A clear agreement.
Service terms and processing agreement · 2026-10-22-v3
Parties and service
This agreement is between the business whose authorized representative creates the club and Motion Industries, business registration 46146360, Københavnsvej 26A, 4000 Roskilde, Denmark (Clubovate). Clubovate provides customer-club administration, Join for members and Run for staff. Contact: support@clubovate.com. The agreement starts when the club is created and includes the processing agreement below.
Shop content and responsibilities
The business sets its own offers, earning rules, rewards and expiry dates and is responsible for lawful content, image rights and honoring the benefits it promises members. This version does not process shop purchases, manage inventory or reconcile POS sales. Statistics show recorded activity, not guaranteed revenue, profit or physical visits.
Content rules and age restrictions
Businesses, including bars and wine shops, may have a club. Join must not be used to advertise, offer or reward tobacco or nicotine products (including vapes and nicotine pouches), weapons or ammunition, or sexual content. This covers text, images, links, posts and campaigns. If a club promotes alcohol, its owner must select 18+ protection for the entire club before publication. Alcohol must not be marketed to minors or encourage excessive drinking. A member's age declaration is not identity verification and does not replace the business's responsibilities or required age checks at sale and redemption. Businesses must classify content correctly and must not bypass protection. Report content in Join or to support@clubovate.com. We may hide content during review without deleting earned points or rewards. Existing accounts are not automatically recorded as accepting the new content rules; separate confirmation is recorded and material contract changes follow the notice period below.
Accounts and messages
Use your own account and give staff individual access. The business manages staff access and must have a lawful basis for its processing and marketing. Send club messages only to members who opted in; membership alone is not consent to other marketing channels. Do not upload sensitive personal data, government identifiers or other people’s private information in posts, products or images.
Trial and payment
Creating a club starts 40 free days without a card. Payment starts only when the owner separately subscribes through Stripe. Both plans cost DKK 99/USD15 per club per month for the first three paid months. After that, Basis costs DKK 299/USD49 and Plus costs DKK 599/USD99 monthly, excluding VAT and applicable taxes. Danish businesses pay in DKK; businesses in other supported countries pay in USD. The linked subscription terms form part of this agreement. Accepting these terms does not order a paid subscription.
Operation, changes and termination
Contact support about faults. We may restrict abuse or unlawful content and explain the reason unless law or security prevents this. Material agreement changes receive at least 30 days’ notice unless law or a necessary security fix requires shorter notice. You can stop before a change takes effect. Cancel paid subscriptions in Settings. Deleting the last owner’s account closes their clubs after the displayed warning; earned benefits can remain visible as member history. Contact support before closure if you want a copy of club data.
Food surplus
The optional Danish food-surplus module needs a separate application and owner acceptance of its terms. It is included in active Basis and Plus trials and subscriptions. Customers reserve in Join and pay the store directly. The module introduces no commission or payment through Clubovate. See food-surplus terms; earlier acceptances are not automatically changed.
AI assistant
The optional assistant provides explanations and suggestions. When an owner or administrator explicitly requests it, it can also save and revise drafts for offers, posts and polls through the usual access and version checks. It can prepare publication of the selected offer, but the user must review the actual content and click Publish now before it is published. It does not schedule or send notifications. Uploaded images are attached to the content by Clubovate and are not sent to OpenAI. AI may be wrong; check text, prices, terms and dates before use. A draft request instructs this save; previously recorded agreements and AI authorizations are not rewritten. Before first use, the owner separately authorizes OpenAI to process questions, accompanying conversation and a limited view of club settings, products, prices, offers, the selected content draft and aggregate activity to provide answers. Club context excludes member lists, individual purchases, QR codes and sign-in credentials. Do not enter sensitive information or other people's private information. Authorization does not purchase credits or a subscription. Existing agreements and recorded acceptances are not silently rewritten.
Article 28 processing agreement
This part governs processing of personal data on the business’s behalf and is accepted with the service terms.
1. Roles, scope and duration
The business is controller of its customer club and Motion Industries is processor. This agreement covers processing on the business’s behalf during service use and subsequent return or deletion. Motion Industries separately controls platform accounts, security and its own invoicing as explained in the privacy notice; club member data is not repurposed for our own marketing.
2. Documented instructions and purpose
The business instructs us to store, display, organize and process club memberships, stamps, rewards, redemptions, poll answers, content and message choices to deliver the functions selected by the business and members. Clubovate configuration and actions are documented instructions. Additional instructions must be sent to support in writing. We process only on documented instructions, including third-country transfers, unless law requires otherwise; we inform the business of that legal requirement beforehand unless prohibited by law. We immediately inform it if an instruction appears to infringe data-protection law.
3. People and data
Data subjects are club members and business owners and staff. Data includes account and membership identifiers, selected contact and authentication information where required by the function, membership status, stamps, rewards and redemptions, poll answers, message choices and delivery-device addresses, and action attribution, timestamps and security/operational records. Processing does not include special-category data or government identifiers. The business chooses its public content and service rules.
4. Confidentiality and security
Only people who need access and are bound by confidentiality may process the data. We maintain appropriate technical and organizational measures under Article 32: separation of club permissions, individual authentication, restricted server and administrator access, encrypted connections and secret protection, records of significant actions, protected recovery and checks of restoration and deletion. Security changes must not reduce overall protection.
5. Subprocessors and transfers
The business gives general written authorization for the subprocessors and functions listed below. Written agreements impose equivalent data-protection obligations, and we remain responsible to the business for their performance. For subprocessors under the general authorization, we give written notice of additions or replacements at least 30 days before use, allowing reasoned objections to support. The business may instead give prior specific written authorization for an identified provider and function. The owner's separate electronic AI authorization is that specific instruction for the described OpenAI processing from acceptance; it does not order payment or alter notice for other providers. We seek a resolution and do not start affected processing while the objection is considered; if unresolved, the business may end the affected service. Transfers outside the EEA require documented instructions and a valid Chapter V safeguard, including appropriate supplementary measures. EU storage does not exclude international provider support.
6. Rights, breaches and assistance
Taking account of the nature of processing, we assist the business with access, correction, erasure, restriction and portability requests, and with Articles 32–36, impact assessments and prior consultation using the information available to us. We forward requests concerning the business’s processing and follow its instructions. We notify the business without undue delay after becoming aware of a personal-data breach, supply available details of the incident, affected data, consequences and mitigation, and provide updates. The business decides on notifications to authorities and data subjects.
7. Return, deletion and recovery
At termination the business chooses return followed by deletion, or deletion, of data processed on its behalf. Contact support before termination for return in a commonly used machine-readable format. We delete or anonymize copies unless law requires retention and document any exceptions. Backups are isolated from ordinary use and expire under the stated retention periods; erasures are reapplied before a restored service resumes. Closed-club history in a member’s platform account and legally required invoice records are processed only for the separate purposes and periods in the privacy notice. Termination does not authorize further marketing.
8. Evidence and audits
We provide information necessary to demonstrate Article 28 compliance and allow and contribute to audits, including inspections, by the business or its appointed auditor. Contact support to arrange proportionate checks protecting other customers’ data and security; this does not restrict statutory audit rights. We cooperate with competent supervisory authorities. This processing agreement prevails in any conflict concerning personal-data processing.
Authorized subprocessors
Supabase Pte. Ltd. (database and authentication, Frankfurt); Render Services, Inc. (server and web hosting); Amazon Web Services EMEA SARL (protected recovery storage, Frankfurt); Plus Five Five, Inc. / Resend (service emails); Twilio (SMS codes, Ireland); Expo / 650 Industries and Apple (push delivery); OpenAI Ireland Ltd. (optional AI assistant, after separate owner authorization). Provider subprocessors are described in their published lists. See the privacy notice for links and transfer information. Stripe handles the business subscription under its own role and terms; Apple and Google also independently control their own sign-in services.
Documents and contact
Subscription terms · Privacy and retention · Food-surplus terms· support@clubovate.com