Privacy Policy

Uplink Sites ("we", "us", "our") is a software operator based in New South Wales, Australia. We build and operate ClubKit — a managed website platform for community sports clubs — as well as Uplink Analytics, a cookieless web analytics service.

We are bound by the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where we process personal data of individuals in the European Economic Area or the United Kingdom, the GDPR and UK GDPR also apply.

Contact: privacy@uplinksites.net

ClubKit club administrators can optionally connect a Business Instagram account to display their club's Instagram feed on their public website. This section explains how that integration works and what data is involved.

What we access

When a club admin connects their Instagram account, ClubKit requests access to the instagram_business_basic permission scope via the Meta (Facebook) API. This allows us to read:

• The connected Business Instagram profile username.
• The club's media feed — post images, captions, and permalinks.

We do not access private messages, follower lists, account credentials, or any personal data belonging to the club's Instagram followers.

How we use it

Instagram feed data is cached server-side for up to 30 minutes and then displayed publicly in the Gallery section of the club's website. It is used solely to power that display — it is not analysed, sold, or shared with third parties or with any other ClubKit club.

Access tokens

The Instagram access token is stored securely on our server and is used only to fetch feed data on behalf of the club. Tokens are never exposed to end-users or third parties.

Disconnecting

A club admin can disconnect their Instagram account at any time via Admin → Connections → Disconnect. When disconnected, the stored access token is immediately and permanently deleted from our servers and the Instagram feed is removed from the public site. No Instagram data is retained after disconnection.

Club operators (you, if you signed up for ClubKit)

• Contact details: club name, your name, email address, phone number.
• Payment information: processed by Stripe. We do not store card numbers.
• Onboarding information: club logo, colours, sport type, initial content you provide.
• Support communications: messages you send us.

Club members (people who use your club's website)

• Name, email address, and phone number submitted via registration or contact forms.
• Member records entered by the club secretary.
• Email addresses from newsletter signups.
• IP addresses logged at the time of form submission (for spam prevention).

Website visitors

Cookieless, anonymous analytics may be collected on club sites (see Section 5). No personally identifying information is collected from visitors who do not submit a form.

Each club's data is owned and controlled by that club. Your club is the data controller for all information collected through your ClubKit website. Uplink Sites acts as your data processor — we handle member data only on your instructions and for the purpose of operating the platform on your behalf.

We do not use club member data for our own purposes, share it between clubs, or sell it to third parties. The operator (Uplink Sites) may access a club's data solely for maintenance and support.

You are responsible for ensuring your club has a lawful basis to collect member data and for providing members with an appropriate privacy notice.

ClubKit sites may include Uplink Analytics, our own cookieless analytics tool. It collects:

• Page URLs visited and referrer.
• Country (derived from IP address — the IP address itself is never stored).
• Browser type, operating system, and screen size (from the User-Agent header — the UA string is never stored).
• Approximate session duration and bounce status.

No cookies are set. No personal identifiers are stored. All data is aggregate and anonymous. No cookie consent banner is required under the Australian Privacy Act 1988, the EU GDPR, or the ePrivacy Directive.

All data is stored on our application server (Debian Linux, hosted with OVHcloud in Singapore). Each club's data is kept in an isolated per-club database — no data is shared between clubs at the database level. A nightly backup of the server, including these databases, is kept in Google Drive.

Because our server is located in Singapore, storing your data with us involves disclosing it outside Australia. We take reasonable steps, consistent with Australian Privacy Principle 8, to ensure it is handled in line with the Australian Privacy Principles.

Data is also shared with the following third-party integrations when required:

• Stripe — payment processing (subject to Stripe's own privacy policy).
• Brevo — transactional email delivery (receipts, notifications).
• Meta / Instagram — when a club admin connects their Instagram account (see Section 2).
• Twilio — SMS notifications on clubs that have SMS features enabled.

We use localStorage (not cookies) to store admin session tokens when you are logged into your club's admin panel. These tokens are used only to keep you authenticated and are cleared on logout.

We do not use tracking cookies, advertising cookies, or persistent device identifiers on any Uplink Sites or ClubKit page.

• Account data — retained for the duration of your subscription plus five years after cancellation for legal and tax record-keeping, then deleted.
• Club member and submission data — retained for as long as your subscription is active. You can delete records at any time from your admin panel. After cancellation, data is retained for 30 days to allow export, then permanently deleted.
• Instagram access tokens — deleted immediately on disconnection (see Section 2). Not retained beyond active use.
• Analytics data — aggregate and anonymous; retained indefinitely as it contains no personal data.

You can request deletion of your personal data or your club's data at any time by contacting us at privacy@uplinksites.net. We will action deletion requests within 30 days, subject to any legal retention obligations.

Instagram access tokens are deleted immediately upon disconnection — no deletion request is required for that data.

Under the Australian Privacy Act 1988 and, where applicable, the GDPR, you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Request deletion of your personal data (subject to legal retention obligations).
• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

To exercise any of these rights, contact us at privacy@uplinksites.net. We will respond within 30 days.

We use industry-standard measures to protect data: encrypted connections (TLS), isolated per-club databases, restricted server access controls, and regular security reviews. No method of transmission over the internet is 100% secure; we encourage club admins to use strong, unique passwords and keep admin credentials confidential.

We may update this Privacy Policy from time to time. We will notify you of material changes by email and by updating the "Last updated" date above. Continued use of any Uplink Sites service after the effective date constitutes acceptance of the revised policy.

Privacy questions, complaints, or data deletion requests:

privacy@uplinksites.net
Uplink Sites · New South Wales, Australia