Privacy Notice

• Account data (name, email, login credentials, authentication provider) — to create and secure your account. Legal basis: performance of our contract with you.
• Business profile data (business name, logo, card designs, rewards) — to run your loyalty program. Legal basis: contract.
• Loyalty activity (which cards you hold, stamp counts, timestamps, redemptions) — to show progress to customers and analytics to the issuing business. Legal basis: contract.
• Support messages you send us — to answer you. Legal basis: legitimate interest in supporting our users.
• Technical data (IP address, device and browser information, error logs, basic usage telemetry) — for security, fraud prevention, and improving the product. Legal basis: legitimate interests.

Payment card details are never collected or stored by us; they are handled by Paddle. When a business issues a card, that business can see the cardholder's stamp activity and progress for its own cards.

• Service providers / subprocessors — hosting, database and authentication infrastructure, email delivery, and error monitoring, acting on our instructions.
• Paddle, our Merchant of Record, for the sale of subscriptions, subscription management, payments, tax compliance, and invoicing.
• Businesses you interact with — a business sees the loyalty activity on the cards it issued to you.
• Professional advisers (legal, accounting) and authorities, where required by law.

We do not sell personal data.

Some of our providers process data outside the EEA/UK. Where that happens, transfers are protected by an adequacy decision or by Standard Contractual Clauses with appropriate additional safeguards.

We keep account and loyalty data for as long as your account is active. If you delete your account or a card, the associated data is deleted or anonymised, normally within 30 days, except where we must keep records longer for legal, tax, or fraud-prevention reasons. Billing records held by Paddle follow their own retention rules.

Subject to applicable law, you have the right to access, rectify, erase, restrict, or port your data, to object to processing based on legitimate interests, and to withdraw consent where processing is based on it. You can also complain to your local data protection supervisory authority (in Norway, Datatilsynet). Email support@clubcarder.com and we will respond within one month.

We use appropriate technical and organisational measures, including encryption in transit, row-level access controls in our database, and restricted administrative access. No online service can be completely secure, so please use a strong, unique password.

We use strictly necessary cookies and browser local storage to keep you signed in and to remember your session. We do not use advertising cookies. You can clear or block storage in your browser settings, but the service will not work while signed out.

Muzaev AS — support@clubcarder.com