Draft, not legal advice.
Privacy Policy: What We Know About You (Not Much, On Purpose)
The Tired & Fed Up Club · https://tfu-club.pages.dev Last updated: 31 October 2026
We'd rather be napping than collecting your data, so we collect as little as we can. This policy explains what we do collect, why, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
The Tired & Fed Up Club ("the Club", "we", "us") is run by Sam G. Kenway, a sole trader in the United Kingdom, who is the data controller for your personal data.
2. What we collect
| Data | When | Why |
|---|---|---|
| Name or display name you choose for your card | When you join | To produce your membership card |
| Email address | When you join or buy | To send your card, receipts, renewal reminders and service messages |
| Membership number (TFU-####-####), tier, join and renewal dates | When you join or upgrade | To run your membership |
| Payment details | When you pay | Processed by Stripe. We never see or store your full card number. We receive limited details (e.g. card brand, last four digits, payment status) |
| Gift details: purchaser name and email, recipient name and email, optional message | When you buy a gift | To deliver the gift and handle any queries |
| Messages you send us | When you contact us | To reply |
| Technical data (IP address, browser type, request logs) | When you visit the site | To keep the site secure and working, via Cloudflare |
| Anonymous usage counts: daily totals of visits and actions (such as joining, upgrading or redeeming a gift), and error messages with personal details stripped. No IP address, cookie or identifier is attached | When you use the site | To see whether the site works and is used. Kept for about 400 days |
| Cloudflare Web Analytics | When you visit the site | We also use Cloudflare Web Analytics, which does not use cookies, to count visits and see which pages are read. It does not identify you. |
We do not knowingly collect special category data, and we ask you not to put sensitive information on your card or in messages.
3. Our lawful bases
- Contract (Article 6(1)(b)): to create your membership, issue your card, take payment, renew paid tiers and deliver gifts.
- Legal obligation (Article 6(1)(c)): to keep financial and tax records.
- Legitimate interests (Article 6(1)(f)): to keep the site secure, prevent fraud, answer enquiries and send essential service messages. We have balanced these interests against your rights.
- Consent (Article 6(1)(a)): for any optional marketing emails. You can withdraw consent at any time with the unsubscribe link or by emailing us.
When you buy a gift, you confirm the recipient is happy for you to give us their name and email address so we can deliver the gift.
4. Who we share data with (our processors)
We do not sell your data. We share it only with service providers acting on our instructions:
- Stripe (Stripe Payments Europe Ltd and its affiliates): payment processing, fraud prevention and the self-service customer portal used to manage or cancel paid memberships. Stripe is also an independent controller for some data it needs for legal and anti-fraud purposes. See https://stripe.com/gb/privacy.
- Cloudflare, Inc.: website hosting (Cloudflare Pages), content delivery and security. See https://www.cloudflare.com/privacypolicy/.
- Grok Bot mail (mail.grokbot.com): sending membership and service emails.
We may also disclose data where the law requires it, for example to HMRC or in response to a lawful request.
5. International transfers
Stripe and Cloudflare may process data outside the UK, including in the United States. Where they do, transfers rely on UK adequacy regulations (including the UK–US "data bridge" where the recipient is certified) or the International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses.
6. How long we keep data
- Membership data: for as long as you are a member, then deleted within 12 months of your membership ending or you asking us to close it.
- Payment and transaction records: 6 years from the end of the tax year they relate to, as UK tax law requires.
- Gift records: until the gift is redeemed or expires, then as for transaction records.
- Correspondence: up to 2 years after the matter closes.
- Server and security logs: kept by Cloudflare under its own retention periods, generally short.
- Anonymous usage counts: about 400 days, then deleted automatically.
7. Cookies
We use only cookies that are strictly necessary for the site to work and for security (including those set by Cloudflare and, at checkout, by Stripe). These do not need consent under the Privacy and Electronic Communications Regulations 2003 (PECR). If we ever add analytics or other non-essential cookies, we will ask for your consent first and update this policy.
8. Your rights
Under UK GDPR you have the right to:
- access your personal data;
- rectify inaccurate data;
- erase your data ("right to be forgotten");
- restrict processing;
- object to processing based on legitimate interests, and to all direct marketing;
- data portability;
- withdraw consent at any time, where we rely on consent.
To use any of these rights, email tiredfedupclub@mail.grokbot.com. We will respond within one month, and we do not charge a fee in normal cases. We may need to confirm your identity first. Some rights are limited, for example we must keep tax records even if you ask us to erase them.
9. Complaints
Please contact us first so we can try to put things right. You also have the right to complain to the Information Commissioner's Office (ICO):
- Website: https://ico.org.uk/make-a-complaint/
- Phone: 0303 123 1113
- Address: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
10. Children
The Club is for people aged 13 and over. Only people aged 18 or over may buy paid tiers or gifts.
11. Security
We use reputable providers, encrypted connections (HTTPS) and limited access to keep your data safe. No system is perfectly secure. If a breach is likely to put your rights at risk, we will tell you and the ICO as the law requires.
12. Changes to this policy
If we make a significant change to this policy, we will update the date above and tell members by email.