SupaClub

Privacy Policy

Effective Date: August 31, 2025

This Privacy Policy explains how Good Creative Lab Inc. ("SupaClub," "we," "us") collects, uses, and shares information. It applies to all users of our Services.

Our Role and Responsibilities with Your Data

It is critical to understand who controls your data. Your relationship with us creates a two-part data structure:

  • Account Information (SupaClub is the Data Controller): When you create your universal SupaClub account, we act as the Data Controller for your Account Information. We determine how and why this data is processed.
  • Organization Data (The Customer is the Data Controller): Once you become a member of a Customer's Organization, that Customer acts as the Data Controller for all personal data you generate within that Organization. For this data, we act strictly as the Data Processor on the Customer's behalf.

1. Information We Collect

We collect information about you in the following ways:

  • Information You Provide to Us:
    This includes Account Information (like your name and email), transaction and billing information, and any communications you send to us.
  • Information from Customers (Data Migration):
    A Customer may provide us with personal information about their members to migrate an existing community to our Services.
  • Information We Collect Automatically:
    This includes log and usage data (like your IP address, browser type, and pages viewed), device information (like operating system and hardware model), and information from cookies.

2. How We Use Your Information

We use the information for which we are a Data Controller for the following purposes:

  • To provide, maintain, and improve our Services.
  • To process transactions and send you related information, such as confirmations and invoices.
  • To communicate with you, including responding to your comments and sending you technical notices and administrative messages.
  • To monitor and analyze trends, usage, and activities in connection with our Services.
  • For security and fraud prevention.

3. How We Share Your Information

We do not sell your private personal information. We may share information in the following circumstances:

  • With the relevant Customer when we are acting as a Data Processor.
  • With trusted vendors and service providers who need access to such information to carry out work on our behalf. These providers are bound by contractual obligations to keep your personal information confidential and use it only for the purposes for which we disclose it to them.
  • In response to a legal process or a request for information if we believe disclosure is in accordance with applicable law.
  • In connection with a merger, sale of company assets, financing, or acquisition of all or a portion of our business by another company.
  • With your consent or at your direction.

4. Data Retention and Security

  • Retention: We retain your personal data for as long as is necessary to fulfill the purposes for which it was collected and to comply with our legal obligations.
  • Un-activated Migrated Accounts: For accounts created via a Data Migration, if a User does not activate their account within ninety (90) days, we reserve the right to disable or remove the un-activated account placeholder. The personal data remains under the control of the Customer.
  • Security: We implement reasonable and appropriate security measures designed to protect your information from loss, theft, misuse, and unauthorized access.

5. Your Privacy Rights and Choices

  • Access and Update: You can review and update your Account Information at any time by logging into your account settings.
  • Delete Your Information:
    • To request the deletion of your universal SupaClub account, please email us at help@supaclub.app.
    • To delete your data from a specific Customer's Organization, you must contact the administrator of that Organization.
  • Marketing Opt-out: You can opt out of receiving promotional emails from us by following the unsubscribe link in those emails.

6. International Data Transfers

SupaClub is based in the United States. If we transfer personal information across national borders, we will take steps to ensure that such transfers comply with applicable data protection laws, such as through the use of Standard Contractual Clauses. By using the Services, you consent to the processing and transfer of your information in and to the U.S. and other countries.

7. California Privacy Rights (CCPA)

If you are a California resident, you have the following rights:

  • Right to Know: To request what personal information we have collected about you.
  • Right to Delete: To request that we delete your personal information.
  • Right to Correct: To request that we correct inaccurate personal information.
  • Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise these rights for your Account Data, please contact us. To exercise them for Organization Data, you must contact the relevant Customer.

8. Other Important Information

  • Children's Privacy: The Services are not intended for individuals under the age of 13.
  • Links to Other Websites: This Policy does not govern third-party websites.
  • Changes to this Policy: We may change this Privacy Policy from time to time. If we make material changes, we will notify you by revising the "Effective Date" at the top of the policy and, in some cases, we may provide you with additional notice (such as by sending you an email).
  • Contact Us: If you have questions about this Policy, contact us at help@supaclub.app.