Privacy Policy

This policy explains how Customer Club handles personal data for everyone who uses the platform — customers who follow local businesses, and the business owners who run their club through us. It applies under UK GDPR.

Customer Club provides the platform businesses use to message the customers who've chosen to follow them. The business you follow decides what it sends you; we operate the underlying service, storage, and delivery on both sides' behalf.

• Your name, email address, and a securely hashed password (we never store it in plain text)
• Which businesses you follow, when you joined, and if/when you unfollow
• The topics you've chosen to hear about, and your consent choices
• Whether you've opted to also receive messages by email, on top of the web portal
• Messages sent to you and whether you've opened them, so businesses can see engagement

• Your account email and password, business name, address, phone, opening hours, and website
• Any logo or cover image you upload
• Your plan and trial status (we don't take card payments today, so we hold no payment card data)
• If you use AI-assisted message drafting, the profile details you enter (e.g. regular events, standing offers) to help generate suggestions

For customers: to run the subscription you signed up for — joining is on the basis of the consent you give at sign-up, which you can withdraw at any time by unfollowing a business or asking us to delete your account. For businesses: to operate the account and dashboard you registered for.

Businesses you follow see your name and email, and whether you've opened their messages — that's how they know who to message and what's landing. We don't sell or share your data with anyone else for their own marketing purposes.

A small number of service providers process data on our behalf, to run the platform itself:

• Supabase — our database and account/login system
• Resend — sends emails on our behalf (welcome emails, message notifications, password resets)
• Netlify — hosts the website and app
• Anthropic — if a business uses AI-assisted message drafting, the business's own profile details (not customer personal data) are sent to Anthropic's Claude to help generate a draft

We keep your data for as long as your account or subscription is active. Unfollowing a business stops future messages immediately, but we keep a record of past activity (e.g. sent messages and engagement) for the business's own record-keeping, rather than deleting it outright. If you'd like your data deleted entirely, contact us — see below.

You can ask us to access, correct, or delete your personal data at any time, or ask us to export a copy of it. Email support@customerclub.uk and we'll action it. You can also unfollow any business yourself, any time, from My places in your account — no need to email us for that one.

We only use strictly-necessary cookies to keep you signed in — no advertising or tracking cookies, and nothing that needs a cookie banner under UK rules.

Everything is sent over HTTPS. Passwords are hashed, never stored in plain text. Access to data is restricted so that, for example, one business can never see another business's subscribers, and a customer can only ever see their own account.

If this policy changes in a meaningful way, we'll update the date at the top of this page.

Questions about any of this? support@customerclub.uk