Privacy Policy

"Clubhouse AC", "we", "us" and "our" refer to the operator of the Clubhouse AC website, dashboard, scanner application and related tools accessible at clubhouseac.com (together, the "Service"). For the personal data we process for our own purposes (account management, billing, service operation, fraud and abuse prevention, aggregate detection telemetry), we are the controller under Article 4(7) GDPR.

For personal data we process on behalf of a server administrator (the forensic scan snapshot a player produces when redeeming a PIN issued by that administrator), the administrator is the controller and we act as the processor under Article 4(8) GDPR. See the separate Data Processing Addendum for the processor-side terms.

This Policy explains our practices for personal data processed when you visit the Clubhouse AC website, create an account, purchase a subscription, use the dashboard or workbench, or run the Clubhouse AC scanner application (whether as a subscriber or as a player redeeming a PIN). It does not cover third-party websites we may link to; those sites publish their own privacy notices.

We process the following categories of personal data. Not every category applies to every user; the categories below cover the full surface across visitors, subscribers and scanned players.

• Account identifiers.

  Email address, hashed password (never stored in plaintext), Discord user id (when you sign in via Discord OAuth), display name and profile picture URL as supplied by Discord, account creation timestamp, last sign-in timestamp and per-session records.

• Subscription and billing data.

  The plan you selected, its status and renewal date, the invoice history, the Stripe customer id and the last four digits of the payment method. Card numbers, CVCs and full bank details never touch our servers; they are handled directly by Stripe under their own privacy policy.

• Network and device metadata.

  IP addresses, User-Agent strings, coarse geolocation derived from IP (city / region / country), browser fingerprinting signals used only for anti-abuse (2FA verification, rate limiting, ban enforcement).

• Scanner forensic data (players only).

  When a player redeems a server administrator's PIN and runs the scanner, we collect the forensic snapshot described in Terms §06 and the linked DPA: OS metadata, hardware identifiers, running processes, loaded modules, installed programs, execution artifacts (Amcache, Prefetch, ShimCache, BAM, PcaSvc), file system metadata, registry artifacts relevant to anti-cheat detection, event log excerpts, DNS cache, network adapters, active and recent connections, and one or more screenshots of the player's display at scan time. Where memory analysis is enabled, process or physical-memory captures may also be collected or processed. Memory captures can incidentally contain personal or sensitive information from unrelated applications, even though their purpose is anti-cheat investigation. See Terms §08 for kernel operations, precautions and risks. Scanner collection can begin before a scan finishes, including when it later fails or is cancelled. Passive site visitors never trigger scanner collection.

• Additional execution and system history (players only).

  Execution artifacts can include accessible Windows user profiles, WMI subscriptions and their stored scripts, selected Windows event records and crash-report fields. If you select the optional Deep scan mode, the scanner also acquires a WMI repository copy for offline analysis and reads historical Prefetch and Amcache from existing system snapshots. These sources can contain account names, file paths, application details and script contents unrelated to cheating. The historical collection reads existing snapshots rather than creating history. A separate, temporary snapshot may be used to acquire a consistent copy of the current repository. These records follow the scan report's access and retention rules.

• Browser forensic records (players only).

  A scan can collect browser history, download records and cache metadata from supported local browser profiles, including URLs, page titles, visit and download times, download destinations and profile and source paths. These fields can reveal personal or sensitive information unrelated to cheating. The browser collector does not open saved-password or cookie databases. Browser records are part of the access-controlled scan report and follow its retention rules. The existing notice before starting a scan describes this collection. Opening-photo permission alone does not start browser collection.

• Scanner lifecycle metadata.

  The download page asks you to explicitly permit an automatic screenshot of all displays whenever you open that downloaded EXE, before PIN entry or scanning and without another screenshot-consent popup. The image may include private information in other applications. We record the permission version, acceptance time, expiry and associated PIN and operator. Permission applies only to that download while the PIN and permission remain valid. Download only for your own use; share the page link with other players instead of forwarding your EXE. You can decline by leaving the checkbox unchecked. To stop future opening photos, stop opening and delete that copy.

• Opening screenshot notifications.

  A consented opening sends its screenshot, scanner protocol version, reported hardware identifier and reported Discord identity. The server observes the connection IP address and supplies the PIN-linked intended identity. The "Scanner Opened" notification and image go to authorized reviewers in configured Discord channels, where Discord processes and stores a copy. Possession of a consented download does not independently verify who opened it. Protected accounts remain excluded. Older versions may send only opening metadata or wait for in-app consent and PIN validation. Client-reported telemetry requires review and is not independent proof of cheating or reverse engineering.

• Scanner tamper telemetry (abuse investigation).

  Independent of the PIN-based scan flow, the scanner detects deliberate attempts to reverse-engineer, patch, unpack, hook, debug or otherwise tamper with it (for example: opening the scanner in a debugger, loading a known unpacker against it, running it under an in-process hooking framework, or launching an unpacked redistributed copy). When such a tamper attempt is detected, and only then, the scanner transmits a bounded environment snapshot: the scanner's own file path, SHA-256 and Authenticode signature status; the operating-system build; the machine name; a partial username (usually masked to a first character plus underscore count and length; unmasked only for well-known analysis-sandbox accounts such as IEUser, WDAGUtilityAccount and vagrant); the parent-process chain that launched the scanner (up to five hops); the scanner's own command line (secrets in key=value form redacted before transmission and truncated to ~4 KB); token elevation and integrity level; whether the operating system is in Test Mode; a shortlist of loaded modules and running processes cross-referenced against a set of known reverse-engineering tools; and debugger-presence flags. Collection is one-shot per tamper event, bounded to under 80 ms of scanner wall time, capped at approximately 8 KB per event, and does not occur during any normal scan or on any machine where no tamper has been detected. It does not include: the full running-process list, the loaded-module list of unrelated software, file contents, browser history, RAM contents, screenshots of user activity, credentials or personal files. Lawful basis is legitimate interests (see §04); retention is 180 days (see §07).

• Communications.

  Support tickets, Discord messages you send to the operator, in-app chat with the scanner assistant.

• Diagnostic and operational logs.

  Server-side error logs, request logs, rate-limit counters, security events (failed logins, unusual sign-in locations, 2FA challenges). Retained short-term for incident response and abuse prevention.

We do not process special categories of data (racial or ethnic origin, political opinions, religious beliefs, trade-union membership, genetic data, biometric data for uniquely identifying a person, health data, sex-life or sexual orientation data) as part of the normal Service.

Each processing purpose maps to a specific Article 6(1) GDPR lawful basis. Where more than one basis could apply, we identify the primary one.

• Providing the Service to subscribers.

  Necessary for the performance of the subscription contract (Art. 6(1)(b)). Covers account management, dashboard access, PIN issuance, scan report delivery.

• Running a scan on a player's machine.

  Explicit consent (Art. 6(1)(a)): the player voluntarily redeems a PIN after being informed of what the scan collects. Consent is revocable: the player can decline the PIN or stop the scanner before it completes; consent already exercised for a completed scan cannot retroactively delete that specific scan report but does prevent future collection.

• Security, fraud and abuse prevention.

  Legitimate interests (Art. 6(1)(f)) in operating a secure and non-abused service, balanced against user rights. Covers rate limiting, IP logging, ban enforcement, 2FA and anti-account-sharing measures.

• Scanner tamper telemetry.

  Legitimate interests (Art. 6(1)(f)) in identifying and correlating deliberate attempts to reverse-engineer, patch, unpack, hook or debug the scanner — conduct that, by definition, is not something a lawful player would attempt on their own machine. The interest in preventing scanner abuse is balanced against the affected individual's rights by: (i) restricting collection to the moment a tamper trap fires (no passive collection); (ii) capping the data set to the fields listed in §03 (bounded environment metadata, no file contents, no RAM, no screenshots of activity, no unrelated processes); (iii) masking usernames by default; (iv) redacting key=value secret patterns from command lines before transmission; (v) applying a fixed 180-day retention followed by automatic deletion; and (vi) granting the affected individual the same access, rectification, erasure, restriction, objection and portability rights as any other data subject (see §09). No solely-automated decision under Article 22 is taken from this telemetry.

• Billing and payment.

  Contract performance (Art. 6(1)(b)) plus compliance with tax and accounting law (Art. 6(1)(c)).

• Detection research and product improvement.

  Legitimate interests (Art. 6(1)(f)) in improving cheat-detection accuracy. Uses only aggregated and de-identified telemetry; individual scan reports are not repurposed for research without additional consent.

• Optional analytics.

  Consent (Art. 6(1)(a)) via the cookie banner. If you have not accepted the analytics category, no analytics script is loaded and no analytics data is collected. See the Cookies Policy for details.

• Legal claims and compliance.

  Legal obligation (Art. 6(1)(c)) and establishment, exercise or defence of legal claims (Art. 9(2)(f) where applicable). Covers responding to lawful requests from authorities, defending abuse-report disputes and preserving evidence.

We disclose personal data only to the categories of recipients below, each bound by contractual and/or statutory confidentiality and security obligations.

• Infrastructure providers.

  Vercel Inc. (application hosting, edge compute, CDN), Neon (managed Postgres), Supabase (managed Postgres + auth for legacy sessions), Cloudflare (DNS, WAF, DDoS mitigation, DNS-over-HTTPS for scanner name resolution).

• Payment processing.

  Stripe, Inc. Handles card details, produces receipts and manages recurring billing. We never see raw card numbers.

• Transactional email.

  Resend Inc. (verification codes, sign-in notifications, account emails).

• Identity and communication.

  Discord Inc. for OAuth sign-in, community support and administrator notifications.

• IP geolocation.

  ip-api.com (best-effort city/region/country lookup used only to enrich 2FA-verify sign-in-location emails).

• Server administrators.

  Scan reports produced by a player under a PIN are disclosed to the administrator who issued the PIN and to that administrator's authorised staff. This is the entire point of the Service.

• Legal and safety.

  Law-enforcement or regulatory authorities where we are legally required to disclose, and to protect the vital interests of a person where necessary.

We do not sell personal data. We do not share personal data with advertising networks, data brokers or profile-syndication vendors of any kind.

Some processors above are established outside the EEA or the UK. Where personal data is transferred to such a jurisdiction, we rely on adequate safeguards recognised under Chapter V GDPR (Articles 44-49), including the Standard Contractual Clauses adopted by the European Commission and, where the destination is the United States and the processor is certified under it, the EU-US Data Privacy Framework. A copy of the safeguards applicable to a specific transfer can be requested from the contact address in §01.

• Account records.

  Retained for the life of the account and for a short grace period (typically 30 days) after account deletion so the deletion is reversible if requested in error. After that, identifiers are irreversibly anonymised or deleted, subject to the tax / accounting exception below.

• Invoice history.

  Retained for the periods required by applicable tax, accounting and anti-fraud law (typically 6-10 years depending on jurisdiction), even after account deletion.

• Scan reports (players).

  Retained for as long as the administrator's subscription is active and the administrator needs the report for investigation and audit. On subscription cancellation, reports are subject to the deletion terms in the DPA. Administrators can also delete an individual report at any time from the dashboard.

• Security and abuse logs.

  Rolling short-term window (typically 30-90 days) sufficient for rate-limiting, incident response and abuse investigation, then discarded.

• Scanner tamper telemetry.

  Retained for 180 days from collection, then automatically deleted by a scheduled retention job. The longer window (compared to the 30-90 days for generic security logs) is limited to this dataset and is necessary for its purpose: correlating repeat tamper attempts from the same hardware / network across time, which typically unfold over multiple weeks. Individual records can be deleted earlier on a verified data-subject request under §09.

• Ban records.

  Retained as long as the ban is enforced. Un-banning removes the record on request; a permanent ban record persists indefinitely because its purpose is durable exclusion.

We apply technical and organisational measures appropriate to the risk (Article 32 GDPR):

• All personal data is transmitted over TLS 1.2+.
• Databases sit behind private networking; access requires authentication, is logged and is limited to personnel whose role requires it.
• Passwords are stored as salted, iterated hashes; we never see or store the plaintext.
• Every authenticated action requires 2FA via email OTP; sign-in events are logged with IP, user agent and coarse geolocation, and unusual sign-ins trigger notifications.
• Scanner uploads are session-bound and encrypted end-to-end from the scanner binary to our ingestion endpoint.
• Personal-data breaches are notified to the affected controller without undue delay in accordance with Article 33 GDPR, and to affected data subjects where required by Article 34.

Under the GDPR, the UK GDPR and equivalent laws, you have the following rights over your personal data:

• Access

  (Art. 15): a copy of the personal data we hold about you.

• Rectification

  (Art. 16): correction of inaccurate or incomplete data.

• Erasure

  (Art. 17, "right to be forgotten"): deletion of your personal data, subject to the legal-hold exceptions in §07.

• Restriction of processing

  (Art. 18): temporary freeze on further processing while a dispute is resolved.

• Data portability

  (Art. 20): a machine-readable copy of the personal data you provided to us.

• Object

  (Art. 21): object to processing based on legitimate interests. Where the objection concerns direct marketing we will always honour it.

• Withdraw consent

  (Art. 7(3)): where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

• Lodge a complaint

  (Art. 77) with your local supervisory authority (in the EU, the data-protection authority of the member state where you live, work or where the alleged infringement took place).

The Service is not directed at children under the age of digital consent in the user's jurisdiction (16 in most EU member states, 13-16 in others, 13 in the UK and the US). Signing up requires an age confirmation on the sign-up form. If we become aware that we have collected personal data from a minor without appropriate parental consent, we will delete that data. See Terms §03 (Acceptable Use) and Terms §12 (Age and Eligibility, if present) for the operator-side rules.

If you are a resident of California (or another US state with an equivalent framework, including Virginia CDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, Texas TDPSA), you have the following rights in addition to those listed in §09:

• Right to know what personal information we collect, use, disclose and (if we did) sell or share.
• Right to delete personal information we hold about you, subject to statutory exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of personal information. We do not sell or share personal information under any state's definition of those terms, so there is nothing to opt out of, but the right exists.
• Right to limit use of sensitive personal information. We do not process sensitive personal information beyond what is strictly necessary to provide the Service you requested.
• Right to non-discrimination for exercising any of the above.

Requests are honoured on the same channels described in §09. You may designate an authorised agent to submit a request on your behalf; the agent will need to demonstrate authority and we may still contact you directly to verify.