Privacy Notice

A Club normally controls the member, parent or guardian, volunteer, team, fixture, attendance, communication, form and club-operation information it enters into ClubOS. Bytecode processes that information for the Club to provide, secure and support the service under the ClubOS Data Processing Agreement.

Questions about a Club's use of member information should normally be directed to that Club. We will assist the Club with relevant requests as required by the Data Processing Agreement.

Bytecode acts as controller for ClubOS account and subscription contacts, billing and agreement records, product-site and walkthrough enquiries, security and access logs, support correspondence, service-operation records and information needed to meet our own legal obligations.

Depending on the context, we rely on performance of a contract, steps requested before a contract, our legitimate interests in operating and securing ClubOS, compliance with legal obligations, or consent where the law specifically requires it.

This may include names, contact details, organisation and role information, authenticated account identifiers, subscription and payment metadata, agreement-acceptance evidence, support messages, device and request information, security events, audit records, uploaded content and operational telemetry.

Payment card details are handled by Stripe or the relevant payment provider and are not stored by ClubOS. Clubs may choose to use features that contain children's, welfare, accessibility or other sensitive information; those records remain subject to the Club's instructions and access controls.

We use information to provide tenant-specific services, authenticate users, administer subscriptions and agreements, deliver transactional communications, provide support, maintain audit trails, monitor reliability, prevent abuse, investigate incidents, improve ClubOS and comply with law.

We do not sell personal information. We do not use Club member records for third-party advertising.

We use providers for hosting, authentication, storage, email, monitoring, payments, support and optional integrations. Principal providers and categories are described in the Data Processing Agreement. Information is shared only where needed for those purposes, a Club-enabled integration, legal compliance or protection of the service.

Where information is transferred outside the United Kingdom, we use an applicable adequacy decision or contractual and organisational safeguards required by UK data-protection law.

When you send an enquiry, Formspree processes the name, email address, club, country, optional phone number and message you provide, along with request information such as your IP address, to filter spam, store the enquiry and deliver it to our team by email. We use these details to respond to your request, not to automatically subscribe you to marketing. You can instead email admin@cluboss.co.uk directly.

The optional ClubOS fit-check keeps incomplete club-level answers in same-tab browser session storage so you can move between its steps. ClubOS does not receive those answers unless you choose Send my summary. Starting again clears the browser copy; a confirmed submission also clears it. The fit-check does not use advertising cookies, create a visitor profile or ask for member records. If you send the summary, Formspree processes the name, email address, club name, country and structured summary you chose to submit under the same enquiry arrangements described above.

If you choose a ClubOS WhatsApp link, your device opens WhatsApp with a ready-written question to our published business number. Nothing is sent until you choose Send. WhatsApp processes your use of its service under its own terms and privacy notice; avoid including passwords, payment details or member records in the conversation.

If you book a ClubOS walkthrough through our embedded Cal.com scheduler, Cal.com, Inc. receives the details you enter to arrange the meeting, normally your name, email address, time zone, selected time, any notes you add, and request information such as your IP address. Cal.com processes this information for Bytecode and may process it in the United States under its contractual transfer safeguards.

Using the scheduler is optional. You may contact admin@cluboss.co.uk directly if you prefer not to submit information through Cal.com.

Typed Club AI assistant conversations use Claude models through Amazon Bedrock (AWS). After the user agrees, ClubOS sends messages, conversation history, any supplied attachments and the relevant club information the user is permitted to access so the assistant can answer or help with authorised tasks. This may include identity, fixtures, events, membership or payment-status information relevant to the request. Permission checks still apply; the provider does not receive direct access to the ClubOS database or payment-card details.

Voice is optional and uses OpenAI. After a separate choice and microphone permission, microphone audio, messages, conversation context and authorised tool results are streamed to OpenAI for replies and requested tasks. ClubOS does not store the audio. Provider security and retention policies still apply; do not assume immediate deletion at the provider when a conversation ends.

How your information is used: AWS states that Bedrock prompts and replies are not used to train its or other providers' base models and are not shared with model providers such as Anthropic. Bedrock security retention depends on the model and service settings. OpenAI's API policy excludes model training by default unless the organisation explicitly opts in. Standard OpenAI abuse-monitoring logs may retain content for up to 30 days, with longer retention where required by law or needed to protect against harm. Not being used for training does not mean that information is never stored. These provider policies are separate from ClubOS service and audit records.

External AI connections through MCP are separate from the in-app assistant. A club administrator must approve the current external-AI notice. Authorised connected clients, such as ChatGPT or Claude, can receive permitted club records, including bounded itemised payments and, where authorised, names and masked email addresses. The connected provider and workspace policies govern that external processing. Existing tool permissions and confirmation requirements continue to apply.

AI is optional. Text and voice choices are separate and remembered for the current notice; public browser choices are remembered on that browser. Declining does not block other ClubOS features. Remove a choice using AI privacy or the native assistant’s About options, and Voice privacy for voice. Withdrawal stops future sharing through that feature; it does not undo completed actions or erase information already processed. Contact support for data-deletion requests. Processing may occur outside the UK under applicable safeguards. Retention and any provider data-use controls depend on the service and the applicable provider terms and Data Processing Agreement.

We retain information only for as long as reasonably needed for the relevant service, contractual, security, accounting, legal or dispute purpose. Club processor data is returned or deleted under the Data Processing Agreement. Agreement evidence and limited security or financial records may be retained separately where needed to establish or defend rights or meet legal duties.

ClubOS uses tenant-aware access controls, role-based permissions, audit logging, encrypted transport, encryption-capable managed storage, monitoring, backups and restricted operational access. No online service can promise absolute security.

Depending on the circumstances, individuals may have rights to access, correct, erase or restrict information, object to processing, receive portable information, withdraw consent and complain to the Information Commissioner's Office. A right may be limited where an exemption or another lawful reason applies.

If the request concerns information controlled by a Club, contact that Club first. Requests concerning Bytecode's own processing can be sent to the address below.

ClubOS uses essential cookies for sign-in, session security, request protection and onboarding controls. We do not use advertising cookies in the platform app. The Cookie Policy explains the current cookie categories.

Privacy questions or requests may be sent to admin@cluboss.co.uk or BYTECODE CONSULTING LTD at its registered office. You may also complain to the UK Information Commissioner's Office at ico.org.uk.