Klubo is software that sports clubs and academies in Singapore use to run classes, packages and payments. This policy explains what personal data is collected when you use Klubo's app, why, who handles it, how long it is kept, and your rights under the Singapore Personal Data Protection Act 2012 (PDPA).
Who is responsible. If you are a member, a parent or guardian, or a coach, your club decides what is recorded about you and is the organisation responsible for it under the PDPA. Klubo (operated by Allyvate Pte Ltd, UEN 201934150N) runs the app for the club as its data intermediary: it processes that data only to provide the service, on the club’s instructions. If you are a club owner, you enquire about Klubo, or you visit getklubo.com, Klubo is responsible for your data.
1. What is collected
- Identity and contact: name, email address, phone number, and the username you choose to sign in with. For a child, the parent’s or guardian’s name and email.
- Profile details your club may record: date of birth, gender, address, handedness, level or school level, and the club’s own notes.
- Emergency contact: a name, relationship and phone number, so the club can reach someone if something happens at training.
- Medical notes (optional): health conditions or allergies that you or your club choose to record, so coaches can act safely. They are seen only by your club’s staff (including coaches) and by you or your family login. They are never put in emails, notifications or analytics, and never shared with other clubs.
- Membership and training: your packages and sessions left, classes you are enrolled in or book, attendance marked by coaches, “can’t come” notices, make-up credits and private lessons.
- Payments: invoices, amounts, due dates, status, PayNow payment claims, shop orders and receipts. If you pay by card, or let your club charge a saved card automatically, the card is handled and stored by Stripe. Klubo and your club never see or store your full card number.
- Account: your sign-in, when you accepted this policy, and, for a family login, which children’s profiles your login can open.
- Notifications (optional): your phone’s push address, if you turn notifications on. It is removed when you turn them off or delete your account.
- Technical information: if the app hits an error, a report of which screen it was on, what went wrong, the app version and the type of device or browser, used only to fix problems. Visits to the website and app are counted with Vercel Web Analytics, which uses no cookies and does not identify you.
- Club owners and enquirers (Klubo is responsible): your name, contact details and club details when you sign up or enquire, including through a Facebook or Instagram lead form; your Health Check answers; and member lists your club sends Klubo to import. The sign-up page uses Cloudflare Turnstile to check that you are a person, not a bot.
2. Why it is used
- To run your training: schedules, bookings, attendance, packages and private lessons.
- To take and record payments, send receipts and remind you when something is due.
- To keep members safe: emergency contacts and medical notes are there for the people looking after you at training.
- To send club notices and replies to your questions, by app notification or email.
- To keep the service secure and working, and to fix errors.
- To meet legal and tax obligations, such as keeping payment records for the period Singapore law requires.
Your data is never sold. Members’ data is not used to market Klubo, and children’s data is never used for marketing or profiling.
3. Who handles it, and where
Klubo uses these service providers. Each one handles data only to provide its part of the service.
- Supabase (Singapore): database, sign-in and file storage, which holds all member data.
- Vercel (global network, USA): hosts and delivers the app and website; anonymous page-view counts.
- Stripe (USA, EU, Singapore): card payments and saved cards.
- Resend (USA): sends emails such as sign-in codes, receipts, reminders and notices.
- Apple and Google (USA): deliver app notifications to your phone.
- Cloudflare (global network): the bot check on the club sign-up page only.
- Meta (USA): only if you answer a Klubo ad form on Facebook or Instagram.
Where data is handled outside Singapore, Klubo requires protection comparable to the PDPA, as the PDPA’s transfer rules require. Data is also shared with Singapore authorities where the law requires it. PayNow transfers go between your bank and the club, not through Klubo.
4. How it is protected
Each club’s data is kept separate at the database level, so no club can see another club’s records. Members can see only their own records (or their family’s, on a family login), and only authorised club staff can see the member list. Data is encrypted in transit and at rest. Passwords are stored as one-way hashes and nobody can read them. Klubo staff who can reach live data use two-factor sign-in.
5. How long it is kept
| Data | Kept |
|---|
| Your account and profile | While you are a member of the club |
| Medical notes, emergency contact, address, date of birth | Cleared as soon as you delete your account |
| Name, contact details, payment and attendance records | Up to 5 years after you leave, as Singapore tax law requires; then erased |
| Your sign-in and notification address | Deleted as soon as you delete your account |
| App error reports | 90 days |
| Member lists sent to Klubo for import | Deleted within 30 days of the import |
| A club’s data when it leaves Klubo | Deleted within 30 days; backups overwritten within 90 days |
6. Your rights
- See your data in the app’s Profile screen, or download a copy: Profile → Privacy → Download my data.
- Correct your details in your profile, or ask your club.
- Delete your account: Profile → Privacy → Delete my account. Your sign-in is deleted and your profile is removed from the club’s lists straight away. Medical notes, emergency contact, address and date of birth are cleared at the same moment. Payment and attendance records stay with your club for the period in section 5.
- Withdraw consent to non-essential messages at any time. Withdrawing consent to the records needed to run your membership will end it.
Requests for access or correction are answered within 30 days. If you contact Klubo about data your club holds, Klubo passes your request to the club and helps it reply.
7. Children
Most members are children. For a member under 18, a parent or guardian gives consent and normally holds the login; one family login can open each of their children’s profiles. The parent or guardian can see, download, correct or delete their child’s data in the same way as their own. Children’s data is never used for marketing, profiling or automated decisions.
8. If something goes wrong
If personal data is accessed, lost or disclosed without authority, Klubo tells the affected club within 72 hours of becoming aware. Where the breach is likely to cause significant harm (health information always counts), the Personal Data Protection Commission is notified within 3 calendar days of the assessment, and the people affected are told as soon as practicable, as the PDPA requires.
9. Changes to this policy
When this policy changes, the date at the top changes. If a change affects what is collected or who it is shared with, you will be told in the app or by email before it applies.
10. Contact
Questions, requests or complaints: please email hello@getklubo.com, which reaches Klubo’s Data Protection Officer, appointed under section 11 of the PDPA. Please include your full name and the email or username you sign in with. If you are not satisfied with the reply, you may contact the Personal Data Protection Commission (pdpc.gov.sg).
How Klubo is secured (where data lives, who can reach it, what is checked) is at getklubo.com/security.
Klubo (operated by Allyvate Pte Ltd) · UEN 201934150N