1. Data controller
POR DEFINIR — razón social, tax ID POR DEFINIR — NIT, domiciled at POR DEFINIR — dirección, Barranquilla, Colombia, is the controller of your personal data.
Channel for anything concerning your data: legal@supremacyclub.com.
2. What we collect
Identification and contact: name, email, username and profile photo (if you upload one).
Profile: city, occupation, bio and goals, when you choose to fill them in.
Health: date of birth, weight and height. These are SENSITIVE DATA (see section 3).
Club activity: habits you log, streaks, experience and progress.
Payment: the blockchain transaction hash and the wallet you paid from. We NEVER have access to your private keys and cannot move funds from your wallet. If you pay by card, the card data is processed by the payment provider; we do not store it.
Technical: session and language cookies (see Cookie Policy).
3. Sensitive data is optional
Health data (weight, height and date of birth) is sensitive under article 5 of Law 1581 of 2012.
YOU ARE NOT REQUIRED TO PROVIDE IT. You can use the club without it. We ask for it only to personalise your habit tracking and progress metrics, and we do not use it for any other purpose nor share it commercially.
You may delete it at any time from your profile, or by asking us at legal@supremacyclub.com.
4. Why we use it
To provide the service: create your account, grant access, show your progress and manage your membership.
To charge you and verify your payments.
To contact you about your membership, expiry reminders and club news.
To meet legal and accounting obligations.
5. Your rights
Access, update and rectify your data.
Request proof of the authorisation you gave us.
Be informed about how your data is used.
File complaints with Colombia's Superintendence of Industry and Commerce (SIC).
Withdraw consent and request deletion, where no legal or contractual duty prevents it.
Access your data free of charge.
6. How to exercise them
Write to legal@supremacyclub.com stating your request and something that identifies you.
Queries are answered within ten (10) business days; complaints within fifteen (15) business days, extendable as allowed by law.
7. Who we share data with
The providers that run the service: authentication (Clerk), database (Neon) and hosting (Vercel). These providers are located in the United States, so your data is subject to international transfer, carried out under adequate security standards.
The payment provider, when you pay by card.
We do not sell your data or share it with advertisers.
8. Blockchain: an honest warning
If you pay in crypto, the transaction is recorded on a public, permanent and immutable blockchain, outside our control.
This means we CANNOT DELETE OR MODIFY that transaction, even if you exercise your right to erasure. What we can delete is the link between that transaction and your identity in our databases.
9. Security and retention
We apply reasonable technical and organisational measures. No system is infallible, but we work to minimise risk.
We keep your data while you are a member and for as long as legal and accounting duties require. After that we delete or anonymise it.