Privacy

Who is responsible

iClutch is operated by iClutch FZC, a société de zone franche de droit émirati, registered office Business Centre, Sharjah Publishing City Free Zone, Sharjah, Émirats arabes unis, commercial licence no. 300641 issued by the Sharjah Publishing City Free Zone Authority.

For anything on this page — a question, a request, a complaint — write to contact@iclutch.today. It is a real inbox, read by a person, and we answer within thirty days.

In force since 11 September 2026.

What we collect, and why

Your account. Your email address, and your mobile number if you give one. The email is how you sign in and how a booking confirmation reaches you; without it there is no account.

Your date of birth. A capsule with a bunk cannot be sold to a minor. We keep the date, not the document that proved it.

Your bookings. Which capsule, which seat, which hours, what you ordered inside, and what you paid. This is the contract between us; we could not honour it, invoice it, or settle a dispute about it without keeping it.

Your identity, when you book a night. An hour of play asks nothing. A night is a person sleeping in a building, and the law that governs accommodation asks who. See the two sections below — they are the most sensitive thing on this page and they are not buried in a list.

How the door opened. When a lock is used, we record which seat, which card, and when. It is what tells us a booking was honoured, and what answers the question of who was inside when something is broken.

Playing, and what it writes

This half of the product was missing from this page, and it holds as much about you as the booking half does.

Your FACEIT nickname, if you link one. It is what lets us find your finished matches; without it nothing can be counted, and unlinking stops the counting.

Your matches, as FACEIT reports them. The day, the kills, and how many of them counted against the daily ceiling. We read them from their servers after the fact; nothing you type is ever counted.

Your ledgers. Every green and every point of xp, line by line, with the reason and the day. They are not a running total we could quietly adjust: they are a list, and you can read the whole of yours under your account. That is deliberate — a balance is not a proof, a list that adds up to it is.

Your plant, and your drops. Which species you water, how many drops it has taken, and how many bottles that has pulled out of the ocean.

Your tickets and your projects. Which project you funded, when, and the certificate number that came back. A ticket carries a code and the month it belongs to.

Your display name and your avatar, if you set them. They appear on the leaderboard and, if you make your profile public, on a page anyone with the link can open. That is a switch in your settings, and it is yours.

Your identity document

Verification is run by Didit, an identity provider. You are sent to their flow: they read your passport or national ID, check a live person is holding it, and match that face to the photograph on the document.

We never receive the images. Not the document, not the selfie, not the video. What comes back to us is what the document said — the type, the name, the date of birth, the document number — and whether the two checks passed. The images stay with Didit under their own retention.

We accept passports and national ID cards only. A driving licence never enters the flow.

The guest register

Accommodation providers keep a register of who stayed. Ours holds your full name, date of birth, nationality and document number, attached to the booking and the venue, with the moment it was signed.

It is kept for five years, then deleted. Nobody on the floor reads it in passing: it is closed by default, and every time an identity is revealed — to answer a police request, to settle an incident — we record who revealed it and the reason they gave. That log exists so that the question *who looked, and why* always has an answer.

Who else handles it

Stripe takes the payment. Your card number never reaches us — we see the last four digits and the outcome, nothing more.

Didit verifies identity documents, as described above.

Supabase stores the database and runs the sign-in, on infrastructure in the European Union — Ireland. Vercel hosts and serves the site. Resend sends the mail — a confirmation, a code, a receipt.

FACEIT reports your finished matches. We query their API with the nickname you linked; we send them nothing about you.

Greenspark buys the impact when you fund a project, and issues the certificate. What reaches them is the project and the quantity — never who funded it.

Crisp runs the support bubble, and it is loaded only once you are signed in. It receives what is already on your screen: your nickname, your greens, your xp, your level. The conversation you open is the point of it.

If you join the ambassador programme, an account is created for you with our affiliate partner, using the address on your account. It is a button you press; visiting the page signs you up for nothing.

None of them is allowed to use your data for anything but the task we give them.

How long we keep it

The register: five years, then deleted, whatever else happens to the account.

Bookings, orders and invoices: as long as accounting and tax rules require them, because an invoice has to remain verifiable after the fact.

Your account: until you delete it. Deleting it removes your address, your phone and your date of birth; it does not remove an invoice already issued or a register entry already signed, and it cannot — those two are kept because the law says so, not because we want them.

Lock events: they are operational, and they are purged on the venue's own schedule.

What you can ask for

A copy of what we hold about you. A correction, if something is wrong. Deletion, within the limits of the paragraph above. A portable export. And you can object to a use you disagree with.

Write to contact@iclutch.today. We answer within thirty days, and if we refuse we say why.

If our answer does not satisfy you, you can complain to a supervisory authority — in France, the CNIL.

Cookies

We set what the site needs to work: your language, a session so you stay signed in, and the state of the booking you are in the middle of. There is no advertising cookie and no audience-measurement tool anywhere on this site.

One third-party script does run, and only behind the sign-in: the Crisp support bubble, which sets its own cookies. This page used to say there was no third-party tracker at all, which was true of the public site and not of the dashboard.

The Cookie policy names every one of them, so you can open your browser's developer tools and check.

Changes

When this policy changes in a way that matters, we say so — by mail to the address on your account, before the change takes effect. A policy that changes quietly is not a policy.