PRIVACY POLICY

Last Updated: June 7, 2026

This Privacy Policy explains how Winkle Co. Pty Ltd (trading as Club Winkle), ACN 650 970 380, ABN 73 650 970 380 ("Club Winkle", "we", "us") collects, uses, shares and protects personal information when you use clubwinkle.com.

If you are in the European Economic Area or the United Kingdom, Club Winkle is the data controller for the purposes of the General Data Protection Regulation ("GDPR") and the UK GDPR.

Who we are & how to contact us

Winkle Co. Pty Ltd (trading as Club Winkle)
Suite 2259 Shop 1, 5 Flynn Street
Churchlands, WA 6018
Australia
Privacy enquiries: [email protected]

Information we collect

We collect the following categories of personal information:

Account information — name, email address, and password (stored hashed) when you create an account.
Billing information — billing name, billing address, and the last four digits and card brand of your payment card. Full card numbers are entered directly with our payment processor (Stripe) and are not stored on Club Winkle servers.
Transaction information — the subscriptions, content sets, photo singles, tips and credits you purchase; amounts; dates; refund and dispute history.
Usage information — pages you visit on the site, content you view, search queries, and similar interaction data, collected via Fathom Analytics.
Device and connection information — IP address, browser type, device type, operating system, and approximate location derived from IP.
Communications — the content of messages you send us, including creator messaging, support requests, and content-related reports.
Compliance records — records relating to your consent to these policies, age verification, and (for creators) identity and model-release documentation, where applicable.

How we use your information

We use personal information to:

Provide, secure, and operate the service, including processing payments and renewals.
Authenticate you and protect your account.
Respond to support enquiries, refund requests, and rights-related requests.
Detect, investigate, and prevent fraud, abuse, and security incidents.
Comply with our legal obligations, including tax, accounting, and content-safety obligations.
Improve the service using aggregated, privacy-friendly analytics.
Send service messages (e.g. billing receipts, security alerts, policy updates).

Legal bases for processing (EEA / UK)

Where GDPR or UK GDPR applies, we rely on the following legal bases:

Performance of a contract — to provide the service, process payments, and manage your subscription.
Legitimate interests — for site security, fraud prevention, and basic privacy-friendly analytics, balanced against your interests.
Legal obligation — to retain billing records and respond to lawful requests.
Consent — for any non-essential cookies (where required) and any direct marketing you opt into. You can withdraw consent at any time.

Who we share information with

We do not sell your personal information. We do not publish subscriber lists or share your subscription status with third parties for marketing. We share limited information only with the service providers we need to run the service. Each is bound by contract to keep your information confidential and to use it only for the purpose we engage them for.

Provider	What we use them for	What we share with them
Stripe	Payment processing — subscriptions, one-time purchases, tips, and refunds.	Cardholder name, billing address, and the last four digits and brand of your card. Full card numbers are entered directly with Stripe and never reach Club Winkle servers. We also share your account email and a Club Winkle customer ID so each payment can be matched to your account.
Cloudinary	Storing and delivering the photographic content that makes up the service.	The content images themselves. We do not send your name, email, billing address, or subscription status to Cloudinary.
Postmark	Sending transactional email such as receipts, password resets, and account notifications.	Your email address and the content of the email we are sending you. We do not use Postmark for marketing.
Pusher	Realtime messaging on the site, such as creator chat and live notifications.	The content of realtime messages and the channel you are connected to (which is tied to your account). No card or billing data is sent to Pusher.
Vercel	Hosting clubwinkle.com.	As our hosting provider, all HTTP traffic to clubwinkle.com necessarily passes through Vercel — including your IP address, browser headers, session cookies, and the page you are loading. We do not send any additional information separately to Vercel.
Sentry	Diagnosing technical errors so we can fix them.	Browser type, the URL where the error occurred, the error message and stack trace, and (where it helps us reproduce the bug) your Club Winkle user ID. We do not send card data, passwords, or message contents to Sentry.
Fathom Analytics	Aggregate, privacy-friendly site analytics.	A truncated IP address, the URL of the page you visited, the referrer, and basic screen-size information. Fathom does not use tracking cookies, does not identify individuals, and does not link visits to your account.
Algolia	Powering search on the site.	Your search query, plus the searchable content catalogue (creator profiles, content sets, and tags). We do not send subscriber names, emails, or billing data to Algolia.

We may also disclose information where we are legally required to do so (for example in response to a valid court order or law-enforcement request), or where it is necessary to protect the rights, property, or safety of Club Winkle, our users, or the public.

International data transfers

Club Winkle is based in Australia. Several of our service providers are located in the United States, the European Union, and other regions. When we transfer personal information outside your country we rely on appropriate safeguards, including the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum where applicable. For users in Australia, this section also serves as our disclosure of the cross-border nature of those transfers for the purposes of Australian Privacy Principle 8.

Cookies and similar technologies

We use cookies and similar technologies for three purposes:

Strictly necessary — to keep you signed in, secure your session, and process payments. These cannot be disabled without breaking core functionality.
Functional — to remember your preferences (e.g. dismissed messages).
Analytics — Fathom Analytics, which uses anonymised, cookieless or first-party data and does not track you across other sites. See Fathom’s privacy policy for details.

You can disable cookies in your browser settings. Disabling strictly necessary cookies will prevent you from signing in or completing payments.

Site analytics

We use Fathom Analytics, a privacy-focused analytics service, to understand how visitors use our website in aggregate. Fathom does not use tracking cookies and is not used to build advertising profiles or track you across other websites.

Fathom collects anonymised, aggregated statistics such as page views and referrers so we can improve the site. These figures do not identify individual visitors.
Fathom does not sell visitor data. It operates on a paid subscription model funded by its customers, not by advertising or data resale.
For more information about how Fathom handles data, see Fathom’s privacy policy.

How long we keep your information

Account data — for the life of your account, and then for a reasonable period (typically up to 12 months) to allow account recovery and to resolve disputes.
Billing and transaction records — at least 7 years, to meet Australian tax and accounting obligations.
Communications and support records — typically up to 3 years.
Compliance and safety records — for as long as required by applicable law.

Your rights

Subject to local law you have the right to:

Access the personal information we hold about you.
Correct inaccurate or incomplete information.
Request deletion of your information (subject to records we are legally required to keep).
Object to or restrict certain processing, including processing based on legitimate interests.
Receive a portable copy of information you have provided to us, where GDPR or UK GDPR applies.
Withdraw consent at any time where we rely on consent.
Lodge a complaint with your data-protection regulator — in Australia, the Office of the Australian Information Commissioner; in the UK, the Information Commissioner’s Office; in the EU, your national supervisory authority.

To exercise any of these rights, email [email protected]. We may need to verify your identity before acting on a request.

Children’s privacy

Club Winkle is intended only for adults aged 18 and over. The service is not directed to children, and we do not knowingly collect personal information from anyone under the age of 18. If you believe a child has provided us with personal information, please contact us and we will take steps to delete it.

Security and data-breach notification

We protect personal information using commercially reasonable technical and organisational measures, including encrypted connections, hashed passwords, restricted access to production systems, and use of reputable cloud infrastructure. No system can be guaranteed completely secure.

If we become aware of a personal-data breach that is likely to result in serious harm, we will notify affected individuals and the relevant regulator in line with the Australian Notifiable Data Breaches scheme and, where applicable, Articles 33 and 34 of the GDPR / UK GDPR.

External links

Our website may link to external sites that are not operated by us. We have no control over the content or practices of those sites and cannot accept responsibility for their privacy policies.

Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced on the site or by email. The current version applies from the date shown at the top of this page.

Contact us about privacy

For any privacy question, complaint, or rights request, email [email protected].

In plain language

Payment processing & service providers

Payment card details are securely processed by our payment provider (Stripe) and are not stored on Club Winkle servers. We may also use privacy-focused analytics (Fathom) and infrastructure providers to operate the site securely.

Billing discretion

We do not publish subscriber lists or share your subscription status with third parties for marketing. Charges may appear on your statement under Club Winkle or a similar billing identifier. We collect only the billing and account information needed to manage your subscription, process payments, and resolve disputes.

Legal bases for processing (EEA/UK)

Where GDPR applies, we process personal data on the following bases: performance of a contract (e.g. managing your subscription), legitimate interests (e.g. site security and basic analytics), legal obligation where required, and consent (e.g. for any non-essential cookies you opt in to).

Retention & your rights

We keep your account and billing records for as long as needed to provide the service and to meet our legal obligations — for example, Australian tax law requires us to keep billing records for at least seven years. You may request access, correction, or deletion of your personal data, or object to certain processing, by contacting [email protected].