ClubKit Privacy Policy

Uplink Sites ("we", "us", "our") operates ClubKit, a managed website platform for community sports clubs. This Privacy Policy explains how we collect, use, and protect personal information in connection with ClubKit.

We are bound by the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where we process personal data of individuals in the European Economic Area or the United Kingdom, the GDPR and UK GDPR also apply.

Contact: privacy@uplinksites.net

When you sign up for ClubKit we collect:

• Contact details: club name, your name, email address, phone number.
• Payment information: processed by Stripe. We do not store card numbers.
• Onboarding information: club logo, colours, sport type, initial content you provide.
• Support communications: messages you send us.

We use this information to provision and operate your ClubKit site, send you transactional emails (receipts, renewal reminders, support replies), and improve the Service.

Your ClubKit site may collect personal information from your club's members — for example, registration form submissions, member records, newsletter subscriptions, and event sign-ups. This may include names, email addresses, phone numbers, and IP addresses logged on form submission.

For that data, your club is the data controller and Uplink Sites is your data processor. We process your members' data only on your instructions, for the purpose of operating the ClubKit platform on your behalf. We do not sell, share, or otherwise use your members' personal data for our own purposes.

You are responsible for ensuring your club has a lawful basis to collect member data and for providing members with an appropriate privacy notice.

Club administrators can optionally connect a Business Instagram account to display their club's Instagram feed on the public website.

When connected, ClubKit requests the instagram_business_basic permission via the Meta API, which allows us to read the club's Business Instagram profile username and media feed (post images, captions, and permalinks). We do not access private messages, follower lists, or any data belonging to the club's Instagram followers.

Feed data is cached server-side for up to 30 minutes and displayed publicly in the club's Gallery section. It is not analysed, sold, or shared with any third party or other club. The access token is stored securely on our server and never exposed to end-users.

A club admin can disconnect Instagram at any time via Admin → Connections → Disconnect. The stored access token is immediately and permanently deleted and the feed is removed from the public site. No Instagram data is retained after disconnection.

All ClubKit sites include an analytics tracking script powered by Uplink Analytics, our own cookieless analytics platform. This script collects:

• Page URLs visited and referrer (the site that sent the visitor).
• Country (derived from IP address — the IP address itself is never stored).
• Browser type, operating system, and screen size (from the User-Agent header — the UA string is never stored).
• Whether the visit was a "bounce" (single-page visit) and approximate session duration.

No cookies are set. No personal identifiers (IP addresses, fingerprints, persistent device IDs) are stored. All data is aggregate and anonymous by design.

Because no personal data is collected and no cookies are used, this tracking does not require a cookie consent banner under the Australian Privacy Act 1988, the EU GDPR, or the ePrivacy Directive. Your club site visitors are not tracked across other websites.

Analytics data is accessible to your club's admin users (on Elite plan) and to Uplink Sites operators for support and platform monitoring purposes.

ClubKit uses localStorage (not cookies) to store admin session tokens when you are logged into your club's admin panel. These tokens are used only to keep you authenticated and are cleared on logout.

We do not use tracking cookies, advertising cookies, or persistent device identifiers on any ClubKit page.

We use the following sub-processors to operate the Service:

• OVHcloud (Singapore) — hosting infrastructure for ClubKit sites and Uplink Analytics.
• Google (Google Drive) — storage for nightly server backups, which include each club's database.
• Stripe — payment processing. Subject to Stripe's own privacy policy.
• Cloudflare — DNS only. Website traffic does not pass through Cloudflare.
• Brevo (formerly Sendinblue) — transactional email delivery (receipts, notifications).
• Twilio — SMS notifications on clubs that have SMS features enabled.
• Meta / Instagram — when a club admin connects their Instagram account (see Section 4).

• Account data — retained for the duration of your subscription plus five years after cancellation for tax and legal record-keeping, then deleted.
• Member data on your site — retained in your ClubKit database for as long as you keep your subscription active. You can delete records at any time from your admin panel. After cancellation we retain data for 30 days to allow export, then permanently delete it.
• Instagram access tokens — deleted immediately on disconnection. Not retained beyond active use.
• Analytics data — aggregate and anonymous; retained indefinitely as it contains no personal data.

You can request deletion of your personal data or your club's data at any time by contacting us at privacy@uplinksites.net. We will action deletion requests within 30 days, subject to any legal retention obligations.

Instagram access tokens are deleted immediately upon disconnection — no deletion request is required for that data.

Under the Australian Privacy Act 1988 and, where applicable, the GDPR, you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Request deletion of your account data (subject to legal retention obligations).
• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

To exercise any of these rights, contact us at privacy@uplinksites.net. We will respond within 30 days.

We use industry-standard measures to protect data: encrypted connections (TLS), isolated per-club databases, restricted access controls, and regular security reviews. No method of transmission over the internet is 100% secure; we encourage you to use strong passwords and keep your admin credentials confidential.

We may update this Privacy Policy from time to time. We will notify you of material changes by email and by updating the "Last updated" date above. Continued use of the Service after the effective date constitutes acceptance of the revised policy.

Privacy questions, complaints, or data deletion requests: privacy@uplinksites.net
Uplink Sites · New South Wales, Australia