Privacy Policy

Effective date: [EFFECTIVE_DATE] Last updated: [EFFECTIVE_DATE]

[LEGAL ENTITY NAME] ("Functional Lifestyle," "we," "us") operates the Functional Lifestyle membership platform (the "Platform"). This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and your choices. Functional Lifestyle is a membership platform that connects members with independent third-party vendors; this Policy covers our practices, not those of the vendors, whose own privacy policies govern their services.

1. Information We Collect

a. Account and authentication information (via our identity provider, Clerk).

• Email address
• Password — created and stored by Clerk in hashed form; we never receive or store your raw password
• First and last name
• Email-verification codes and password-reset tokens (transient)
• Session and login information, and security signals such as IP address and device characteristics that Clerk uses to protect your account
• Invitation records (the invited email address and invitation status)

b. Membership profile (stored in our database, Supabase).

• Name, and optionally phone number and organization/employer you provide during onboarding
• Membership tier, status (pending/active/suspended/expired), and role
• Timestamps such as when you accepted the Terms and when your membership was activated or changed

c. Administrative activity logs. We keep an internal audit log of administrative actions (for example, approving or suspending a membership), including which administrator performed the action, the action type, and the time. This is used for security and accountability.

d. Usage and device information (analytics). We use Vercel Analytics, which collects aggregated, cookieless usage metrics (such as page views and general device/region information). It does not use tracking cookies or build advertising profiles.

e. Cookies and similar technologies. We use essential cookies only, primarily to keep you securely signed in (set by our identity provider). We do not use advertising or cross-site tracking cookies. See Section 4.

What we do NOT collect. We do not collect health, medical, diagnostic, biometric, or wearable data. We do not process payment card information through the Platform. We do not host user-uploaded files.

2. How We Use Information

• To create and administer your account and membership (including the pending → active approval workflow)
• To authenticate you and secure the Platform
• To send transactional communications such as invitations, email verification, password resets, and membership-status notices
• To operate, maintain, and improve the Platform
• To keep security and audit records and to detect and prevent fraud or abuse
• To comply with legal obligations and enforce our Terms

We do not sell your personal information.

3. How We Share Information

We share personal information only as needed to run the Platform:

Service providers (sub-processors) acting on our behalf:

• Clerk — authentication and identity management
• Supabase — database hosting for membership data
• Vercel — application hosting, edge delivery, and cookieless analytics
• SendGrid (via Clerk) — delivery of transactional email

Third-party vendors. When you choose to visit or engage a Vendor featured on the Platform, you do so on the Vendor's own site and under the Vendor's own privacy practices. We do not control and are not responsible for Vendor data practices.

Legal and safety. We may disclose information if required by law, to protect our rights or the safety of others, or in connection with a corporate transaction (e.g., merger or acquisition), subject to this Policy.

4. Cookies

We use cookies that are strictly necessary to provide the Platform — chiefly the session cookies our identity provider sets so you stay signed in. Because we use only essential cookies and cookieless analytics, we do not display a consent banner; disabling essential cookies will prevent you from signing in.

5. Data Retention

We retain membership information for as long as your account is active and as needed to provide the Platform, comply with legal obligations, resolve disputes, and enforce our agreements. Administrative audit logs are retained for security and accountability. Invitations expire automatically after 30 days. [CONFIRM ANY SPECIFIC RETENTION PERIODS WITH COUNSEL.]

6. Your Rights and Choices

Depending on where you live, you may have rights to access, correct, or delete your personal information, to obtain a copy, and to object to or restrict certain processing.

• Access / correction: you can review and update basic profile details, or contact us at [PRIVACY_EMAIL].
• Deletion: you may request deletion of your account and associated personal information by contacting [PRIVACY_EMAIL]. [IMPLEMENT a deletion flow or a documented manual process before relying on this statement.] Some records may be retained where required by law or for legitimate security/audit purposes.

[IF YOU HAVE EU/UK USERS — GDPR: identify the legal bases for processing (contract performance, legitimate interests, consent, legal obligation), the right to lodge a complaint with a supervisory authority, and international- transfer safeguards. IF YOU HAVE CALIFORNIA USERS — CCPA/CPRA: include the categories of information collected, the "do not sell/share" statement (we do not sell or share), and the methods to submit requests. Include or remove these sections with counsel based on your user base.]

7. Data Security

We use administrative and technical safeguards to protect personal information, including access controls, encrypted transport (HTTPS), and reputable infrastructure providers. Access to member data in our systems is restricted to server-side operations and authorized administrators. No system is perfectly secure; we cannot guarantee absolute security.

8. Children's Privacy

The Platform is intended for adults and is not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us at [PRIVACY_EMAIL].

9. International Users

We operate the Platform from the United States. If you access it from outside the U.S., you understand your information may be processed in the U.S. and other locations where our service providers operate. [ADD TRANSFER SAFEGUARDS IF YOU SERVE EU/UK USERS.]

10. Changes to This Policy

We may update this Policy from time to time. We will update the "Last updated" date and, for material changes, provide additional notice where appropriate.

11. Contact Us

Questions or privacy requests: [PRIVACY_EMAIL] · [LEGAL ENTITY NAME] · [BUSINESS ADDRESS].