Last reviewed: 12 September 2026
This is a working draft, written to reflect what the platform actually collects and does today. It hasn't been reviewed by a lawyer yet, so treat it as a genuine starting point rather than a finished legal document.
Cluvest is software clubs use to run training, matches, attendance and squads. When your club signs up, your club is generally the data controller for your membership data. It decides who gets registered and what they can see. Cluvest is the processor: we operate the platform that data lives on, following your club's instructions.
Account & profile data
Club activity data
Device & notification data
If a club runs a junior or youth program, registration might collect a bit more: date of birth, medical notes, and a parent or guardian's contact details. We treat this as sensitive information. Access is limited to specific staff permissions rather than every club admin, each access gets logged, the data is encrypted at rest, and it's deleted on a schedule your club sets. A parent or guardian's consent is captured when registration happens.
Mainly to run your club day to day: squad selection, attendance tracking, match day logging, and keeping members in the loop. We also use it to operate the service itself, things like signing you in, sending the notifications you've opted into, and helping when you need support.
Access inside a club follows a permission system. Managers, admins and coaches see roster data relevant to their role, and sensitive fields like medical or injury notes sit behind a separate permission from the general roster. Players see their own data and whatever's public for their team. Cluvest staff only access data to keep the platform running or to help with a support request. We never use it for anything else.
Each of these companies processes data on our behalf, under contract, purely to help deliver the service. None of them get to use it for their own purposes.
We keep account and club data while your account or club membership stays active, plus a limited period after that. Children's program data gets deleted automatically once your club's chosen retention period ends.
You can ask us to access, correct, or delete your personal data. A deletion request reaches our primary database, our audit logs, and our backups, not just the record you can see. You can also ask for a copy of your data or object to a specific use of it. If you or your club are based in the EU, GDPR applies to you. Cluvest's first clubs are Australian, so the Australian Privacy Act, including the Notifiable Data Breaches scheme, is our baseline no matter where you're located.
Email [email protected]. Since your club controls most of its own membership data, some requests, like fixing a roster detail, get resolved fastest by asking your club administrator directly.
If we ever become aware of a data breach likely to cause serious harm, we'll notify the people affected and the relevant authority (the OAIC under Australia's Notifiable Data Breaches scheme, or the equivalent EU authority under GDPR) as quickly as we reasonably can.
Cluvest isn't something a child can sign up for on their own. Minors only ever get registered through a club's supervised program, with a parent or guardian's consent captured at registration, as covered in section 3.
We'll update the "last reviewed" date above whenever this policy changes, and note material changes separately if they affect how your data is handled.