Privacy Policy

1. Our role and your organization’s role

We determine how account administration, our subscriptions, website operation, support, security and our own business communications work. Organizations generally determine the purposes and permitted uses of the member, applicant, family, volunteer and activity records in their workspaces. For those records we act as a processor or service provider under the Data Processing Addendum. The organization’s own notice also matters.

Ask your organization about its membership decisions, dues, required documents, sharing and record retention. You may also contact us; we will help identify the responsible party and assist with requests within our role. Calling an organization the controller does not remove ClubNest’s own legal duties.

2. Information and sources

We receive information from you, the organization you join, authorized administrators and guardians, imports, connected providers and your interactions with the service. Depending on the features used, categories include:

• Identifiers and account details: name, email, phone, mailing address, login identifiers, authentication credentials and settings, roles and support contact details.
• Membership and family records: date of birth or age group, household and guardian relationships, applications, membership status, interests, qualifications, training and customer-supplied AMA, TRUST or other credential details.
• Commercial and financial records: plans, invoices, dues, donations, sponsorships, payment status, processor references, transaction dates and amounts. Connected payment providers collect card details through their payment forms; ClubNest uses returned tokens and transaction records rather than storing full card numbers or security codes in workspace records.
• Aviation records: aircraft reservations, flight history and meter readings, recorded qualifications and certificate status, maintenance reports, instructor availability and compensation estimates, technician contacts and selected airport.
• Documents and activity content: uploaded files and photos, form answers, typed signatures and initials, document versions and completion evidence, event registration and attendance, operational records, messages, community posts, votes, incident reports and administrative notes.
• Device and service activity: IP address, browser and device information, timestamps, authentication and security events, audit activity and delivery events. Optional website analytics collect browser identifiers, public page categories, selected campaign labels, referring domains and approximate country or region.
• Support and preferences: requests, correspondence, feedback, communication choices, consent records and privacy-request information.

Document completion receipts retain the signer’s authenticated account and name, signing-time email when recorded, UTC completion time, submitted answers, consent text, document fingerprint and form revision. They also retain the browser information and network IP address observed by our hosting proxy when available. An IP address identifies a network endpoint, not necessarily an individual or physical location. These records support document attribution, security, diagnostics and dispute handling; they are separate from optional website analytics. Access follows the document’s signer and authorized organization permissions, including authorized Master admin support access. Older completions may not contain email or IP evidence.

Where saved member cards are available, Square stores the card for the connected organization. Creating its customer record sends Square your name, email when available and a reference linking the organization and member. ClubNest uses provider references and displays the card brand, last four digits and expiration date. Saving a card does not make a payment or authorize automatic charges.

Some records can be sensitive, such as account credentials, private communications, children’s information or information revealing an organization affiliation. We use them for the requested service, security and permitted legal purposes. Do not upload Social Security numbers, full payment credentials, biometric identification templates or medical records requiring a HIPAA business associate agreement. An ordinary profile photo is not a request for biometric identification. Organizations must minimize additional sensitive information in free-text fields and attachments.

3. Why we use information

• Provide accounts, memberships, authorized family access, documents, transactions, events, communications and requested workflows.
• Authenticate users, enforce permissions, maintain audit records and protect against fraud, abuse and security incidents.
• Manage our subscriptions, payment reconciliation, support and account notices.
• Troubleshoot, maintain and improve reliability and usability; measure website traffic through the optional analytics described below.
• Deliver consent-based marketing where applicable and honor opt-outs.
• Respond to lawful requests, preserve required records, enforce agreements and establish or defend legal claims.

We do not use personal information for targeted advertising or profiling that produces solely automated decisions with legal or similarly significant effects. Organizations make their own membership and operational decisions. Automatic rules and moderation may flag or restrict activity; contact the organization or ClubNest if you believe a result is wrong.

4. Who receives information

Authorized organization staff and users receive information according to their roles and the selected audience. Accepted parents and guardians may see permitted youth membership, balance, document and communication information. Community posts and shared files are visible to the audience made available by the organization. “Private” does not mean inaccessible to authorized administrators, support staff or lawful requests. Voting visibility depends on the election configuration; an anonymous ballot does not mean no participation or security records exist.

Event registration information, including custom answers and recorded credentials, is available to the organizing organization and authorized event staff. Where an event uses contest-director access, an authorized director may review registration details through the event pass. Protect the pass and share it only for its intended event use. Guest registration may create an organization contact record without creating an independent ClubNest account or membership.

Adding an event to an external calendar shares its title, times, description and location with the calendar service you choose. If you enable an Aviation calendar subscription, anyone with its private URL can retrieve the reservation and registered-event titles, times and locations included in the feed without a ClubNest sign-in. Adding the URL to a calendar shares those details with that calendar provider. Keep the URL private. Rotating or disabling it stops access through the old URL but does not erase copies already downloaded; remove those separately with the recipient or calendar provider.

Our providers process information for hosting, authentication, storage, delivery, security, image screening and backup operations. Payment providers and services you connect receive information needed for those transactions and may have independent legal obligations. We may also disclose necessary information to professional advisers, authorities when legally required, parties needed to protect rights or safety, and a successor in a merger, sale or reorganization subject to appropriate protections.

We do not sell personal information for money or other valuable consideration, or share it for cross-context behavioral advertising, including information about minors. We do not rent membership lists. Necessary service-provider disclosures and your requested sharing still occur as described above. These are our current practices; changes requiring notice or consent will be addressed before the changed use.

5. U.S. state privacy rights

Rights depend on your residence, our role, statutory coverage and exceptions. Where applicable, you may request confirmation and access, information about categories and sources, correction, deletion, a portable copy, and information about disclosures or recipients as provided by your state’s law. You may also have rights to opt out of sale, targeted advertising or qualifying profiling, limit certain uses of sensitive information, withdraw consent, and appeal a denied request. We will not unlawfully discriminate against you for exercising a privacy right.

California residents: the categories, sources, purposes, recipient categories and retention criteria in this policy describe our current collection and disclosures. We have not sold personal information or shared it for cross-context behavioral advertising in the preceding 12 months. We use sensitive information only for permitted service, security and legal purposes, not to infer characteristics for advertising. We do not offer financial incentives in exchange for personal information. Applicability of the CCPA/CPRA depends on its legal thresholds and exclusions.

Global Privacy Control disables our optional unique-visitor analytics. Since we do not sell information or use targeted advertising, there is no sale or advertising program to opt out of. Ordinary Do Not Track browser signals do not have a separate service-wide effect; essential security and authentication still operate.

6. How to request access, deletion or an appeal

Email info@clubnest.tech with “Privacy request,” your requested action, account email and relevant organization. A workspace support request is another option; an account is not required to make a request. Do not email passwords, identity documents or sensitive member files. We may ask for information proportionate to the request to verify identity or guardian authority, using it for that purpose. Authorized agents may submit requests with evidence of authority; direct verification may also be required where lawful.

We will respond within the applicable legal period, explain a permitted extension or denial, and provide appeal instructions. If we deny a request, reply to the same email with “Privacy appeal” and the reason you disagree. We will review the appeal, explain the result within the applicable deadline and identify a relevant regulator complaint channel if it is denied. A request is ordinarily free; we will explain any legally permitted fee or exception before applying it.

For organization-controlled information, we will route or assist the request with that organization as appropriate. For urgent youth-safety concerns or information submitted by an ineligible child, tell us directly. Self-service deletion recovery settings do not postpone a statutory privacy-rights deadline.

7. Retention, recovery and deletion

We retain information for the purpose collected, the duration of the service relationship and necessary legal, accounting, dispute, security or preservation obligations. Criteria include the record type, organization instructions, configured retention, applicable deadlines, outstanding disputes and whether less information can satisfy the purpose. We do not retain every category for one universal period.

Document and task-history settings offer 30 days, 90 days, six months, one year or seven years, subject to holds and applicable obligations. Owner-requested workspace deletion and self-requested membership deletion have a 45-day recovery window; signing in during that window cancels your own pending request. It cannot reverse an administrator’s removal or security restriction. These actions do not automatically delete your separate login, other organizations or payment-provider records. Contact us for login deletion or a statutory request.

Completed signing records and their evidence are locked against ordinary edits or deletion. Removing a document from the current list does not erase its signing evidence. Requests affecting retained agreement records require review of applicable retention obligations and legal holds; contact your organization or ClubNest for review.

Optional analytics records are retained for up to 24 months; the browser identifier lasts up to 90 days. Parent-managed registration requests are removed after 30 days; approved child records follow documented membership retention. Expiring export links, live records and encrypted recovery archives have different lifecycles. Restricted backups can outlast live deletion until their retention expires; they must not be used to restore revoked access or deleted data to ordinary use. Ask us for the applicable retention details rather than treating backup recovery as permanent archival storage.

8. Children, teens and guardians

Independent accounts require age 14 or older. Children under 14 have parent-managed membership records, with an adult submitting the registration through their own verified account. No consent form enables an independent under-14 login. We do not invite children to bypass that restriction by using an adult’s credentials.

For members aged 14–17, guardian name and email are required by default at signup or joining. A supported owner setting may remove that contact requirement, but cannot waive parental permissions or legal duties. A named contact is not a verified guardian and does not grant account access. Organizations must verify guardian relationships and required permissions. Youth communication, parent visibility and photo restrictions operate according to their separate rules.

Read Children’s Privacy & Parent-Managed Memberships for data, purposes, parent rights and safeguards. Contact info@clubnest.tech if a child has supplied information through an ineligible direct account or to request review, restriction or deletion. We will investigate and take steps required by law.

9. Photos, moderation and safety reports

Where enabled, uploaded profile photos are sent to the configured image-moderation provider for screening before publication. They may be viewed by authorized people according to the relevant workspace and family permissions. Optional text filters and reporting tools help flag prohibited content, but can miss harmful material or reject acceptable material. These tools are not a safety guarantee or substitute for supervision.

Safety reports may contain sensitive information and are restricted to people responsible for review, response and lawful disclosures. Use concern-reporting tools or our public email to report an issue; do not redistribute illegal imagery. See the Community Guidelines.

10. Cookies, analytics and communication choices

Essential cookies and browser storage support login, security, remembered devices and preferences. Optional analytics use a pseudonymous browser identifier—an identifier that distinguishes a browser without directly naming you—and protected hashes, not a guarantee of legally anonymous data. Analytics reports do not store full IP addresses, full referrer URLs, names, emails or phone numbers, although service infrastructure may process IP addresses separately for delivery and security.

Use Allow analytics, Decline analytics or Analytics preferences to manage the optional measurement described in the Cookie Policy. Withdrawal removes records associated with the current identifier; it may not identify older or different-device records. Declining analytics does not prevent membership service.

Use unsubscribe links, available preference controls or our contact email to stop our marketing. Account, security and legally required notices may still be sent. An organization’s own communications have separate preferences and responsibilities. Submitting a privacy request does not enroll you in marketing.

11. Security and processing locations

We use authentication, permissions, organization-level database controls, protected transport and other safeguards described on the Security page. No internet service can guarantee absolute security. Users and organizations must protect credentials and configure access appropriately.

ClubNest is operated in the United States. Providers may process information in the United States or other countries according to their service configuration; we do not promise that every copy remains in Arizona or the United States. If a non-U.S. law applies, applicable rights remain available. Where a transfer needs an additional legal safeguard, that safeguard must be established; this page alone does not execute standard contractual clauses or certify international compliance.

12. Policy changes and contact

We will update the effective date when this policy changes and provide additional notice or obtain consent for material changes when required. A new policy does not retroactively authorize incompatible uses of previously collected information. Contact Club Nest LLC at info@clubnest.tech for privacy questions, accessible copies, requests or appeals.