Privacy Policy

1. Who We Are

ClubForge (“we”, “us”, “our”) operates the ClubForge platform at clubforgehq.com. ClubForge is a Software-as-a-Service (SaaS) platform that provides club management tools to gym owners, martial arts academies, and sports organisations (“Club Operators”). Club Operators use ClubForge to manage their own members (“End Users”).

2. Data We Collect

From Club Operators (customers):

• Name, email, and contact details
• Club name, address, and type
• Billing information (processed by Stripe — we do not store card numbers)
• Usage data and platform analytics

From End Users (club members):

• Name, email, phone, and emergency contacts
• Attendance records and class participation
• Belt/rank progression and grading history
• Membership and payment information (processed by Stripe)

3. How We Use Data

• To provide and operate the ClubForge platform
• To process payments and subscriptions via Stripe
• To send transactional emails (welcome, billing, notifications)
• To improve the platform and fix bugs
• To comply with legal obligations

We never sell personal data to third parties.

4. Data Processor vs Controller

ClubForge acts as a Data Processor for End User data on behalf of Club Operators, who are the Data Controllers. ClubForge is a Data Controller for Club Operator account data.

Club Operators are responsible for ensuring they have lawful bases for collecting and processing their members' data through ClubForge.

5. Data Security

• All data is encrypted in transit (TLS) and at rest
• Row-level security (RLS) ensures complete tenant isolation — clubs cannot access each other's data
• Hosted on enterprise-grade cloud infrastructure with global availability
• Regular security reviews and updates
• Payment data handled by Stripe (PCI DSS compliant)

6. Data Retention & Deletion

Club data is retained for the duration of the active subscription. Upon cancellation, data is retained for 90 days to allow reactivation, then permanently deleted.

Club Operators can export their data at any time (CSV, JSON, or API depending on plan). End Users can request data deletion through their Club Operator.

7. Third-Party Services

• Cloud Database Provider — secure database hosting and authentication
• Stripe — payment processing
• Cloud Hosting Provider — application hosting and content delivery

Each service has its own privacy policy and is GDPR-compliant.

8. Your Rights (GDPR)

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to processing of your data
• Data portability — receive your data in a structured format
• Withdraw consent at any time

9. Cookies

ClubForge uses essential cookies only — for authentication and session management. We do not use tracking, advertising, or analytics cookies.

10. Contact