Privacy Policy

1. Scope and Application

1.1 Who this applies to. This Policy applies to visitors, registered Studio users, and anyone who contacts us through Platform channels.

1.2 Relationship to Terms. Use of the Platform is also governed by our Terms of Service. Capitalized terms not defined here have the meanings given in the Terms.

1.3 Changes. We may update this Policy periodically. Material changes will be posted on clubbaddie.comwith an updated "Last Updated" date. Continued use after changes constitutes acknowledgment of the revised Policy.

2. Information We Collect

2.1 Account and profile data. When you register, we collect identifiers such as email address, display name, account role, and authentication tokens managed through our identity provider.

2.2 Studio content. We process character profiles, posts, stories, vault assets, generation prompts, reference imagery, and configuration data necessary to operate Studio.

2.3 Usage and device data. We automatically collect technical information such as IP address, browser type, operating system, device identifiers where available, referring URLs, pages viewed, and interaction events for security, analytics, and product improvement.

2.4 Payment-related data. We receive limited billing metadata from payment processors (transaction IDs, amounts, currency, payment status, last four digits where provided). We do not store full card numbers on our servers.

2.5 Cookies and local storage. We use cookies, session storage, and similar technologies for authentication, theme preferences, and security. See Section 10 for details.

2.6 Information from third parties. We may receive information from authentication providers, payment processors, and infrastructure vendors strictly as needed to deliver the Services.

3. How We Use Information

We process personal information for the following purposes:

• Creating and administering your account and session.
• Delivering Studio tools, AI generation, and billing features.
• Processing payments and maintaining transaction records.
• Detecting, preventing, and investigating fraud, abuse, and security incidents.
• Enforcing our Terms and legal obligations.
• Providing customer support and responding to inquiries.
• Monitoring performance, debugging errors, and improving reliability.
• Generating aggregated or de-identified analytics that do not identify you.
• Complying with court orders, lawful requests, and regulatory requirements.

We do not sell your personal information to data brokers or use it for third-party behavioral advertising networks.

4. Legal Bases for Processing

Where applicable privacy law requires a legal basis, we rely on: (a) performance of our contract with you; (b) legitimate interests in securing and improving the Platform, preventing abuse, and operating our business, balanced against your rights; (c) compliance with legal obligations; and (d) consent where explicitly obtained, such as optional marketing communications if offered.

5. How We Share Information

5.1 Service providers. We share data with vendors who assist with hosting, database operations, content delivery, email delivery, authentication, payment processing, AI inference, and customer support. These providers are authorized to process data only as instructed and subject to contractual confidentiality and security obligations.

5.2 Business transfers. If we undergo a merger, acquisition, or asset sale, personal information may transfer as part of that transaction subject to continued protection consistent with this Policy.

5.3 Legal and safety disclosures. We may disclose information when we believe in good faith that disclosure is necessary to comply with law, respond to valid legal process, protect the rights and safety of users or the public, or investigate fraud or security issues.

5.4 No sale of personal data. We do not rent, sell, or trade personal information to third parties for their independent marketing purposes.

6. International Data Transfers

Our infrastructure providers may process data in countries other than your own, including the United States and other jurisdictions where our subprocessors operate. Where required, we implement appropriate safeguards such as standard contractual clauses or equivalent mechanisms recognized under applicable law.

7. Data Controller

Personal information collected through clubbaddie.com is processed by Ghost Coin Limited (trading as Club Baddie) as the data controller responsible for the processing activities described in this Policy.

8. Data Retention

8.1 General rule. We retain personal information for as long as your account is active or as needed to provide Services, comply with legal obligations, resolve disputes, and enforce agreements.

8.2 Deletion. When you delete your account, we delete or anonymize personal data within a reasonable period, except where retention is required for legal, security, or backup integrity purposes.

8.3 Logs. Security and server logs may be retained for a limited period before automatic rotation or deletion.

8.4 Backups. Residual copies in encrypted backups may persist temporarily until those backups expire according to our retention schedule.

9. Security Measures

We implement administrative, technical, and organizational measures designed to protect personal information, including encrypted transport (HTTPS), access controls, and monitoring for anomalous activity. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

You are responsible for maintaining the confidentiality of your credentials and for logging out on shared devices.

10. Cookies and Similar Technologies

10.1 Essential cookies. Required for login sessions, CSRF protection, and core functionality. The Platform may not work correctly if you disable them.

10.2 Preference cookies. Store choices such as theme (light or dark mode) to improve your experience.

10.3 Analytics. We may use first-party or privacy-conscious analytics to understand feature usage. We do not deploy invasive cross-site advertising trackers.

10.4 Browser controls. Most browsers allow you to block or delete cookies. Blocking essential cookies may limit Platform functionality.

11. AI and Automated Processing

Prompts and reference inputs you submit for image or text generation are processed by automated systems and may be transmitted to third-party AI providers under data processing agreements. Do not submit sensitive personal information you do not want processed for generation.

We may use automated tools to detect spam, abuse, or policy violations. Significant decisions with legal or similarly significant effects are not made solely by automated means without human review where required by law.

12. Your Rights and Choices

Depending on your jurisdiction, you may have rights to access, correct, delete, restrict, or object to certain processing of your personal information, and to data portability where technically feasible.

New Zealand users may have rights under the Privacy Act 2020, including the right to access personal information we hold about you and to request correction. We will respond to verified requests within timeframes required by applicable law.

To exercise rights, use in-app account controls where available or contact us through support channels on clubbaddie.com. We may need to verify your identity before fulfilling requests.

13. Age Restriction

The Platform is intended only for individuals aged eighteen (18) or older. We do not knowingly collect personal information from minors. If we learn that an account belongs to someone under the age of majority, we will promptly disable the account and delete associated personal data where appropriate.

Registration requires self-certification of eligibility. We do not operate a standalone government ID verification program for age assurance.

14. Third-Party Links and Services

The Platform may contain links to third-party websites or integrations (such as payment checkout). This Policy does not apply to those third parties. Review their privacy policies before providing information to them.

15. Contact and Complaints

For privacy questions, access requests, or complaints, contact us through the support options available on clubbaddie.com. If you are unsatisfied with our response, you may have the right to lodge a complaint with the Office of the Privacy Commissioner in New Zealand or another competent supervisory authority in your jurisdiction.

Last updated: June 2026