We collect personal information that you voluntarily provide when you register, make a purchase, or contact us. This includes:

• Names
• Email addresses
• Mailing addresses
• Usernames and passwords
• Contact preferences
• Billing addresses
• Phone numbers

Sensitive Information. We do not process sensitive personal information.

Payment Data. All payment data is handled and stored by Stripe and PayPal. We never store your card details on our servers. Privacy policies: Stripe and PayPal.

When you visit our site, we automatically collect certain technical information including:

• Log and Usage Data — IP address, browser type, pages viewed, date/time stamps
• Device Data — device type, operating system, browser settings
• Location Data — approximate location based on your IP address

Our use of Google APIs adheres to the Google API Services User Data Policy.

We process your personal information for the following purposes:

• Account creation and authentication — to create and manage your account
• Service delivery — to fulfil and deliver your orders
• Customer support — to respond to your questions and resolve issues
• Administrative communications — to send order confirmations, policy updates
• Order management — to process payments, returns and exchanges
• Marketing — to send promotional emails where you have consented
• Security — to prevent fraud and keep the site safe
• Analytics — to understand how the site is used and improve it

We rely on the following legal bases:

• Consent — for marketing emails and cookies. You can withdraw consent at any time.
• Performance of a Contract — to process and deliver your orders.
• Legitimate Interests — for analytics, fraud prevention and service improvement.
• Legal Obligations — to comply with UK law and regulatory requirements.
• Vital Interests — in rare circumstances involving safety.

We share data with the following third-party services:

• Klaviyo — email marketing and direct communications
• Stripe and PayPal — payment processing
• UpdraftPlus — data backup and security
• Google Analytics — website analytics
• Termly — privacy compliance infrastructure
• WordPress — website hosting

We may also share your information in the event of a business transfer, merger or acquisition.

We use cookies and similar tracking technologies to collect and store information when you interact with our site. Some cookies are essential for the site to function; others help us understand how the site is used via Google Analytics.

For full details on the cookies we use, please see our Cookie Policy. You can manage your cookie preferences at any time using the banner at the bottom of the page.

Some of our third-party service providers (including Google and Klaviyo) are based in the United States. When your data is transferred outside the UK or EU, we ensure it is protected using the European Commission's Standard Contractual Clauses.

We retain your personal information for as long as your account is active. When you close your account, we will delete or anonymise your data unless we are legally required to retain it (for example, for tax or accounting purposes).

We use appropriate technical and organisational security measures including Wordfence security, regular encrypted backups via UpdraftPlus, and secure payment processing through Stripe and PayPal. However, no transmission over the internet can be guaranteed to be completely secure.

We do not knowingly collect data from or market to anyone under 18 years of age. By using our services, you confirm that you are at least 18. If we become aware that we have collected data from a minor, we will delete it immediately. Contact us at Tyler.Hodgson@afterhoursclub.co if you have any concerns.

Under UK GDPR you have the right to:

• Access a copy of the personal data we hold about you
• Request correction of any inaccurate data
• Request deletion of your personal data
• Object to or restrict how we process your data
• Request a portable copy of your data
• Withdraw consent for data processing at any time
• Opt out of marketing emails by clicking unsubscribe in any email we send

To exercise any of these rights, contact us at hello@afterhoursclub.co. If you are in the UK and believe we are unlawfully processing your data, you have the right to complain to the ICO.

We recognise and honour Global Privacy Control (GPC) signals. If your browser sends a GPC signal, we will automatically apply your opt-out preference for targeted advertising.

There is currently no industry standard for Do-Not-Track browser signals, so we do not respond to these separately at this time.

The table below shows the categories of personal information we have collected in the past 12 months:

To exercise your US state privacy rights, contact us at hello@afterhoursclub.co.

We process your data in accordance with Australia's Privacy Act 1988 and New Zealand's Privacy Act 2020. You have the right to request access to or correction of your personal information at any time.

We process your data in accordance with POPIA. If you are unsatisfied with how we handle your data, you may contact the Information Regulator of South Africa.

Yes — we may update this Privacy Policy from time to time. The updated date at the top of this page reflects when it was last revised. We will notify you of material changes by email or a prominent notice on the site.

If you have any questions or concerns about this Privacy Policy, please get in touch:

To request access to, correction of, or deletion of your personal information, email us at hello@afterhoursclub.co. We will respond in accordance with applicable data protection laws.

You can also update your account information directly by logging into My Account.