Privacy Policy

1. Who we are and what this policy covers

ClubCircl is operated by Thompson Software Solutions, based in North Carolina, United States. This policy explains how we handle information when you visit our website, request information or a pilot discussion, create an account, use a club workspace, communicate with other members, or ask us for support. Contact help@clubcircl.com with privacy questions, requests, or complaints. Identify ClubCircl and the email address you used for your account or inquiry so we can route your request; you do not need an account to make a privacy request. Do not send passwords, payment card numbers, or identification documents unless we have explained a secure, necessary verification process.

ClubCircl provides software for clubs and organizations. Clubs decide whom to invite, what activities to organize, what content to publish, and which permitted records to share with an overseeing organization. Thompson Software Solutions controls account administration, service security, billing administration, and support. A club or organization may separately determine purposes for its membership, event, and financial records. This policy describes our service; a club may also have its own notice and responsibilities. Ask the club about information it keeps outside ClubCircl.

2. Information you provide

Account information includes your email address, authentication identifiers, email-verification state, your full name supplied at signup, and the name you provide within each club. Our authentication provider handles password verification; passwords are not available in the ClubCircl support dashboard. Club records can include a club name, optional logo, time zone, visual preferences, membership status, officer role and position, invitation information, event details, RSVPs, attendance, dues records, and membership history. We do not request a student ID at account creation. When joining a specific club, you provide the student ID issued by that club’s university for attendance purposes. IDs are stored with the specific club membership and are not automatically reused for another club or university. Check-in uses your authenticated account and membership; it does not ask for a student ID again. This identifier is stored separately from the public-facing directory and is available only to you and your club’s authorized officers; it is not included in organization reports or activity emails. You can update it in that club’s Membership page. Club owners may include it in authorized club exports; they must protect downloaded copies. It is removed with the associated membership or account, subject to the backup retention described below. Semester dates and finalized Meeting attendance determine whether a student member has met the two-meeting active-standing threshold. Alumni standing and club-access permissions are separate from that threshold. A club owner can override semester standing with a recorded reason; this does not add meeting attendances. Meeting check-ins record the event, your membership and the check-in time after you enter a valid meeting code or scan its QR code during the meeting. We store per-member read markers for Communication, Media and News to display unread indicators. When an owner or president kicks, bans or unbans a member, we record the action, reason, responsible account and date. These records cannot be edited through the club interface and are included in monthly summaries available to authorized club officers and overseeing organization roles with report and membership access. Bans prevent the associated membership or account from rejoining that club. Member-linked records are removed with the membership or account under the deletion process described below.

When you use community features, we process the messages, news articles, media files, captions, and other material you submit, along with submission dates and approval status. Members’ news and media submissions remain visible to the submitting member and authorized officers while awaiting review. Published content is available to its selected audience: club members, officers, or authorized leadership. The owner controls leadership access for officer positions. Ordinary member chat messages become visible to club members without officer approval. Private updates and their email notifications are restricted to eligible recipients; role changes are checked by the server and refreshed in open tabs. A previously downloaded copy or an already issued short-lived file link cannot be recalled from a recipient’s device. Avoid including sensitive personal information about yourself or other people in club posts or general support requests.

If your club uses financial records, information can include descriptions, categories, dates, and amounts of income and expenses, and manually recorded dues obligations and payments. These records are bookkeeping entries; ClubCircl does not receive card numbers or bank login details. Organizations can receive reports prepared by their affiliated clubs. Support requests include the subject, description, account identity, status, and relevant support actions.

3. University clubs and education records

A student ID identifies a student within the issuing university; it is not a password or proof of identity. ClubCircl uses verified account sessions to associate attendance with the correct membership. Do not submit passwords, Social Security numbers, or government identification numbers in the student ID field. Ordinary members cannot browse other members’ student IDs. Authorized officers may use club IDs only for legitimate club administration and attendance, and owners must safeguard exports and avoid unauthorized redistribution.

Participation in a club does not itself mean a university has approved ClubCircl as an institutional service. Before an institution supplies education records or relies on ClubCircl under FERPA’s school-official exception, it must approve the service and establish the appropriate authority, permitted purposes, direct control, access restrictions, retention/deletion requirements, incident contacts and contractual arrangements. A club signup or acceptance of this policy alone is not a substitute for those arrangements. Institutional education records must not be repurposed for advertising, lead generation or training AI models. Contact help@clubcircl.com before an institutional pilot or regulated-data deployment.

4. Requests for information and pilot inquiries

You can request information without creating an account or buying a plan. The inquiry form collects your name, email address, the kind of information you are interested in, and an optional club or organization name. We record the submission date, your affirmative permission to contact you about that inquiry, the version of that permission notice, and an internal follow-up status. Do not include student IDs, rosters, payment details, or other sensitive records in this form.

We use these details to review your inquiry and respond about ClubCircl, a club workspace, or an organization pilot, according to your request. The consent box is not preselected. Submitting this form does not create an account, start a subscription, authorize a payment, or enroll you in a general marketing mailing list. A ClubCircl administrator reviews requests for manual follow-up; the form does not automatically send emails. An inquiry email address is supplied by the visitor and is not treated as a verified account identity.

Inquiry records are stored privately with our service providers and are available in ClubCircl only to authorized platform administrators. Club members, club officers, organization leaders, and the public cannot browse these records. We do not publish or sell this contact list. Necessary abuse controls also use limited request information to restrict automated or excessive submissions.

You can withdraw permission for further inquiry follow-up, request a correction, or ask us to delete your inquiry by contacting help@clubcircl.com from the address you supplied. Administrators can delete an inquiry from active records. Inquiry records are automatically removed from active storage 180 days after their creation or the last administrator status update, unless deleted earlier. Deleting a verified ClubCircl account also removes inquiry records matching that account’s email address; contact us separately about an inquiry submitted using another address. Restricted database backups follow the retention and recovery limits described below. Any separate correspondence is handled under the applicable support, operational, and legal retention needs.

5. Information collected when the service runs

Our hosting, security, authentication, and email providers process technical information needed to operate the service, such as request times, network information, device and browser characteristics, authentication events, errors, and delivery status. ClubCircl uses abuse counters and request limits to protect accounts. Club activity records can record who performed a change, what type of change occurred, and when it occurred. Support access and password-reset requests are also recorded.

The current service does not use advertising cookies, third-party behavioral advertising, or optional analytics trackers. Necessary browser storage maintains your sign-in session and remembers your cookie choice. A synthetic sample workspace can store sample data on your device; it is separate from live club records. Our Cookie Policy describes these technologies and the choices available. We do not obtain access to your Gmail mailbox merely because you register with a Gmail address. Current email/password registration does not request access to Google contacts, calendars, Drive files, or messages.

6. Why we use information

We use account and club information to create and maintain accounts, verify email addresses, establish membership, display appropriate club records, enforce member limits and roles, deliver invitations and password-reset messages, manage events, and provide the community and reporting features you choose to use. We process submitted files to store them privately, apply access controls, and make approved material available to the appropriate audience.

We use technical and activity information to prevent unauthorized access, limit spam and abuse, investigate reported problems, maintain reliable operation, and recover from failures. Authorized support personnel may search account names and email addresses, inspect memberships and roles, and initiate a password-reset email when providing support. Support personnel cannot view an existing password or set a password on your behalf through the dashboard.

Where applicable law requires a legal basis, we rely on performing our agreement with you for core service functions; legitimate interests in service security, reliability, and support where those interests are not overridden by your rights; compliance with applicable legal obligations; and consent where it is required, including before introducing nonessential tracking. Where a club controls its own purposes, that club is responsible for establishing a suitable legal basis. We do not sell personal information or share it for cross-context behavioral advertising.

7. Who can see club information

Other active club members can see the club directory, including names, membership roles, and officer position titles. The ordinary member directory does not display other members’ email addresses. Officers and owners may access email addresses and other records needed to administer their club. News and media awaiting review are available to their authors and authorized officers. Messages in the club conversation are visible to club members. Invitations are addressed to a specific email address; a join code allows a verified account to request member access within the club’s plan limit.

The owner controls ownership transfers, officer positions, financial-access permissions, and club data downloads. Financial records are limited to the owner and authorized officer positions, such as a treasurer or president. An overseeing organization receives relevant rosters, officer titles, attendance information, spending records, and submitted reports only after the club owner requests the relationship and the organization accepts it. Each club should explain that relationship to its members. Downloaded reports can be retained by the club outside this service, and ClubCircl cannot remotely erase copies a recipient has already downloaded.

8. Service providers and other disclosures

We use Supabase for authentication, database services, and private file storage; Cloudflare for website delivery, security, and supporting infrastructure; and Resend to send transactional emails. These providers process information to deliver their services under their respective agreements. An external payment provider such as Stripe, PayPal, or Square handles transactions you initiate on its website. The provider’s own privacy notice applies to the payment information you enter there. ClubCircl does not transmit member card or banking credentials to these providers because it does not collect them.

We may disclose information where reasonably necessary to comply with a valid legal process, protect rights and safety, investigate abuse, or enforce our terms. We assess requests and limit disclosures to what is appropriate. If the service undergoes a merger, acquisition, reorganization, or asset transfer, relevant information may transfer subject to appropriate confidentiality and continuity protections, and we will provide notice where required. We do not make club rosters public for advertising or allow unrelated clubs to browse them.

9. Retention, deletion, and backup copies

We retain active account and club records while needed to provide the requested service, subject to deletion actions and applicable obligations. You can delete your account through Account, select Delete account, acknowledge the permanent-deletion warning, and confirm. You must first transfer or delete clubs or organizations you own so other people’s shared workspace is not abandoned. Account deletion removes your authentication account, memberships, associated RSVPs and dues, submitted messages, news, media, invitations addressed to your account, and support requests from the active service. Uploaded content associated with your account is removed from primary private file storage and its backup mirror as part of the deletion process. Once deletion begins, new account activity is blocked while failed steps can be retried. To catch an upload that finishes late, we retain restricted cleanup records containing opaque file paths and account identifiers and repeat deletion checks for seven days. These records do not contain the uploaded file content. A cleanup record remains longer if a storage provider is unavailable, until a successful removal can be confirmed. If an immediate deletion step fails, the service reports the failure so you can retry.

Shared club information that is not your personal content, such as an event created for the club, may remain for the club’s continuing operation. Personal attribution is removed where appropriate. Financial or legal records may need to be retained when a law requires it; a club or payment provider may have independent retention obligations. Contact help@clubcircl.com if a remaining shared record contains personal information about you that should be corrected or erased.

Our database provider maintains restricted backups for disaster recovery. Under the current Pro hosting configuration, scheduled database backups are retained for up to seven days. A deletion from the live system does not immediately rewrite an existing restricted backup. Backup copies are not used for ordinary service access, and expire according to the provider’s retention cycle. Restoration procedures must reapply completed deletion requests before restored personal information is returned to normal use. Private uploaded files are also mirrored to restricted Cloudflare R2 storage. Account deletion removes associated files from both live storage and this mirror. We retain a hashed account-ID deletion marker for up to eight days solely to prevent erased accounts from being restored from older backups. Email delivery and payment providers may retain their own operational or legal records under their policies. We do not promise that deleting your account can erase independent copies already lawfully held by a club, another member, or an external provider.

10. Security and international processing

We use encrypted transport, private storage, authenticated server requests, club-role checks, limited support access, and controls intended to reduce abuse. Privileged account administration is granted to specifically authorized accounts; entering an email address alone does not grant administrative authority. Downloadable media uses short-lived access links. Officers may add social profile links. When you choose to share approved media, the selected social app receives the file and caption and its own privacy terms apply. ClubCircl does not automatically publish through profile links. Review the destination account and audience before publishing. You should protect your device and email account, use a unique password, sign out of shared devices, and notify us promptly if you suspect unauthorized access. No online service can guarantee that every security incident will be prevented.

The current database region is in the United States. Our service providers may process technical or support information in other locations. If your jurisdiction restricts international transfers, applicable safeguards and contractual terms must be considered for your deployment. An organization with specific data-residency, student-record, or regulated-data requirements should contact us before onboarding to agree on appropriate arrangements.

11. Your privacy choices and rights

Depending on your location and applicable law, you may have rights to access, correct, receive a portable copy of, delete, restrict, or object to certain processing of your information, and to withdraw consent where processing depends on consent. Owners can download readable club records subject to their plan and authority. Individual privacy requests can be sent to help@clubcircl.com even if you are not a club owner. We will verify requests proportionately and respond within applicable legal deadlines. We may ask you to authenticate or confirm control of your registered email address. We do not charge for ordinary requests unless permitted by law in exceptional circumstances.

An authorized agent may contact us where applicable law allows, with suitable evidence of authority. If we cannot fulfill a request, we will explain the relevant reason and available review or appeal steps. You may also complain to an applicable privacy regulator. We will not unlawfully discriminate against you for exercising privacy rights. Club membership and access to shared records may necessarily end when account information required for the service is deleted.

Transactional emails concerning account security, verification, invitations you receive, and service operation are distinct from optional marketing. This release does not provide automated marketing subscriptions. You can decline an invitation by not accepting it and contact the inviting club if it continues sending unwanted invitations. Necessary security messages may still be sent while an account exists. Optional club activity emails cover published messages, news, and media. Each member can turn these emails off by category in the club’s Membership page. Pending submissions do not generate activity emails. Private delivery records, including the recipient address needed to retry delivery, are retained for up to 30 days and removed when the associated membership is deleted.

12. Children, changes, and contact

ClubCircl is intended for people aged 18 or older and is not designed for children under 13. Do not create an account if you are under 18. We do not knowingly solicit personal information from children under 13. If you believe a child has provided information, contact help@clubcircl.com so we can investigate and address it. School or youth organizations must discuss an appropriate separate arrangement before submitting children’s information.

We may update this policy as the service or legal requirements change. The effective date identifies the current version. Material changes will be communicated through appropriate service notices or other legally required means. We will obtain fresh consent when required for a new use. Questions about this policy or the handling of your information should be sent to Thompson Software Solutions at help@clubcircl.com, identifying ClubCircl.