Privacy Policy

WaveClubs (“we”, “our”, or “us”) operates the WaveClubs platform — an all-in-one management solution for surf schools and experience businesses. This Privacy Policy describes how we collect, use, and share information about you when you use our website (waveclubs.com) and platform (dashboard.waveclubs.com).

By using our services, you agree to the collection and use of information in accordance with this policy.

Information you provide

• Account details — name, email address, and password when you register.
• Business details — surf school name, location, contact number, and other business information you enter.
• Payment information — processed securely by Stripe. We never store full card numbers.
• Instructor and staff profiles — names, contact details, and availability schedules.
• Customer records — booking names, contact details, and session preferences you enter on behalf of your customers.
• Support communications — messages you send to our team.

Information collected automatically

• Usage data — pages visited, features used, and time spent on the platform.
• Device and browser data — IP address, browser type, and operating system.
• Cookies and similar tracking technologies (see Cookies section).

We use the information we collect to:

• Provide, operate, and improve the WaveClubs platform.
• Process payments and send billing notifications.
• Send transactional emails (booking confirmations, password resets, invoices).
• Send product updates and feature announcements — you can opt out at any time.
• Respond to support requests and troubleshoot issues.
• Monitor and analyse platform performance and security.
• Comply with legal obligations.

We will never sell your personal data to third parties or use it to serve you third-party advertising.

We do not sell, trade, or rent your personal data. We only share it in the following limited circumstances:

We retain your data for as long as your account is active. If you close your account, we delete or anonymise your personal data within 90 days, unless we are legally required to retain it longer (for example, payment records for tax purposes, which we keep for 7 years).

Backups are purged on a rolling 30-day cycle, so residual copies may persist for up to 30 days after deletion.

We take security seriously and implement appropriate technical and organisational measures to protect your data:

• All data is transmitted over TLS (HTTPS).
• Passwords are hashed using bcrypt — we never store plaintext passwords.
• Payment data is handled entirely by Stripe (PCI-DSS Level 1 certified).
• Access to production systems is restricted to authorised team members only.
• We conduct regular security reviews and dependency audits.

No method of transmission over the internet is 100% secure. If you discover a security vulnerability, please contact us immediately at security@waveclubs.com.

We use cookies and similar technologies to keep you logged in, remember your preferences, and understand how the platform is used.

You can control cookies through your browser settings. Disabling essential cookies will prevent you from using the platform.

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data.
• Deletion — request that we delete your personal data.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to certain types of processing, including marketing.
• Restriction — ask us to restrict processing in certain circumstances.

To exercise any of these rights, email us at privacy@waveclubs.com. We will respond within 30 days. EU/EEA residents may also lodge a complaint with their local data protection authority.

WaveClubs is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

We may update this policy from time to time. When we make material changes, we will notify you by email and update the “Last updated” date at the top of this page. Continued use of the platform after changes take effect constitutes acceptance of the revised policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please reach out: