Privacy Policy

The Archival Club ("we", "us", "the Club") operates the website at thearchival.club and the associated members' area. We are the data controller for the personal data described in this policy under Article 4(7) of the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679).

Contact for privacy matters: [email protected].

We process the smallest amount of data we can get away with:

We do not knowingly collect data from anyone under 16. If you believe a minor has registered, email us and we will delete the account promptly.

• Sell your personal data to advertisers, data brokers or marketplaces.
• Rent, lease, or "exchange" your email with affiliate partners.
• Build advertising profiles or sync identifiers with ad networks.
• Place tracking cookies from Meta, Google Ads, TikTok or similar.
• Disclose what you have bought, requested, or browsed to anyone outside the strict service providers listed in Section 4.

It is in our commercial interest to be the discreet place, not the leaky one.

Your data is shared only with processors strictly necessary to run the service, each bound by a Data Processing Agreement under Art. 28 GDPR:

• Supabase: database & authentication. Data stored on servers located in the EU (Italy).
• Stripe, Inc. (USA): payment processing. Card data handled under PCI-DSS Level 1. Data transferred to the USA under Standard Contractual Clauses (Art. 46 GDPR). See stripe.com/legal/dpa.
• Hostinger: transactional email delivery (SMTP). Servers in the EU.

For international transfers outside the EU/EEA (currently only Stripe), we rely on Standard Contractual Clauses adopted by the European Commission under Art. 46(2)(c) GDPR, which provide equivalent data protection safeguards.

All member data (accounts, orders, waitlist entries, giveaway records) is stored on a dedicated server located in Italy (EU). We self-host our database (PostgreSQL via Supabase) on this infrastructure specifically to keep EU member data within the EU and minimise cross-border transfers. This means we are not subject to additional transfer obligations under Chapter V GDPR beyond those listed in Section 4.

• Account data: for as long as your account exists, plus 30 days after deletion.
• Order & invoicing data: 10 years, as required by EU tax law (statutory obligation under Art. 5(1)(e) GDPR).
• Authentication / security logs: 90 days.
• Waitlist emails: until launch or until you unsubscribe, whichever is sooner.

Under Articles 15–22 of the GDPR you have the right to:

• Access the personal data we hold about you (Art. 15).
• Rectify inaccurate data (Art. 16).
• Erase your data, the "right to be forgotten" (Art. 17).
• Restrict or object to processing (Arts. 18, 21).
• Receive your data in a portable format (Art. 20).
• Lodge a complaint with your local supervisory authority (Art. 77). Italian residents may contact the Garante per la Protezione dei Dati Personali at garanteprivacy.it.

To exercise any right, email [email protected]. We respond within 30 days as required by Art. 12(3) GDPR.

In line with Article 32 GDPR we apply technical and organisational measures appropriate to the risk:

• TLS 1.3 in transit, AES-256 at rest.
• Row-Level Security on every database table: by default you can only see your own rows.
• Passwords hashed with bcrypt; we never see them in plain text.
• Two-factor authentication on every administrative account.
• Least-privilege access: most of our team cannot read member data at all.
• Quarterly review of access logs and dependencies.

We use only strictly necessary cookies: specifically, a session cookie to keep you logged in. We do not use advertising cookies, tracking pixels, or analytics that identify you personally. No cookie consent banner is shown because we do not set any non-essential cookies.

If we update this policy in a way that materially affects your rights, we will email you at least 14 days before the change takes effect, describing clearly what has changed. You do not need to re-consent provided we notify you in this manner. The latest version always lives at this URL with a "Last updated" date at the top.