Privacy Policy

Who this policy covers

This policy covers the ClubGate customer Android app and public website at clubgate.kurbs.in. ClubGate is presented on this site as a product by Kurbs. It does not cover a club’s own website, venue systems or independent privacy practices.

The separate ClubGate CRM serves club staff. Staff-account retention and deletion require an organizational review and are not handled by the customer deletion tool.

Information we collect

Code and database review confirms that the customer service can store:

• Account details: full name, email address, mobile number, encrypted password hash, account status and account timestamps.
• Optional profile details: birth date, gender, city, Instagram handle and profile-photo URL.
• Reservation details: venue, booking type, date and arrival time, guest counts, contact name and encrypted phone number, notes, promoter or event selection, status and reservation reference.
• Entry-pass details: a cryptographically protected token, pass status and check-in time.
• Security details: session token hashes, expiry and last-seen time, user agent and IP address.
• Support requests: name, email, category, message, status and reference.
• Deletion records: one-way hashes of account identifiers, request status, source, timestamp and reference.

The current customer app does not request camera or location permissions. The public browser demo can request location only after the visitor selects its location action and keeps demo state in session storage.

How we use information

• Create and secure customer accounts and sessions.
• Show eligible venues, accept reservation requests and issue digital entry passes.
• Let the selected venue review, confirm, manage and check in a reservation.
• Respond to support, privacy and account-deletion requests.
• Prevent abuse, investigate security incidents and keep operational audit records.
• Maintain and improve service reliability using operational data. No customer analytics SDK is present in the audited code.

When information is shared

Reservation details are available to authorized staff of the venue receiving the reservation. This includes the contact name and phone number needed to manage entry, plus booking and pass status. A promoter is associated only when selected for that booking.

Data may also be processed by infrastructure providers needed to host the app, database and private files. The repository does not identify the production hosting vendors, so a vendor list must be confirmed before publication. ClubGate does not include an advertising SDK or code that sells customer data.

Information may be disclosed where required by applicable law, to protect users or the service, or as part of a lawful business reorganization.

Security

Passwords are stored as salted scrypt hashes. Session and entry tokens are stored using hashes; sensitive phone and settlement fields use server-side encryption. Access to venue data is permission- and venue-scoped. Rate limits and input validation protect relevant public and authenticated endpoints.

No system is completely secure. Customers should use a unique password and report suspected account misuse through the support page.

Retention and deletion

Customer sessions are configured to expire after 30 days and can be revoked earlier. When a verified customer deletion succeeds, ClubGate immediately removes the customer account, profile and sessions. It disassociates the customer from reservations, removes reservation notes and contact identity, replaces the contact phone with a non-customer placeholder, and revokes stored entry-pass credentials.

Anonymized reservation facts—such as venue, date, party size, status and amount fields—remain for venue operations and aggregate records. A deletion log containing one-way identifier hashes and a reference remains so the request can be evidenced without retaining the account email. Support requests and operational records are retained only while needed for support, security or legal obligations. The business has not supplied an approved fixed retention schedule; this is listed as a publication blocker in the compliance report.

Your choices and rights

You may request help accessing or correcting your account information through ClubGate Support. You can permanently delete a customer account in the Android app at Profile → Account & privacy → Delete account, or use the public account deletion page.

Privacy rights vary by location. ClubGate will assess verified requests under the laws that apply to the user and the operator. A request may require identity verification.

Age and venue restrictions

ClubGate is a nightlife service and is not directed to children. Venue entry may be restricted by age and local law. Venue listings can contain a minimum-age rule, and venues may require valid government-issued identification. Do not create an account or make a reservation if you are below the age permitted for the relevant service or venue.

Data location

The repository does not identify the production database region or cross-border transfer mechanism. ClubGate must confirm hosting locations and any international transfers before final legal publication. Where transfers occur, the operator will use protections required by applicable law.

Changes and contact

Material updates will be posted here with a revised “Last updated” date. Continued use after an update is governed by the updated notice where permitted by law.

The verified contact channel currently implemented is the ClubGate support form. A legal entity name, registered address, privacy email and grievance contact were not present in the audited repository and must be supplied before Play Store submission.