Privacy Policy

1. Introduction

Clubly ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our educational platform designed for student club officers and the members of their clubs.

2. Information We Collect

2.1 Account Information

• Personal Details: Name, email address, and profile information provided during registration
• Authentication Data: Managed securely through Clerk (SOC 2 Type II compliant)
• Educational Information: School affiliation and club roles
• Contact Information: Email addresses for communication and notifications

2.2 Club and Activity Data

• Club Information: Names, descriptions, mission statements, and organizational details
• Membership Data: Member lists, roles, and participation records
• Meeting Records: Schedules, attendance check-ins, audio recordings, transcripts, and summaries. See 2.3 for how recordings are handled.
• Club Communication: Club chat messages and poll votes. Other members see poll totals, not who voted for what.
• Content Creation: AI-generated presentations, emails, roadmaps, and other educational materials

2.3 Meeting Recordings

• Who Can Record: Only a club's owner and officers can record a meeting. Recording starts only when an officer presses Record, after a short countdown, using their own device's microphone, and they can pause or stop it at any time. Members cannot record.
• Letting People Know: Officers are responsible for telling everyone at the meeting before they start recording.
• What We Keep: The audio file, its transcript, the summary written from it, the meeting title, and the club and date it belongs to.
• Where It Is Stored: In Clubly's private Amazon S3 storage, encrypted at rest. Recordings are never made public and have no shareable links.
• Who Can Listen: Only signed-in owners, officers, and members of the club the meeting belongs to. Clubly checks club membership every time a recording is played, so people outside the club, including members who have been removed, cannot play it. Anyone who can play a recording can also save a copy from their browser.
• Transcription: The audio is sent to AssemblyAI or Google Gemini to produce the transcript (see 6.5)
• How Long We Keep It: Up to 3 years, like other meeting records, unless it is deleted sooner
• Deleting Recordings: When a club's owner deletes the club, its recordings are deleted with it. To have a single recording deleted sooner, email clublyteam@gmail.com.

2.4 Usage Information

• Platform Activity: Features used, time spent, and interaction patterns
• AI Content: Presentations, emails, and roadmaps generated through our AI tools
• Scheduling Data: Meeting schedules and calendar integration
• Performance Metrics: Platform usage statistics and feature adoption rates

2.5 Technical Information

• Device Data: IP address, browser type, operating system, and device identifiers
• Log Data: Server logs, error reports, and performance monitoring data
• Cookies and Tracking: Essential cookies for platform functionality (no third-party advertising cookies)

3. How We Use Your Information

3.1 Core Platform Services

• Provide and maintain the Clubly educational platform
• Enable club management and organization features
• Generate AI-powered educational content (presentations, emails, roadmaps)
• Schedule and manage meetings, events, and club activities

3.2 Communication and Support

• Send important updates about your clubs and activities
• Notify you of platform updates
• Provide technical support and customer service
• Send educational content, tips, and platform improvements

3.3 Platform Improvement

• Analyze usage patterns to enhance our services
• Develop new features based on user needs and feedback
• Ensure platform security and prevent abuse or misuse
• Conduct research to improve educational outcomes and user experience

4. Data Security and Protection

4.1 Security Measures

• Encryption: End-to-end encryption for all data transmission using industry-standard protocols
• Authentication: Secure authentication via Clerk with multi-factor authentication support
• Database Security: Encryption at rest and in transit in Google Firebase and Amazon S3
• Access Controls: Role-based permissions and strict access controls
• Regular Audits: Ongoing security assessments and penetration testing

4.2 Data Retention

• Account Data: Retained while your account is active and for 30 days after closure
• Club Data: Retained for 7 years after club closure for educational record purposes
• Meeting Records: Recordings, transcripts, and summaries are retained for 3 years for administrative and educational purposes, or until the club is deleted
• AI-Generated Content: Retained for 2 years or until manually deleted by users
• Logs and Analytics: Retained for 1 year for security and performance monitoring

4.3 Data Sharing and Disclosure

• No Sale of Data: We never sell your personal information to third parties
• Consent-Based Sharing: Data is only shared with your explicit consent
• Anonymous Analytics: Aggregated, anonymized data may be used for research and platform improvement
• Legal Compliance: Data may be disclosed when required by law or to protect our rights
• Service Providers: Limited sharing with trusted partners (Clerk, Google Firebase, Amazon Web Services, Google, Google Gemini, Groq, AssemblyAI, Pexels, Vercel) under strict data protection agreements

5. Your Rights and Choices

5.1 Access and Control

• Data Access: View and download all your data at any time through your account settings
• Data Correction: Update or correct your personal information
• Account Deletion: Delete your account and associated data (with 30-day recovery period)
• Communication Preferences: Opt out of non-essential communications
• Privacy Settings: Control visibility of your club activities and information

5.2 Data Portability

• Export Capabilities: Download your club data in standard formats (JSON, CSV)
• Content Transfer: Export AI-generated content you've created
• Meeting Records: Access and download meeting attendance and notes

5.3 Privacy Controls

• Club Visibility: Control who can see your club information and activities
• AI Content Settings: Control AI content generation and storage preferences

6. Third-Party Services

Clubly runs on a small number of providers. Each one sees only what its job requires.

6.1 Authentication (Clerk)

• Purpose: Sign-in, accounts, and sessions
• Data Access: Your name, email address, and sign-in method. No club content.
• Privacy Policy: Available at clerk.com/privacy

6.2 Database (Google Firebase, Firestore)

• Purpose: Stores clubs, memberships, term plans, tasks, attendance check-ins, mailing lists, club chat messages, polls, rank profiles, and usage counters
• Security: Encrypted at rest and in transit; access only through Clubly's servers
• Privacy Policy: Available at firebase.google.com/support/privacy

6.3 File Storage (Amazon S3)

• Purpose: Stores generated presentation files, meeting recordings, and the history of decks and meeting summaries
• Sharing: When you email a deck to members, the email carries a download link that works for 7 days without signing in. Anyone with that link can open the file during that time.
• Privacy Policy: Available at aws.amazon.com/privacy

6.4 AI Text Generation (Google Gemini and Groq)

• Purpose: Writes presentation outlines, term plans, prep tasks, meeting summaries, email drafts, and rank assessments from the club profile and the request you make
• Data Sent: Only the text needed for that request; never your mailing list
• Privacy Policies: Available at policies.google.com/privacy and groq.com/privacy

6.5 Transcription (AssemblyAI and Google Gemini)

• Purpose: Turns a meeting recording into a transcript
• Audio: The recording is sent to the provider only to produce the transcript. Clubly then keeps the audio in its own private storage so the club's members can listen back (see 2.3).
• Privacy Policy: Available at assemblyai.com/legal/privacy-policy

6.6 Images (Pexels)

• Purpose: Supplies stock photos for slides. Only the slide's search phrase is sent.
• Privacy Policy: Available at pexels.com/privacy-policy

6.7 Google Drive Export (optional)

• Purpose: If you connect your Google account, you can save a deck to Google Slides or a meeting summary to Google Docs in your own Google Drive with one click
• Access: Clubly asks Google only for permission to create files (the "drive.file" scope). It cannot see, read, change, or delete any file in your Drive that it did not create.
• Data Sent: The presentation or summary file you chose to export, and its title
• Tokens: Your Google access token is stored by Clerk, our authentication provider, and used by Clubly only at the moment you export. We do not store it ourselves, share it, or use it for anything else.
• Revoking: Disconnect Google from your Clubly profile at any time, or remove Clubly at myaccount.google.com/permissions. Files already created stay in your Drive under your control.
• Google API Policy: Clubly's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements

6.8 Email Delivery (Gmail)

• Purpose: Sends messages to your club's mailing list from Clubly's own address
• Data Sent: The recipient addresses and the message you wrote

7. Children's Privacy (COPPA Compliance)

7.1 Age Restrictions

• Under 13: We do not knowingly collect personal information from children under 13
• Immediate Deletion: If we discover data from a child under 13, we will delete it immediately
• Parental Rights: Parents can contact us to review, update, or delete their child's information
• Consent Requirements: We require parental consent for users under 18 in certain jurisdictions

7.2 Educational Use

• Institutional Oversight: Platform is designed for educational institutions and student organizations
• School Partnerships: We work with schools to ensure appropriate data handling
• FERPA Compliance: Educational records are protected under FERPA guidelines where applicable

8. International Data Transfers

• Primary Storage: Data is primarily stored in the United States
• International Users: Additional safeguards are in place for international data transfers
• Adequacy Decisions: We rely on adequacy decisions and standard contractual clauses
• User Rights: International users maintain the same privacy rights and protections

9. Cookies and Tracking Technologies

9.1 Essential Cookies

• Authentication: Required for user login and session management
• Functionality: Necessary for platform features and user preferences
• Security: Used for fraud prevention and security monitoring

9.2 No Advertising Cookies

• No Third-Party Tracking: We do not use advertising or marketing cookies
• No Behavioral Tracking: We do not track users across other websites
• Privacy-First: Our cookie usage is minimal and focused on platform functionality

10. Contact Information

10.1 Privacy Inquiries

• Email: clublyteam@gmail.com
• Response Time: We respond to all privacy inquiries within 48 hours
• Data Requests: Use the same email for data access, correction, or deletion requests

10.2 Data Protection Officer

• Contact: clublyteam@gmail.com
• Purpose: For complex privacy questions or concerns
• Availability: Business hours, Monday-Friday

11. Policy Updates

11.1 Notification Methods

• Website Posting: Updated policy posted on our website
• Email Notification: Direct email to all users for material changes
• Platform Notice: In-app notification for significant updates
• Effective Date: Changes become effective 30 days after notification

11.2 Your Continued Use

• Acceptance: Continued use of the platform after changes constitutes acceptance
• Objection Rights: You may object to changes by contacting us or deleting your account
• Version History: Previous versions of this policy are available upon request