Compliance

Card payments on SplitClub are processed by Stripe, which is certified as a PCI Service Provider Level 1, the highest level under the Payment Card Industry Data Security Standard (PCI DSS).

Cards are entered only in Stripe's own forms (the payment sheet in the app, Stripe Elements and Stripe Checkout on the web), so card numbers go straight to Stripe. SplitClub's own systems don't receive, store or transmit full card numbers or security codes. We keep the card brand, last four digits and payment status that Stripe gives us. See Security.

Stripe holds and moves the money. When you pay on SplitClub, the payment is made to SplitClub through Stripe (SplitClub is the merchant of record, as our Terms explain). Businesses are paid out through Stripe Connect to their own Stripe account.

Stripe checks who businesses are. Before a business can be paid, Stripe collects and verifies the identity, ownership, tax and bank details the law requires (often called KYC, “know your customer”). Stripe, not SplitClub, keeps those documents. Stripe also screens payments for fraud.

Your SplitClub wallet is SplitClub's record of money credited to you, such as returns from splits that didn't fill. The money behind it is held in SplitClub's Stripe account. SplitClub is not a bank: the wallet isn't a bank account, earns no interest, and isn't insured by the FDIC or any government agency. Withdrawals go to your bank through Stripe after Stripe verifies your identity, and we may hold or limit a withdrawal while we check it for fraud. The rules are in our Terms, section 8.

California (CCPA, as amended by the CPRA) and a growing number of other states (including Colorado, Connecticut, Virginia, Texas, Oregon and Florida) give residents rights over their personal information. Where these laws apply, you can ask us to:

• tell you what personal information we have about you, and give you a copy;
• correct it;
• delete it.

We don't sell lists of members or their contact details to anyone. Google Analytics on splitclub.com runs with Google signals and ad personalization turned off. Our iOS app includes Meta's SDK, which tells Meta when the app is installed and opened and when someone signs up or pays (with the amount), so we can measure our ads on Meta. It doesn't send your name, email or phone number, and there's no tracking prompt, so it can't read your device's advertising identifier. We won't treat you differently for using your rights.

To make a request, email privacy@s7vc.com from the email on your account, or delete your account in the app. We verify requests before acting on them, answer within the time the law sets, and accept requests from an authorized agent where the law allows. What we collect and why is in our Privacy Policy.

SplitClub is live in European destinations including Madrid, Barcelona, Ibiza, Milan, Capri, Amalfi, Cannes, Saint-Tropez and Mykonos. If you use SplitClub from the European Union or the United Kingdom, the GDPR (and the UK GDPR) applies to how we handle your personal data, and S7 Managed Reserves Fund is responsible for it as the controller.

Why we use your data (our lawful bases):

• To provide SplitClub to you (contract): your account, splits, bookings, payments, messages and check-ins.
• With your consent: location, contacts, push notifications, “Suggest me for open seats” and the AI assistant. You can withdraw consent at any time in the app or your device settings.
• Our legitimate interests: keeping SplitClub safe, preventing fraud, scraping and abuse, fixing errors, improving the service, and telling you about SplitClub by email (you can unsubscribe from any marketing email).
• Legal obligations: tax and accounting records, and answering lawful requests.

Your rights. You can ask to access your data, correct it, delete it, restrict or object to how we use it, and receive it in a portable format. Email privacy@s7vc.com. You can also complain to the data protection authority where you live.

International transfers. Your data is stored in the United States. The providers that process it for us (listed on our Service providers page) offer data processing terms that use the European Commission's Standard Contractual Clauses, and several, including Stripe, Vercel and Google, are also certified under the EU-U.S. Data Privacy Framework.

SplitClub is not for anyone under 18, and nightlife events are 21+. We ask for your date of birth and for you to confirm you're 18 or older, and keep a record of that confirmation. We don't knowingly collect personal information from children. If you believe a child has an account, email privacy@s7vc.com and we'll close it and delete the information.

Email (CAN-SPAM). Account email, such as sign-in links, receipts and booking updates, is sent because you use SplitClub. Marketing email, such as our weekly roundup, says it's from SplitClub and carries an unsubscribe link and a one-click unsubscribe your email app can use. When you unsubscribe, we stop sending you marketing email. Turning off “News & offers” in the app does the same.

Texts (TCPA). We don't send marketing texts. The only texts are the sign-in codes you ask for, sent by Google Firebase. When you invite someone by text, the message is sent from your own phone's Messages app, by you.

Push notifications are sent only if you allow them, and you can turn them off in your device settings.

We want everyone to be able to use SplitClub, and we aim to follow the Web Content Accessibility Guidelines (WCAG) on our website and Apple's accessibility guidelines in the app. If something is hard to use, tell us at business@splitclubapp.com and we'll help.

If you believe content on SplitClub infringes your copyright, email business@splitclubapp.com with the subject “Copyright notice”, as our Terms say. Include:

• the work you believe is infringed;
• where the content is on SplitClub (a link or screenshot);
• your name, address, phone number and email;
• a statement that you believe in good faith the use isn't authorized, and that your notice is accurate and you are the owner or authorized to act for them;
• your physical or electronic signature.

We review notices and may remove or disable the content, and close the accounts of people who repeatedly infringe. If your content was removed and you believe that was a mistake, email the same address to explain.

We give personal information to police, courts or government agencies only when the law requires it, for example under a valid subpoena, court order or warrant, and only what the request legally requires. In an emergency involving a risk of death or serious injury, we may share what is needed to prevent it.

Requests go to privacy@s7vc.com.

Stripe collects the tax details a business needs to give (such as a taxpayer ID) when it sets up payouts. Where US tax law requires it, we'll issue tax forms (for example a Form 1099) for amounts paid to a business, as our Business Terms say. Businesses are responsible for their own taxes, including sales, hotel and amusement taxes on what they sell, and prices on SplitClub show the taxes and charges a business or the law requires.

We keep payment and booking records, without your name or contact details once you delete your account, for as long as tax and accounting rules require. We keep a record of your age confirmation (without your date of birth) for three years after you delete your account. Every wallet balance change is logged. The full list of what we keep and for how long is in our Privacy Policy.