Skip to content
Dead Man's Clique
DRAFT — PENDING LEGAL REVIEW

Privacy Policy

Last updated: 2026-06-19

DRAFT — final wording is pending legal review. The processor list, data categories, and retention windows below match the live product. Email hello@deadmansclique.com with any questions in the meantime.

1. Who we are

Dead Man's Clique is a fitness, lifestyle, and culture brand based in Dubai, United Arab Emirates. We operate the website deadmansclique.com and the related membership service. This Privacy Policy describes how we handle personal information when you visit the site, sign up for a membership, attend sessions, or interact with our sponsor-partner programme.

2. What we collect

We only collect what we need to run the service. The categories below are exhaustive — we do not collect device fingerprints, ad identifiers, or social-graph data.

  • Account. Email address and name, managed by Clerk (our authentication provider). Optional sign-in factors you choose (e.g. social login) are also handled by Clerk.
  • Membership. Subscription status (active, past_due, cancelled) and billing period dates. The subscription record lives in Stripe; we mirror the status flag into Clerk publicMetadata and into your Sanity member_profile document so the app can gate access without round-tripping to Stripe on every request.
  • Profile (optional). The fields you fill in at /account/profile: profile photo, training goals, emergency contact details, and waiver acknowledgement. You can edit or remove these at any time.
  • Usage. Pages you visit on this site, your booking history, attendance scans, and sponsor-discount redemptions. We use this to deliver the service and to keep session capacities honest.
  • Cookies and local storage. A Clerk session cookie (signs you in), a dmc_ref referral cookie that lasts 30 days when you arrive via a referral link, and small localStorage entries used to remember your UI preferences. See §9.

3. How we use it

  • Provide the service. Authenticate you, gate member-only routes, accept bookings, run the verify-QR door flow, and process payments through Stripe.
  • Transactional email. We send booking confirmations, waitlist promotions, cancellation receipts, and membership notices via Resend. You can opt out of optional member emails at /account/profile; statutory notices (e.g. billing issues) cannot be turned off while your subscription is active.
  • Prevent abuse. We rate-limit critical endpoints and log webhook events to detect duplicate or hostile traffic. These logs hold IP addresses and request signatures only.

4. Third parties

We use a small set of processors. Each receives only the data needed for its function. Their own privacy policies are authoritative for how they handle that data — they are listed on each processor's website.

  • Clerk — authentication, sessions, MFA. Stores your email, name, and password hash.
  • Stripe — payment processing, subscription billing, and the hosted customer portal. Stores your card details — never us.
  • Sanity — content management system that holds your member_profile, bookings, attendance audit, and content.
  • Shopify — powers the store at /store. If you check out, Shopify receives your shipping and order details.
  • Resend — transactional email delivery. Receives recipient address + email body.
  • Vercel — hosts the site and runs server functions. Sees standard HTTP request metadata (IP, user-agent, path) in access logs.

We do not sell or rent your personal information. We share it with third parties only as described above or where required by law.

5. Your rights

If you live in the UAE the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) gives you the rights described below. If you live in the European Economic Area the GDPR gives you a broadly equivalent set of rights. Either way, you can:

  • Access the information we hold about you.
  • Correct anything that is wrong or out of date.
  • Ask us to delete your account and associated data.
  • Receive a portable copy of your data in a machine-readable format.
  • Withdraw consent for optional processing at any time.

Send requests to hello@deadmansclique.com. We respond within 30 days.

6. Data retention

We hold your account data for as long as your subscription is active, plus 12 months after cancellation so you can reactivate without losing your booking and attendance history. After that window we delete or anonymise your record. Aggregated, non-identifying analytics (e.g. how many bookings a given session takes per week) may be kept indefinitely.

7. Security

Passwords are managed by Clerk — they never touch our servers. Payment cards are handled directly by Stripe — same story. Everything between your browser and our servers travels over HTTPS. We follow defence-in-depth on protected routes (middleware gate + handler-level auth check) so a single layer cannot leak member data.

8. Children

Dead Man's Clique memberships are for people aged 16 and over. We do not knowingly collect data from anyone under 16. If you believe a minor has signed up, email us and we will close the account.

9. Cookies

We use the minimum cookies needed to run the service:

  • Clerk session cookies — keep you signed in. Strictly necessary.
  • dmc_ref — a 30-day cookie set when you arrive via a referral link. Lets us credit the right person if you sign up.
  • Preferences in localStorage — small UI choices (e.g. dismissed banners). Lives only in your browser.

We do not use third-party advertising or analytics cookies.

10. Changes to this policy

If we change anything material we will email active members at least 30 days before the change takes effect and show a banner at the top of this page for the same window. The Last updated date above always reflects the most recent change.

11. Contact

Privacy questions, data requests, or anything else: hello@deadmansclique.com.

→ Terms of Service→ Contact