Clubfold · Service information
Privacy notice
What we store, why we use it, who can see it and how you stay in control.
Last updated 26 September 2026 · English
Who is responsible
The X70 operator identified in the imprint is responsible for personal data processed to operate Clubfold. Contact contact@x70.one for privacy requests. Our postal address is in the imprint.
Club operators use the membership and attendance information available to their authorized staff for their own club operations. Contact the relevant club about its admission decisions, benefits and any separate data practices. A club receives access only to its own members and conversations.
Account and membership data
We process your name, email address, password hash and sign-in/session information; encrypted authenticator secrets and recovery codes if you enable two-factor authentication; optional phone number and language preference; membership plan, subscribed benefits, dates, status, entry QR and club relationships; reservations, guest counts, attendance and messages. We use these records to provide and administer the account and features you request (Article 6(1)(b) GDPR).
Passwords are not stored as readable text. Payment-card details are entered with the payment provider. Clubfold stores payment and subscription identifiers, amounts and membership status when that integration is used, rather than full card numbers.
If you add a passkey, we store its public key, credential identifier, label, creation date and technical authenticator information to verify sign-ins. Your private key stays with your device or chosen passkey provider. Clubfold does not receive your fingerprint, face scan or device PIN. You can rename or remove passkeys in Profile.
Security and technical information
Our hosting and authentication services process technical request information such as IP address, browser information and session timestamps to operate and protect the service. Authentication rate-limit keys are hashed before storage. Those counters expire after their configured window and are removed by a scheduled cleanup.
We use proportionate security and abuse-prevention measures in our legitimate interest in protecting accounts and service availability (Article 6(1)(f) GDPR). We may retain records required to meet legal obligations (Article 6(1)(c)). We do not use the app for automated decisions with legal or similarly significant effects.
Clubs, communications and device permissions
The relevant club's owner and managers can see membership information, bookings, attendance and conversations needed to operate the club. Door staff have restricted attendance access. Other members cannot read your private club conversations.
Club announcement emails are optional and off by default. After verifying your email address, you may opt in separately for each club in Profile. We record your choice and update time, and recheck it before sending. Each announcement includes an unsubscribe link that works without signing in. Withdrawing this consent does not stop necessary account or payment messages (optional announcements: Article 6(1)(a) GDPR).
In-app updates are associated with your account. Optional device notifications require browser permission and store a push endpoint and encryption keys. A browser push service receives the notification payload when that channel is used. You can withdraw device permission or disable subscriptions in your profile.
Camera access is requested only when staff choose QR scanning. The scanner processes camera frames in the browser; the app does not upload or store those frames. The scanned membership identifier is sent to validate entry.
Requests and support
When you request a club or contact support, we use the details you submit to respond and handle your request. The club-request form collects club name, your name, email and optional city. Do not include sensitive personal information or complete payment-card details in free-text messages.
Service providers and international processing
Vercel hosts the web app; Convex provides the database, authentication component and backend functions; Resend sends configured transactional email. The Clubfold production database is deployed in the EU West region. A regional database location does not mean every provider's support, logs or subprocessors remain exclusively in the EU.
Stripe is the implemented payment provider; live paid checkout is currently unavailable. Wallet export and optional social sign-in are unavailable unless their issuer/provider credentials are configured. When those features become available, the provider receives the information needed for the feature you choose.
Providers may process data outside the EEA. Their data-processing agreements describe applicable transfer safeguards, including standard contractual clauses or applicable adequacy frameworks. Contact us for information relevant to your request.
Storage, retention and deletion
Account, membership, booking and conversation records remain while they are needed for your account and club relationships. You may request deletion from your profile or contact us. This removes your profile, memberships, bookings, attendance, conversations, push subscriptions, club-email preferences and personal notification records; authored staff messages and payment-order records are anonymized by the account-deletion process.
Some records may need to be retained to meet legal obligations or resolve claims, and providers may retain limited records under their own retention policies. Deletion from the active app is distinct from expiry of provider backups. We can explain the applicable retention circumstances when handling a request.
Your rights
Subject to the applicable conditions, you may request access, correction, erasure, restriction, portability or object to processing based on legitimate interests. You can withdraw consent for optional features without affecting the lawfulness of earlier processing. We may need to verify that a request comes from the account holder.
Email contact@x70.one to exercise your rights. You can also complain to a competent data-protection authority, including the Bavarian State Office for Data Protection Supervision (BayLDA).