Privacy notice

1. Who we are

ClubPass is operated by [TO BE COMPLETED — registered company name], registered at [TO BE COMPLETED — registered address, Tunisia] (registration [TO BE COMPLETED — RNE / tax registration number]). We are the data controller for the personal data described here.

For any question about this notice or about your data, write to contact@clubpass.space.

2. What we collect

From parents

• Account details: name, email address, phone number, and your password (stored hashed, never in readable form).
• If you sign in with Google or Apple: the account identifier and email those services return to us.
• Payment records: amount, currency, method, and the transaction reference. Card details are entered directly with our payment providers and never reach our servers.
• Your activity in the app: bookings, approvals, wallet credit balance and transactions, and messages you send us.

From and about children

• First name and age, so clubs can place a child in the right group.
• The activities a child requests and attends, and their check-in records.
• Anything else a parent chooses to add to a child's profile. We ask for the minimum a club needs to run a safe class — please do not add more.

From partner clubs

• Business details, contact person, activity listings and schedules, and payout information.

Automatically

• Device and app information, app version, approximate region, and crash diagnostics.
• Usage events (screens viewed, features used) used to understand and improve the product.

3. Why we use it, and on what legal basis

• To provide the service — creating your account, showing activities, taking bookings, moving credits, and letting clubs run their classes. Basis: performance of our contract with you.
• To take payments and pay clubs, and to keep the accounting and tax records the law requires. Basis: contract and legal obligation.
• To keep the service safe — preventing fraud, abuse of credits, and unauthorised access. Basis: our legitimate interest in a service that is not being defrauded.
• To fix and improve the app using crash reports and usage analytics. Basis: legitimate interest, and your consent where the law requires it.
• To measure our advertising and understand which campaigns bring families to ClubPass. Basis: your consent. This is off unless you turn it on.
• To send you service messages (booking confirmations, approval requests, receipts). Marketing emails are separate and always have an unsubscribe link.

4. Advertising, analytics and tracking

On iOS, we ask for your permission through Apple's App Tracking Transparency prompt before any advertising or attribution tracking is enabled. If you decline — or simply never answer — advertising identifiers stay off and we do not share data with advertising partners for measurement. You can change your answer at any time in your device settings.

Analytics that we need to operate and debug the service (such as crash reporting) run regardless, but they do not build an advertising profile of you or your children.

We do not show behavioural advertising to children, and we do not sell personal data.

5. Who we share it with

We share only what each recipient needs, and each is bound to use it solely on our instructions.

• Partner clubs — the child's first name, age, and the booking, so they can run the class. Clubs do not see your payment details or your other bookings.
• Payment providers (Stripe, Konnect) — to process payments and refunds. They act as independent controllers for the card data you give them directly.
• Infrastructure and tooling — hosting, database, object storage and error monitoring providers that store data on our behalf.
• Analytics and attribution (Mixpanel, AppsFlyer, Meta, Firebase Crashlytics) — as described in section 4, and subject to your tracking choice.
• Authorities — where we are legally required to, or to protect someone's safety.

6. Where your data goes

Some of the providers above process data outside Tunisia, including in the European Union and the United States. Where that happens we rely on the safeguards those providers offer, such as the European Commission's standard contractual clauses.

7. How long we keep it

• Account and child profile data: while your account is open, then deleted or anonymised.
• Booking and attendance records: kept while relevant to a dispute or a club's obligations.
• Payment and invoicing records: for the period Tunisian tax and accounting law requires.
• Diagnostics and analytics events: retained in aggregated or shortened form.

8. Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or hand it to another provider. Where we rely on consent, you can withdraw it at any time — that does not affect what we did before you withdrew it.

A parent may exercise these rights on behalf of their child, including asking us to delete everything we hold about that child.

Deleting your account

You can delete your account and all associated child profiles from inside the app, under Profile. You can also email contact@clubpass.space and we will action it. We keep only what the law obliges us to keep, such as payment records. For step-by-step instructions, see how to delete your account.

If you believe we have handled your data wrongly, you can complain to the Tunisian Instance Nationale de Protection des Données Personnelles (INPDP), or to your local supervisory authority if you are in the EU.

9. Security

Passwords are stored hashed. Traffic is encrypted in transit. Authentication tokens are held in the device's secure keystore rather than ordinary app storage, and access to production data is limited to the people who need it. No system is perfect, so please use a strong, unique password and tell us immediately if you think your account has been used by someone else.

10. This website

This site uses only the cookies strictly necessary to serve the page. We do not run advertising or profiling cookies here. If that changes, we will ask for your consent first.

11. Changes

If we change this notice we will update the date at the top, and tell you in the app when the change is significant.

12. Contact

contact@clubpass.space — [TO BE COMPLETED — registered company name], [TO BE COMPLETED — registered address, Tunisia].