This policy explains what personal data CK Club ("we", "us") collects, how we use it, and the choices you have. It is written to comply with UK GDPR and the Data Protection Act 2018.
1. Data we collect
- Account: name, email, hashed password, avatar, profile preferences.
- Billing: subscription plan, billing cycle, invoice history and Stripe customer / subscription IDs. Full card details are handled by Stripe and never touch our servers.
- Product usage: submitted credit requests, credit balance and ledger, add-on subscriptions, redemption history.
- Community: threads and replies you post inside the paying-member community, plus moderation metadata.
- Rewards: your referral code, referrals attributed to you, and loyalty milestones awarded.
- Security telemetry: sign-in / password-reset attempts and rate-limit counters, used only to protect accounts.
- Server logs: IP address, user agent and timestamps, retained short-term for abuse prevention and debugging.
2. How we use it
- Deliver the service you subscribed to (hosting, design credits, community access).
- Process payments, renewals, top-ups and refunds via Stripe.
- Send transactional emails — welcome, receipts, credit updates, renewal reminders, failed-payment notices, password resets and onboarding — via Brevo.
- Attribute referrals and award loyalty credits, only after a real paid subscription.
- Detect abuse, enforce rate-limits and moderate community content.
3. Lawful basis
Contract (delivering your membership), legitimate interests (security, service improvement, fraud prevention), and consent (marketing emails, if you opt in). You can withdraw consent at any time.
4. Sub-processors we share data with
- Stripe — payments, subscriptions, invoices.
- Brevo — transactional email delivery from
notify.club.creative-kay.com. - Managed cloud database & auth provider — hosts your account, credits, requests and community data with Row Level Security enforced.
- Cloud hosting / CDN — serves the website and API globally.
We never sell your personal data and never share it for third-party advertising.
5. Cookies & analytics
See the Cookies page for the current list. We use strictly necessary cookies for authentication and, where applicable, privacy-friendly analytics.
6. Retention
Account & billing data is retained for the life of your account plus the period required by UK tax law (typically 6 years for invoices). Community posts remain visible while the community exists unless you request deletion. Security telemetry is retained short-term (typically 30–90 days).
7. Security
Data is encrypted in transit (TLS) and at rest. Access to the database is protected by Row Level Security policies that scope every table to the correct user or role. Administrative privileges are gated by a server-verified role table (not client-side flags). Sensitive endpoints are rate-limited and audit-logged.
8. Your rights (UK GDPR)
You may request access, correction, export or deletion of your data, object to processing, or withdraw consent, by emailing hello@creative-kay.com. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO).
9. Children
CK Club is not directed at children under 16 and we do not knowingly collect their data.
10. Changes
We may update this policy; material changes will be notified by email. Last updated 8/14/2026.