MyClubBook is a web application that helps gyms and sports clubs keep track of their members, fees and schedule. This policy explains what personal data MyClubBook handles, why, and what rights you have. It is written in plain language; if anything is unclear, write to info@myclubbook.com.
Who is responsible
MyClubBook is operated by SC Aquila, Sofia, Bulgaria ("we"). You can reach us about privacy matters at info@myclubbook.com.
Two kinds of people use MyClubBook and the responsibility differs. For the staff accounts of club owners, managers and coaches, we are the data controller. For the records a club keeps about its own members (names, contact details, payments and so on), the club is the data controller and we act as its data processor: we store and display that data on the club's instructions and never use it for our own purposes.
What we store about staff accounts
When you create an account we store your first and last name, email address, a hashed version of your password (we cannot read it), your language preference and the date you accepted the terms. If you sign in with Google, we receive your name, email address and profile picture from Google; we do not receive your Google password.
To keep you signed in we store session records that include the IP address and browser type used at sign-in. Invitations to join a club store the invited email address and the role offered.
Every change to club data is written to an activity log that records which account made the change and when. Club owners can see this log for their club.
What clubs store about their members
A club may record about each member: first and last name, date of birth, gender, phone number, email address, rank or grade, training group, the name and phone number of an emergency contact, a photo, free-text notes, membership status and the dates the person joined and left.
The club also records payments (amount, date, method, the months a fee covers, a reason for other payments and an optional note), its own income and expenses, its training schedule and events, and short notes shared between its staff.
Members do not have accounts and do not sign in. The club that entered this data is responsible for having a lawful basis for it and for informing its members, including the parents or guardians of members under 18.
Why we process data and on what basis
We process staff account data to provide the service you signed up for (performance of a contract), to keep the service secure, for example by limiting sign-in attempts and keeping the activity log (our legitimate interest), and to meet legal obligations.
We process club member data only as the club's processor, on the club's instructions and under the agreement the club accepted when creating it.
We do not sell personal data, show advertising, build profiles or use the data for any purpose other than running MyClubBook.
Where data is stored and who helps us
MyClubBook runs on Cloudflare's platform. The database and uploaded photos and logos are stored in Cloudflare's Western Europe region. Cloudflare Inc. processes data on our behalf under its data processing terms, which include the EU standard contractual clauses for any access from outside the European Economic Area.
Emails such as verification links, password resets and invitations are sent through Resend, Inc. (USA), which receives the recipient's email address and the content of the email.
If you choose to sign in with Google, Google LLC processes your sign-in under its own privacy policy.
We do not share personal data with anyone else, unless required by law.
Cookies and local storage
MyClubBook uses one cookie, which keeps you signed in for up to 30 days. It is strictly necessary for the service and is not used for tracking. Your language choice is kept in your browser's local storage.
We do not use analytics or advertising cookies and we do not embed third-party trackers.
How long we keep data
Staff account data is kept for as long as the account exists. You can delete your account at any time from the Profile page; deletion is confirmed by email. Clubs where you are the only staff member are deleted together with your account.
Club data is kept for as long as the club exists in MyClubBook. A club owner can delete the club, which removes all its data.
When a club removes a member, that person's details and photo are deleted. Any payments already recorded are kept for the club's books but are moved to an anonymous "Unknown member" entry that holds no personal details.
Backups of the database are kept for up to 30 days and then overwritten.
Your rights
Under the General Data Protection Regulation you have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format. Staff can edit their own details on the Profile page; clubs can export their members and finances as spreadsheets from Settings.
If you are a club member and want to exercise these rights, please contact your club first, as it controls your record. We will assist the club with any such request.
To exercise your rights towards us, write to info@myclubbook.com. You also have the right to complain to a data protection supervisory authority, for example the authority in Bulgaria or the one where you live.
Security
All traffic to MyClubBook is encrypted (HTTPS). Passwords are stored only as salted hashes. Access to club data is limited by role: coaches can read member data and record payments, managers and owners can change it. Sign-in attempts are rate-limited and every change to club data is logged.
Changes to this policy
If we change this policy in a material way, we will show a notice in the application or send an email to account holders before the change takes effect. The date at the top shows the latest version.