Privacy Policy

1. Controller

Stonedhenge Club ("the Club", "we", "us") is the data controller responsible for your personal data. Contact: info@stonedhenge.club

2. Data we collect

• Membership application: full name, date of birth, email, WhatsApp, document type, document number, document expiry date, a photo of your document and your handwritten signature.
• Account: name, email address, role (member / VIP), session data.
• Newsletter: email address (only after confirmed double opt-in).
• Technical: IP address (for security logging), browser/device info in sessions.
• Analytics: if you accept analytics cookies — the pages you open, an approximate location derived from your IP address (country and city level), your device and browser type, and a random identifier stored in your browser. Analytics data is not used to identify you by name.

Document numbers and signatures are encrypted at rest. Document photos are kept in private storage that is never publicly reachable and can only be opened through a short-lived staff link. Every view of a document is written to the access log.

3. Purpose and legal basis

• Membership management: performance of a contract (GDPR Art. 6(1)(b)). Verifying member eligibility as required by Spanish CSC regulation.
• Identity verification: performance of a contract (GDPR Art. 6(1)(b)) — Spanish cannabis social club rules require us to confirm that every member is an identified adult before granting access.
• Email communications: consent (GDPR Art. 6(1)(a)). You can withdraw consent at any time.
• Security logging: legitimate interest (GDPR Art. 6(1)(f)) — protecting club members and preventing fraud.
• Audience measurement: consent (GDPR Art. 6(1)(a)). We measure how the site is used only after you accept analytics cookies, and you can withdraw that consent at any time in your account settings.

4. Data retention

• Active member accounts: retained while membership is active.
• Membership applications: 2 years from submission date.
• Document number, document photo and signature: erased 30 days after your application is approved or rejected.
• Applications we never review: their document number, photo and signature are erased after 180 days.
• Newsletter subscriptions: until you unsubscribe.
• Security/audit logs: 1 year.
• Google Analytics event and user data: 14 months from your last visit.

5. Your rights

Under GDPR and Spanish LOPD-GDD (Ley Orgánica 3/2018), you have the right to:

• Access your data — request a full export via your account settings or email us.
• Rectification — correct inaccurate data.
• Erasure ("right to be forgotten") — delete your account via settings or email us.
• Restriction — limit how we process your data in certain circumstances.
• Portability — receive your data in machine-readable format (JSON export available in settings).
• Object — object to processing based on legitimate interest.

To exercise any right, contact us at info@stonedhenge.club. We will respond within 30 days.

You may also lodge a complaint with the Spanish data protection authority: AEPD (Agencia Española de Protección de Datos) — aepd.es

6. Data sharing

We do not sell or share your personal data with third parties for marketing. Data is processed by the following sub-processors under GDPR-compliant data processing agreements:

• Supabase (database and file storage) — EU data residency (eu-west-1, Ireland)
• Vercel (hosting) — SOC 2 certified
• Resend (email delivery) — GDPR compliant
• Sentry (error monitoring) — EU region, Germany. Receives technical error reports, which can include your account identifier.
• Upstash (rate limiting) — EU region, Frankfurt. Stores short-lived counters derived from your IP address.
• Cloudflare R2 (off-site backups and inspection-mode snapshots) — backup archives are AES-256 encrypted before upload, so only ciphertext leaves our systems.
• PostHog (product analytics inside the member area) — EU cloud. Only active after you accept analytics cookies.
• Google Ireland Ltd. (Google Analytics, audience measurement on our public website) — processed under Google's GDPR data processing terms. Google may transfer data to servers in the United States under the EU–US Data Privacy Framework and the European Commission's Standard Contractual Clauses. The account-level options that would let Google use this data for its own products and services are switched off, and Google Analytics does not store your IP address — it is used to derive an approximate location and then discarded.
• Groq and Anthropic (AI assistant) — receive the question you type into the assistant. Please do not enter personal details there.
• Telegram (staff alerts) — receives a content-free notification that something needs staff attention; it carries no applicant or member data.

Sub-processors listed above as EU keep your data inside the European Union. Google, Groq and Anthropic process data on servers in the United States; those transfers rely on the European Commission's Standard Contractual Clauses, and for Google additionally on the EU–US Data Privacy Framework.

7. Cookies

We use strictly necessary cookies to keep you signed in. These cannot be switched off — without them the site cannot tell one session from another.

Analytics cookies are set only after you accept them in the cookie banner. Until you accept, no analytics script is loaded at all: we do not load Google Analytics in a “denied” state. If you never answer the banner, we treat that as a refusal.

You can change your mind at any time under Cookie settings in your account, or by clearing this site's data in your browser. Withdrawing consent stops any further collection; it does not erase measurements already recorded — for that, use your right to erasure in section 5.