Privacy Notice — Ironbridge Pub Crawl

1. Who we are

Ironbridge Pub Crawl ("we", "us") is the data controller for personal data collected through this site and the Ironbridge Pub Crawl product.

2. What we collect and why

Account data (email address, password hash, display name) — to create and operate your account. Legal basis: performance of contract.
Pub crawl activity (which pubs you've checked into, which group you joined, route preferences) — to provide the leaderboard and route-planning features. Legal basis: performance of contract.
Sign-in metadata (last sign-in time, IP address used for authentication) — for security and fraud prevention. Legal basis: legitimate interest.
Support correspondence — to respond to your messages. Legal basis: legitimate interest.

Payment card details are collected directly by Stripe (see "Sharing" below) and are not visible to us.

3. How we share your data

Stripe Payments Europe, Ltd. — our payment processor. Stripe processes card payments and helps us prevent fraud. See Stripe's privacy notice.
Hosting and infrastructure providers (Lovable Cloud / Supabase, Cloudflare) — to store data and serve the site.
Google Maps Platform — when you view the interactive map, requests are sent to Google in line with their privacy policy.
Authorities — where required by law.

4. International transfers

Some of our providers are located outside the UK / EEA. Where they are, transfers rely on adequacy decisions or the UK / EU Standard Contractual Clauses.

5. Retention

We keep account and activity data for as long as your account is active, and for up to 24 months afterwards for fraud-prevention and accounting purposes. You can request earlier deletion at any time (see "Your rights").

6. Your rights

You have the right to access, correct, delete, restrict or object to processing of your personal data, and to data portability. You can also withdraw consent where processing is based on consent, and complain to the Information Commissioner's Office (ICO) at ico.org.uk. We respond to requests within one month.

7. Security

We use industry-standard technical and organisational measures including encryption in transit, access controls, password hashing and row-level security in our database.

8. Cookies

We use essential cookies and local storage for sign-in and session management. We do not currently use marketing or third-party advertising cookies.

9. Contact

For any privacy questions or to exercise your rights, contact us at the email address listed on our Refund Policy page.