club's behalf.

Usage data

We may also collect information about how the Service is accessed and used — for example IP address, browser type and version, the pages visited, the time and date of a visit, and other diagnostic data.

Cookies

We use cookies to operate the Service. This includes session cookies (to keep you signed in), preference cookies (to remember your settings), and security cookies (to help protect your account). We do not use advertising or remarketing cookies, and we do not place advertising pixels (including Google or Meta pixels) on the Service. If you arrive from one of our ads or campaign links, our essential session cookie may briefly hold the ad's click identifier, which we may report back to that platform (see "Advertising measurement" below), and the link's campaign tags.

You can instruct your browser to refuse cookies or to alert you when a cookie is sent, but some parts of the Service may not work correctly without them.

Advertising measurement

This section is about people who are considering Flub for their venue. It never applies to club members: we record none of this on the pages members use.

If you arrive on Flub from one of our ads, the link you clicked carries a click identifier from the advertising platform the ad came from (Google, or Meta, which runs Facebook and Instagram) and tags that say which campaign it belonged to. We keep these in your session cookie and with the sample club you build on the Service, and if you create a Flub account we store them with your account. While we run ads on Meta, we also keep the IP address and browser details (such as your browser type and version) of your visit alongside the click identifier, for anyone who arrives from one of our Meta ads. Other links to Flub can carry campaign tags too (for example in our emails), and we keep those the same way. We only ever send anything to an advertising platform when you, or the sample club you are claiming, arrived from one of its ads.

When you press "Show me" on /try and we build a sample club, we tell that advertising platform that you built one. At that point we do not have your email address, so we send only the ad's click identifier (and, to Meta, the extra details described below). If you then give us your email address (for example to save your sample club for later), create a Flub account, launch your club or add a payment card, we tell that advertising platform which of those steps happened. For these later steps we send the ad's click identifier and a hashed copy of your email address. Hashing turns your email address into a fixed string of characters using SHA-256, so we do not send the address itself. To Google we send nothing else about you: not your name, your IP address or details of your browser. To Meta we also send the IP address and browser details we kept from your visit when you built a sample club, gave us your email address or created your account, because Meta needs them to match the step to your ad. We never send your name. We send all of this from our servers. We do not place advertising cookies or pixels in your browser.

We do this on the basis of our legitimate interests. We want to know which ads lead to sign-ups, so that we spend our advertising budget sensibly. The platform the ad came from (Google or Meta) may use what we send to match the step to your ad click and to measure how well the ad worked. Its use of that data is governed by its own privacy policy.

You can object at any time. If your browser sends a Global Privacy Control signal while you use Flub, we treat it as an objection: we remember it, and from then on we send nothing about you to Google or Meta, and we do not keep your IP address or browser details for this purpose. You can also email us at support@useflub.com and we will stop sending your details. We cannot recall anything we sent before you objected.

We keep click identifiers, hashed email addresses and, where we have stored them, IP addresses and browser details for up to 12 months, and then clear them. If you build a sample club or give us your email address but never create an account, we delete them within 30 days of your last visit to your sample club. If you do create an account, we keep a record of which campaign and which of our landing pages brought you to us, for our own reporting, for as long as the account exists.

Payments

Where a club is on a paid plan, we use a third-party payment processor, Stripe, to handle billing. We do not store or collect full payment card details ourselves — that information is provided directly to Stripe, whose use of it is governed by Stripe's own privacy policy.

Retention

We retain Personal Data only for as long as necessary for the purposes set out in this policy, including to comply with our legal obligations, resolve disputes, and enforce our agreements. For members' data processed on a club's behalf, retention follows the instructions and retention period set by that club.

Transfers

Your information may be transferred to and maintained on computers located outside your own state, province, country, or other jurisdiction, where data protection laws may differ. We take reasonable steps to ensure your data is treated securely and in accordance with this policy wherever it is processed.

Security

We use commercially reasonable measures to protect Personal Data, but no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

Disclosure

We may disclose Personal Data where required to do so by law, in response to valid requests by public authorities, or where we believe in good faith that disclosure is necessary to comply with a legal obligation, protect our rights or property, prevent or investigate wrongdoing, or protect the safety of users or the public.

Business transfer

If Flub is involved in a merger, acquisition, or asset sale, Personal Data may be transferred as part of that transaction. We will provide notice before your Personal Data is transferred and becomes subject to a different privacy policy.

Your rights

Subject to applicable law, you have rights over your Personal Data, including to access a copy of it, to have inaccurate data corrected (rectification), to have it deleted (erasure), to receive it in a portable format, and to object to certain processing.

If you are an operator, you can exercise these rights over your own account data by contacting us directly. If you are a club member, these rights apply to your data too, but because the club — not Flub — is the controller of that data, please contact your club first; we will assist the club in responding to your request.

Children

The Service is not directed at children, and we do not knowingly collect Personal Data from anyone under the age of 13. If you believe a child has provided us with Personal Data, please contact us so we can remove it.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and, where appropriate, by email or a notice within the Service, before the change takes effect.

Contact us

If you have any questions about this Privacy Policy, please contact us at support@useflub.com.