theKlub Privacy Policy

1. Who we are

theKlub is operated by The Klub Technologies Ltd., a company registered in England and Wales (company number 15597572), whose registered address is 11 Cabanel Pl., London, SE11 6BD, United Kingdom. The Klub Technologies Ltd. is the data controller for the personal data described in this policy, and processes it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where the EU GDPR applies to you, we process your data in line with it as well.

2. Information we collect

We collect the following information:

• Account information: your name, email address, and password (stored only as a secure hash) or the details your sign-in provider shares with us (see section 3).
• Profile and preferences: the sports and interests you choose, your sporting level, saved experiences and hotels, your display currency, and whether you want to receive marketing emails.
• Booking information: the experiences and stays you book, travel dates, the names of the guests on a booking, your phone number, and any information you give us that the host or hotel needs to deliver your booking (for example dietary or accessibility requirements).
• Payment information: payments are processed by Stripe. We receive the payment amount, its status and a payment reference; we never see or store your card number.
• Loyalty and referrals: your points balance, credit, discount codes you use, and the people you refer or who referred you.
• Communications: messages you send to us or to hosts through theKlub, enquiries and concierge requests, and the contact method you prefer (email, phone or WhatsApp).
• Usage and device data: your IP address, browser and device type, pages visited and actions taken on the site, collected through cookies and similar technologies (see section 11).
• Photos and videos you upload: a profile photo; and, if you are a host, the photo, cover image and intro video for your public host page, which appear there once we approve it. We remove the location and camera details embedded in photos before we keep them.
• Instagram data, only if you are a host and connect your Instagram professional account (see section 4).
• Following a host: when you follow a host on their page, your first name and email address (or the ones on your account, if you are signed in), when you asked, the exact wording you agreed to, and how you reached the page (for example, the host's link you tapped). When you ask a host a question on their page, your first name, email address and message.
• A host's list of contacts: when you join a trip's waitlist, ask about, book or travel on a trip (including when the person who booked names you as a fellow traveller with your email), follow a host, or write to them on Instagram, the host sees you on their list with what you did and how you first came (for example, the host's link you tapped — never which pages you looked at). A host may also add people or import a list they already have; we keep only name, email, Instagram handle and a note from such a list. Whether you said yes to the host's own emails — the unticked "Send me … new trips" box on the waitlist and enquiry forms, or a follow — is recorded with when and the wording you agreed to.

3. Signing in with Google

You can create an account or sign in with your Google account. When you do, and only with your permission on Google's consent screen, Google shares the following with us (the openid, email and profile scopes):

• your name;
• your email address and whether Google has verified it;
• your profile picture; and
• a unique Google account identifier, which links your Google account to your theKlub account.

How we use it: only to create your theKlub account, sign you in securely, show your name and picture on your profile, and send you the service emails about your account and bookings. We do not request access to your Gmail, contacts, calendar, Drive or any other Google data.

How we share it: this data is stored by our authentication and database provider, Supabase, which processes it on our behalf. We do not sell Google user data, do not use it for advertising, and do not transfer it to anyone else except where the law requires it.

How we keep and delete it: we keep it for as long as your account is open. You can disconnect theKlub from your Google account at any time at myaccount.google.com/connections, and you can ask us to delete your account and this data by emailing support@theklub.world.

theKlub's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Connecting Instagram (hosts)

Hosts (the coaches and athletes who lead trips on theKlub) can connect their own Instagram professional account (Business or Creator) from their Klub-house, using Instagram Login. We only receive what the host allows on Instagram's consent screen, and only about the account they connected:

• Profile: the account's Instagram identifiers, username, account type, profile picture and follower count.
• The account's own posts: images and video thumbnails, captions, links and dates, and each post's statistics (reach, likes, comments, saves, shares and views) where the host granted access to them.
• The account's statistics, where the host granted access to them: its daily reach, views, engagement, follows and link taps; the age range, gender, city and country of its followers and of the people who engage with it, as totals Instagram has already aggregated (never individuals); when its followers are online; a reel's watch time; and its stories' statistics (reach, views, replies and taps), which Instagram keeps for only 24 hours.
• Messages and comments: direct messages sent to the connected account and comments on its own posts, including the sender's or commenter's Instagram username and name and what they wrote, and the host's replies. For someone who sends a direct message, Instagram also tells us their number of followers and whether they follow the host's account.
• An access token, which lets theKlub act for the account. It is stored encrypted and never sent to a browser.

How we use it: to show the host their connected account and confirm the Instagram handle on their trip pages is really theirs; to use their profile picture on their host profile if they have not uploaded one; to let them pick photos they already posted for their trip pages; to show them which posts brought visitors to their trips; where they granted access to their statistics, to show them how their Instagram is doing (growth, audience, what works and when to post) and how they compare with hosts of a similar size, as an anonymous middle value over at least five hosts in which nobody is named or can be singled out; and to bring the messages and comments people send them about trips into their Klub-house inbox, where they can answer each person once, in one place. We suggest replies drafted by an AI model from the facts on the host's own trip pages, and describe synced photos with an AI model so the host can find them. A reply is sent only by the host, or by the “reply autopilot” if the host turns it on, and never about money, cancellations, health, discounts or complaints. The first automatic reply in a conversation says it was sent automatically. Once Instagram approves it, a host can also answer a direct message between 24 hours and 7 days after it with a reply they type themselves (Instagram's “human agent” feature); automatic replies never use it. We never post to Instagram on a host's behalf except those replies and the posts described below, never message anyone who has not written first, and never read accounts other than the one connected.

Planning and writing posts: in their Klub-house a host can plan posts, keep a library of their own photos and videos, and ask for help writing. Once a week we suggest three post ideas; they are written by an AI model from numbers only — how many posts the host made and when, how their posts did where they granted access to their statistics, their trips' dates and places left, and what their past posts earned — never from anyone's messages, names or contact details, and every number in an idea is checked against those figures before the host sees it. When the host asks, an AI model also drafts hooks, captions, a reel shot list or a story sequence from their trip page, their own recent captions and the writing notes they keep about their style (which they can edit or delete at any time), and describes the photos they upload so they can search them. Drafts are only ever drafts: the host chooses what to use.

Publishing from the Klub-house, only once Instagram has approved it for theKlub and the host has granted the publishing permission (instagram_business_content_publish): a host can schedule a post they prepared — the photos or video they chose and the caption they approved — to be published on their own connected account at the time they picked, or publish it at once. We send Instagram that media file and caption, at that time, and nothing else. Every publish is started by the host; nothing is posted automatically. A scheduled post can be cancelled until 15 minutes before it goes out, and we tell the host 15 minutes before. Before each publish we check Instagram's limit for the account, and we never publish more than 25 posts a day for one account. We keep the published post's Instagram id so the host can see what it did; disconnecting deletes it with everything else below.

If you write to a host from our website (an enquiry on a trip page, or a question on a host's page): your first name, email address and message reach that host's Klub-house inbox. The host's reply reaches you by email, sent through Postmark, and your email answers come back into the same conversation. Messages about money, cancellations, health or complaints are answered by theKlub's team instead of the host.

If you message or comment on a host: when you write to a host's connected Instagram account, your username, name and message reach that host's Klub-house, and you appear as a contact in their list. Only that host and theKlub's operations team can see it.

How we share it: it is stored by Supabase and processed by Render (our servers), Vercel (our website) and OpenRouter (the AI provider behind the drafted replies, the post ideas and drafts, and photo descriptions), on our behalf. It is never sold, never used for advertising and never shared with anyone else except where the law requires it.

How we keep and delete it: for as long as the account stays connected. A host can click “Disconnect” in their Klub-house at any time, or remove theKlub in Instagram's settings (Website permissions → Apps and websites). Either way we delete the token, the synced posts and photos, every statistic we kept, every message and comment thread, the weekly post ideas reasoned from the account, and the Instagram ids of posts published from the Klub-house; a post still scheduled goes back to the host's planner unpublished. We keep daily snapshots of a connected account's statistics so its history outlasts the 90 days Instagram holds it for; audience and story snapshots are kept for at most 25 months. What the host chose to keep stays until they change it: photos they added to a trip page, their Instagram handle and profile picture on their host profile, and contacts who also gave us an email address or handle. Anyone who messaged or commented on a host can ask us to delete their data at support@theklub.world, and Meta's data deletion requests are honoured the same way.

5. How we use your information

We use your information for these purposes, on these legal bases:

• To provide your account and bookings (performance of our contract with you): creating and securing your account, taking payment, confirming bookings with hosts and hotels, issuing invoices, and supporting you before, during and after your trip.
• To run the loyalty and referral programmes (contract): awarding and redeeming points and credit, and preventing abuse.
• To send service messages (contract): booking confirmations, receipts, reminders and changes to your trip.
• To send marketing (consent): newsletters and offers, only if you opted in. You can unsubscribe at any time from the link in any email or in your profile.
• To improve and protect theKlub (our legitimate interests): understanding how the site is used, fixing errors, preventing fraud and keeping the service secure.
• To run a host's Instagram connection (performance of our contract with the host, and our legitimate interest in letting people who write to a host get an answer): as described in section 4.
• To tell you about a host you follow (consent): when you follow a host, we email you, on the host's behalf, when they open a trip or share news — and nothing else. If you are not signed in, we first send one email to confirm the address is yours; nothing more is sent until you confirm. The host sees that you follow them, with your first name and email address, in their list of contacts. You can stop at any time with the link in every such email.
• To show hosts how their pages are doing (our legitimate interest, and the host's, in knowing what works): a host sees counts about their trip pages and their public page — views, where visits came from (a country or a city once at least five people visited from it), the device type, what people did on the page, and the Google searches that found it. These are totals only: a host never sees who visited, or anything about one visitor. The search queries come from Google Search Console, which reports the words people searched and how many saw or clicked the page — never who searched; Google withholds rare queries itself. We keep those search totals for 16 months.
• A host's announcements (consent): a host can email the people who said yes to hearing from them — their followers, and anyone who ticked "Send me … new trips" — about a new trip, a new date or places left, at most four times a month and twice a month about any one trip. People a host imported are never emailed until they follow the host themselves. Every such email comes from theKlub on the host's behalf, carries a one-tap unsubscribe for that host, and records whether it was delivered, opened or clicked.
• A message about a trip you are waiting for (our legitimate interest in telling you what you asked to hear): if you joined a trip's waitlist, its host can tell you that a place opened or a second date was added — about that trip only. You can stop these with the same link.
• A host's export of their contacts (the host's legitimate interest in keeping their own records): a host can download their list as a spreadsheet at most five times a month. We log every export — who, when, which people and how many — and our team reviews that log.
• To pass your question to a host (our legitimate interest in answering you): a question you ask on a host's page goes to that host, and our team sees it too so that questions about money, health or complaints are answered by us.
• To measure advertising (consent): only if you accept marketing cookies (see section 11).
• To meet legal obligations: keeping accounting and tax records and responding to lawful requests.

We do not sell your personal data, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

6. Who we share it with

We share personal data only where it is needed for the purposes above:

• Hosts and hotels: the name, contact details and requirements needed to deliver the experience or stay you booked. Hotel reservations are placed through our booking partner LiteAPI.
• The host you follow or write to: your first name and email address, and your message if you sent one.
• Service providers acting on our behalf, under contracts that require them to protect your data and use it only on our instructions: Supabase (database and authentication), Render (server hosting), Vercel (website hosting), OpenRouter (AI models, for hosts' drafted Instagram replies, post ideas and drafts, and photo descriptions), Stripe (payments), Resend (service emails), Postmark (emails between hosts and the people who write to them from our website, and hosts' announcements to the people who said yes to them), Klaviyo (marketing emails, only if you opted in), Mixpanel (product analytics), Sentry (error monitoring), Google Maps (maps and location search) and Google Search Console (the search queries that led to host and trip pages, in totals).
• Advertising partners: Google Ads and Meta receive browsing and conversion events from our site only if you accept marketing cookies.
• Legal and safety: authorities, courts or professional advisers where the law requires it, or to protect the rights and safety of our members and our company.
• Business transfers: a buyer or successor if theKlub is sold or reorganised, under the same protections described here.

7. International transfers

Some of our providers store or process data outside the UK and the European Economic Area, for example in the United States. Where they do, we rely on the UK's adequacy regulations or on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, so your data keeps an equivalent level of protection.

8. How long we keep it

• Account and profile data, including data received from Google: for as long as your account is open. When you ask us to delete your account, we delete or anonymise it within 30 days.
• Instagram data: while the host's account stays connected (audience and story snapshots for at most 25 months); deleted when it is disconnected (see section 4).
• Booking, payment and invoice records: six years after the end of the financial year they relate to, as UK tax law requires.
• Marketing preferences: until you unsubscribe; we then keep only your email address on a suppression list so we do not contact you again.
• Follows: while you follow the host. When you unfollow we keep the record that you did, so we never email you about that host again; a follow you never confirmed sends nothing. Deleting your account deletes your follows.
• A host's contacts: while the host keeps you on their list. A host can archive anyone and delete people they added or imported themselves; the record of anything you did through theKlub stays with theKlub. Deleting your theKlub account removes you from every host's list and from the record of the emails they sent you. An unsubscribe is kept so that host never emails you again unless you say yes again. The export log holds no names — only who exported, when, and how many people.
• Analytics and error logs: no longer than 24 months.

9. Security

All traffic to theKlub is encrypted in transit (HTTPS). Data is encrypted at rest by our hosting providers, passwords are stored only as salted hashes, card details are handled by Stripe and never touch our servers, and access to personal data inside our company is limited to the people who need it to do their job. No system is perfectly secure, but we will notify you and the regulator of a breach where the law requires it.

10. Your rights

You have the right to:

• access the personal data we hold about you;
• correct inaccurate or incomplete data;
• have your data deleted;
• restrict or object to how we process it;
• receive your data in a portable format;
• withdraw your consent at any time, for marketing emails or cookies, without affecting processing that already happened.

To exercise any of these rights, email support@theklub.world. We will reply within one month. If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office at ico.org.uk or to your local data protection authority.

11. Cookies and similar technologies

We use strictly necessary cookies to keep you signed in and to make the site work; these do not need consent. We use Mixpanel, hosted in the EU, to understand how the site is used and improve it, on the basis of our legitimate interests. Advertising technologies (Google Ads and the Meta Pixel) stay off until you accept marketing cookies in our cookie banner. You can change your choice at any time by clearing this site's cookies in your browser, which shows the banner again.

When you arrive through a link a host shared or through a campaign, your browser keeps a note of where you came from (the link, the campaign and the referring site) for 30 days, and we store it with an enquiry, waitlist sign-up or booking you make. This lets us, and the host, see which link or post it came through; hosts see counts, never who you are. We also count clicks on hosts' short links (theklub.world/l/…) on our own servers, recording only the country and the type of device, never your IP address. If you decline analytics, your browser keeps no such note.

12. Children

theKlub is not directed at children under 16, and we do not knowingly create accounts for them. A child may be named as a guest on a booking made by a parent or guardian, who provides that information on their behalf. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy when our services or the law change. The date at the top shows when it last changed, and we will email account holders about significant changes before they take effect.

14. Contact us

For any question about this policy or your personal data, contact The Klub Technologies Ltd. at support@theklub.world, or write to us at 11 Cabanel Pl., London, SE11 6BD, United Kingdom.