Privacy Policy

1. Who and what this policy covers

This is the shared Privacy Policy for Chubby Club’s first-party websites, apps, member experiences, applications and business tools. It describes common practices once and identifies differences where a feature or role matters. Using one Service does not mean every category below is collected about you.

This consolidated draft is pending review. The intended coverage includes the main Chubby Club experience, Reserve, Verify, My Chubby Club, Create, Plus, Refer, Partner, the public directory, Admin and Legal. Main-site, Marketing, Receipt, Survey and CMS source records remain incomplete, so their specific practices are not represented as verified by this document.

“Chubby Club” is the brand used here. Imported notices identify Chubby Club LLC / Chubby Club, LLC, Chubby Group Inc. (My Chubby Club), Chubby Club Group (Admin), and Chubby Club (Create). The responsible legal entities must be confirmed before this draft takes effect. Independent restaurant operators, app stores, social networks, reservation platforms and other third parties have their own privacy practices.

2. Information we collect and where it comes from

• Account and identity information: names, email addresses, phone numbers, member identifiers and authorized identity or membership claims from Chubby Club sign-in. Staff authentication also processes work email and hashed credentials.
• Membership and activity: membership status, points, passes, tastings, visits, receipts and rewards displayed in My Chubby Club; account and linked-platform metadata for Verify; reservation and Priority Waitlist details for Reserve.
• Applications: creator names, contact details, location, social handles, audience-size ranges, niches, formats, portfolio links and collaboration interests; partner contacts, role, business group, venue links, CRM history and onboarding activity.
• Business and agreement records: legal business names, contract contacts, location and point-of-sale details, commercial terms, tax identifiers, agreement status, reports and provider-event records for partner operations.
• Messages: support, privacy and security correspondence and information you choose to submit.
• Technical information: IP address, browser and device signals, request paths, timestamps, security and audit logs, error diagnostics, session records and privacy choices where needed to operate the feature.

Information comes from you, your browser or device, Chubby Club’s identity and platform services, authorized business users, and providers involved in the feature you choose. My Chubby Club does not collect payment-card details. Plus does not offer account sign-in or complete membership purchases; purchases occur at the linked destination under its notices.

3. Location, maps and optional connections

Hosting infrastructure may supply a coarse country, city or region. Partner’s “Near Me” feature uses precise coordinates only after browser permission to center and filter the map in the current browser session; those coordinates are not written to its database. Google Maps may process coordinates and network data when its map is used. The public directory keeps precise coordinates in your browser and does not send them to its analytics systems. My Chubby Club and Create describe coarse region hints, not stored precise location.

Plus displays public venue data obtained from the platform, not the visitor’s personal location. When configured and loaded, its optional Google Maps integration receives technical network/device information and map interactions. App Store, Google Play, Yelp and directions destinations receive information when you follow their links.

My Chubby Club’s social linking is currently unavailable. Its adapters support Reddit, YouTube and Twitch. Before activation, permissions and disclosures must be confirmed. If enabled, linking requires your authorization at the provider, uses a temporary code and token exchange, and sends a verified account identifier and public handle to Chubby Club; the profile does not maintain a separate social-account database.

4. Why we use information

We use the information relevant to a feature to provide accounts and Services; display and verify membership benefits; handle reservations; evaluate applications and collaborations; administer partner agreements and operations; provide support; prevent fraud and unauthorized access; maintain security and accountability; remember privacy choices; respond to rights requests; and comply with law and enforce applicable agreements.

Optional analytics is used only with the required permission. Listing a potential use here does not authorize a new purpose. Material changes in purpose or recipients require updated notices and renewed consent where required.

Admin’s source identifies legitimate interests for authentication, security, audit logging and error monitoring without replay, and consent for optional analytics and session replay where GDPR applies. This is not a claim that the same legal basis applies to every Service or jurisdiction.

5. Analytics, diagnostics and sale or sharing

The imported notices state that personal information is not sold or shared for cross-context behavioral advertising. Partner also states that it does not engage in targeted advertising or profiling that produces legal or similarly significant effects. These statements must be confirmed across the full proposed scope before this draft is approved.

• My Chubby Club: consent-based PostHog performance and viewport measurements use temporary in-memory identifiers. Replay, automatic interaction capture, page-URL capture and automatic exception capture are disabled; analytics identifiers are not persisted in cookies or local storage.
• Public directory: consent-based aggregate events use a keyed pseudonym that rotates daily. Its first-party analytics database does not retain raw IP addresses or clear user-agent strings. Optional Vercel Web Analytics, Speed Insights and Microsoft Clarity provide performance measurements and privacy-masked interaction diagnostics, including recordings. They do not load before analytics consent; advertising storage is denied.
• Admin: optional PostHog events are described as anonymized and without personal identifiers, stored in the EU. Sentry crash reports include stack traces, browser and operating-system details, stored in the US under Standard Contractual Clauses. Replay requires analytics consent. A timestamped consent record is stored for compliance.
• Plus: app-store action placement and destination platform are logged without a member identifier. Sentry technical diagnostics are processed only if configured; membership information is not intentionally sent from the public lander.
• Reserve, Verify, Create, Refer and Partner: their cookie notices describe no optional analytics or marketing cookies. Partner also describes no optional tracking runtime. Legal has no sign-in or optional analytics; hosting logs and configured error reporting still require an approved operational disclosure.

Hosting providers may process network metadata even when optional analytics is disabled. See Cookies for actual storage and controls.

6. How information is disclosed

Information may be provided to processors performing the relevant service under confidentiality and data-protection obligations; professional advisers where necessary; authorities or other parties where required by law or to protect rights, safety and security; and a successor in a business transfer subject to applicable protections.

The Service Providers document identifies the providers named in the sources, their purposes and scope. A vendor’s presence in that list does not mean it receives data from every app. Integrations and independent destinations may also process data under their own policies.

7. Retention

Personal information is retained for the purpose for which it was collected and applicable legal obligations, then deleted or de-identified. Retention differs by record and system; a shorter cookie lifetime is not a promise that all related server records are deleted at the same time.

• Partner account and identity records: the account or relationship duration plus up to 3 years.
• Partner applications and CRM records: 2 years after the decision.
• Partner agreements, tax and business records: 7 years, or longer if law requires.
• Partner device, request and security logs: up to 24 months. Privacy requests and preference records are retained as needed to honor choices and demonstrate compliance.
• Admin: session cookies expire after 24 hours of inactivity; audit and consent records are retained for 7 years; Sentry events for 90 days; PostHog events for 12 months.
• Public directory: analytics events are retained no longer than 24 months before deletion or further aggregation. Correspondence is retained as reasonably needed to respond and maintain business records.
• Plus: hosting/security logs, aggregate app-store events, technical error reports and correspondence are retained as needed for security, operations and legal compliance, then deleted or anonymized; the source does not state fixed periods.

Refer’s retention schedule and processor list are incomplete. Other source notices generally state necessity-based retention without fixed periods. A comprehensive system-by-system schedule remains an approval requirement. Legal holds, disputes, security investigations and statutory duties may require longer retention where permitted.

8. Your privacy rights

Depending on your location and the applicable law, you may request confirmation of processing, access to categories and specific information, correction, deletion, portability, and opt-out of sale, sharing, targeted advertising or specified profiling. You may have the right to limit particular uses of sensitive information, use an authorized agent, appeal a denial and complain to a regulator. Rights are subject to applicable exceptions and verification; we do not discriminate against you for exercising them.

For California residents, these include rights under CCPA/CPRA. Other US state laws provide comparable rights where they apply. Partner’s source states it does not use sensitive information for purposes triggering a right to limit; the public directory states it does not collect sensitive information. Neither statement is extended to unrelated features by this draft.

In Canada, access, correction and withdrawal of consent are available subject to legal and contractual limits under PIPEDA and applicable provincial laws. Withdrawal may affect a feature that needs the information. Quebec rights include contact with the person responsible for personal-information protection and complaint to the Commission d’accès à l’information; Canadian complaints may also be made to the Office of the Privacy Commissioner of Canada. Partner’s notices provide for French-language notices and correspondence. The existing Create and Refer commitments below are also retained for those services; French materials and a responsible privacy officer for the entire shared scope still require confirmation.

Create

Quebec (Law 25). We obtain your consent before activating non-essential cookies, present this notice in French where required, and have designated a person responsible for the protection of personal information, reachable at privacy@chubbyclub.com.

Refer

Quebec (Law 25). If you are in Quebec, we obtain your consent before activating non-essential cookies, present this notice in French where required, and have designated a person responsible for the protection of personal information, reachable at privacy@chubbygroup.com. You may also lodge a complaint with the Commission d’accès à l’information du Québec.

See Data Requests & Deletion for working contacts, verification, timing and appeals. Do not send passwords or highly sensitive documents by ordinary email.

9. Consent and browser choices

You can review optional choices on the Service you use and withdraw permission. Global Privacy Control is honored as an opt-out of sale, sharing and targeted advertising where applicable. My Chubby Club, Create and the public directory also suppress optional analytics in response to GPC; the directory suppresses analytics for Do Not Track as well. We do not ask you to override those signals.

Some controlled first-party subdomains share a signed, identity-free preference; this does not make account sessions shared or guarantee that a choice reaches another domain, device or app. Refer uses a separate domain. Use Your Privacy Choices for the relevant control.

10. Security and international processing

Administrative, technical and organizational safeguards include access controls, secure transmission, monitoring and contractual provider protections appropriate to the system. No system can guarantee absolute security. Breaches are assessed, contained and notified to affected individuals and authorities as applicable law requires.

Providers process data in the United States and other locations identified in Service Providers. The public directory is operated in the United States and its notice describes US processing for international visitors. Admin’s PostHog processing is in the EU and its Sentry disclosure identifies Standard Contractual Clauses. Transfer arrangements for the consolidated scope remain subject to confirmation; this draft does not claim every system uses the same safeguards or region.

11. Children and age restrictions

Public directory

This site is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, please email support@chubbyclub.com and we will delete it.

Other services

Refer is not directed to children under 13 and states it does not knowingly collect their information. If such information is identified, contact the privacy team so it can stop inappropriate processing and follow the applicable deletion or parental-consent procedure. Partner is a business portal, is not directed to anyone under 18 and states that inadvertently collected under-18 information will be deleted promptly. Creator participation and other account services have the eligibility requirements in Terms of Service.

12. Contact and changes

General legal inquiries: legal@chubbyclub.com. Existing privacy contacts are retained in Data Requests & Deletion; forwarding between these mailboxes has not been verified.

Refer’s versioned-preference commitment is retained:

We will post changes and update the effective date. A material purpose or vendor change increments the privacy policy version and requires a new category choice; ordinary copy corrections do not.

Material changes will be described with notice and any required consent. A document revision date is not a new effective date or a change to a saved consent version. This draft remains subject to review before it replaces the existing notices.