Your information, handled clearly

SUP Buddies Privacy Policy

Last updated 13 September 2026

1. Who we are and what this policy covers

This Privacy Policy explains how SPO Investments Ltd (“SPO Investments”, “we”, “us” or “our”) processes personal information when you visit the SUP Buddies marketing website, use the SUP Buddies app, create an account, or take part in the SUP Buddies community.

SUP Buddies is an adults-only community product for finding paddling buddies, making Trip plans, scheduling Trips, sharing safety information, and keeping a record of participation. This policy applies to the SUP Buddies websites, app, and related services that link to it.

We are the data controller for the personal information described in this policy. Our contact details are: SPO Investments Ltd, a company registered in Wales (company number 08153111), 42b Morfa Rd, Swansea, SA1 2EN, UK. You can contact us at privacy@supbuddies.net.

2. The information we collect

We collect information you provide, information created when you use the service, and limited information received from the services that help us operate authentication and infrastructure.

  • Account and identity information: your name, email address, authentication account identifier, date of birth, eligibility answers, account status, and sign-in or account-management information. Authentication is provided by Clerk; SUP Buddies does not store your password.
  • Profile and paddling information: gender, experience tier, preferred environments, preferred Trip type, availability, maximum travel distance, unit preferences, paddle certificates or courses, profile photographs, and information you choose to add to your profile.
  • Location information: your Home Base label and country, and map coordinates associated with it; Trip launch or meeting locations; and location information used to calculate approximate distance or show maps. Your Home Base and phone number have more limited visibility than your public profile and are shared only in the relevant Circle or Trip context.
  • Safety and health information: your self-rescue and swimming confirmations, health information you choose to provide, emergency contact details, and safety preferences. Please only provide another person’s contact details when you are permitted to do so.
  • Community and Trip information: buddy requests and connections, Circle membership, Trip plans, scheduled Trips, invitations, acceptance or withdrawal decisions, participation outcomes including “did not participate”, safety and risk information, ratings, reports, notifications, and saved evidence or snapshots associated with a Trip.
  • Uploaded content: photographs, certificate files, and other files you choose to upload. Files are stored separately from the main application database.
  • Notifications and device information: notification preferences and, if you enable browser push notifications, the push subscription endpoint and encryption keys needed to deliver those notifications to your device. We do not receive the contents of unrelated notifications or messages from your device.
  • Technical information: basic request, security, and diagnostic information processed by our hosting and service providers when the websites or app are delivered. We do not currently use a third-party advertising or behavioural analytics system.

3. How we use information

We use personal information to provide, secure, and improve SUP Buddies, including to:

  • create and manage your account, authenticate you, and provide account recovery and account-management features;
  • check the adult and basic safety eligibility requirements for the service and guide you through onboarding;
  • show relevant paddlers, buddies, Circles, Trip plans, scheduled Trips, invitations, and safety information according to the visibility rules of the service;
  • calculate approximate distances, display maps, support location search, and help you choose Trip locations;
  • send in-app and optional browser push notifications about connection requests, Trip invitations, Trip changes, and other service events you have enabled;
  • create safety snapshots and retain completed Trip records so that the record reflects the information and participation status at the relevant time;
  • moderate the community, investigate reports, protect members, prevent misuse, maintain security, troubleshoot faults, and enforce our terms;
  • respond to requests, exercise or defend legal rights, comply with legal obligations, and maintain appropriate business records; and
  • understand aggregate use of the service and improve its reliability and design without using personal information for third-party advertising.

4. Our lawful bases

For people in the UK or another jurisdiction applying similar data-protection rules, we generally rely on the following lawful bases:

  • Contract or steps before contract: to create your account and provide the features you request, including buddy discovery, Trips, invitations, and account settings.
  • Consent: for health information you choose to provide, browser push notifications, and any other processing where we specifically ask for permission. You can withdraw consent where the law allows, without affecting earlier lawful processing.
  • Legitimate interests: to keep the service safe, prevent abuse, operate and secure our systems, support the community, maintain Trip evidence, and improve the service, balanced against your rights and expectations.
  • Legal obligation: where we need to keep information, respond to a lawful request, or establish, exercise, or defend legal claims.

Health information can be special category data under UK GDPR. We ask you to provide it voluntarily, use it only for the safety and Trip-related purposes explained here, and rely on your explicit consent where required. You can revoke that consent through the app or by contacting us, although information already included in a completed Trip safety record may be retained where necessary for safety, legal, or evidential purposes.

5. What other members can see

SUP Buddies is a community product, so some information is intentionally visible to other members. Your profile and paddling preferences may be shown to eligible members for buddy discovery. We use approximate distance and do not intend the discovery view to expose your exact Home Base coordinates.

Phone numbers and more detailed Home Base information are protected and shared only with the relevant Circle or Trip participants where the product requires it. Trip organisers and participants may see the safety and contact information needed for that Trip. Completed Trip records use saved snapshots so later profile edits do not silently change the historical record.

Do not include information in your public profile, Trip descriptions, reports, or messages that you would not want other relevant members to see. Information you share directly with another member may be copied or retained by that member independently of SUP Buddies.

6. Who we share information with

We share information only where needed to provide the service, protect people, comply with law, or operate our business. Depending on the feature, recipients may include:

  • Clerk: authentication and account-management services. Clerk processes account data under its own privacy documentation and does not give SUP Buddies access to your password.
  • Replit and infrastructure providers: application hosting, PostgreSQL database hosting, and object storage for uploaded files and generated evidence.
  • OpenStreetMap and Nominatim: location search is sent to geocode a Home Base or Trip location, and OpenStreetMap map tiles are used to display maps.
  • Project OSRM: coordinate pairs may be used to calculate approximate road distance for discovery or Trip-related features.
  • Browser and push-delivery services: the technical information needed to route a notification to your chosen device when you enable Web Push notifications.
  • Other SUP Buddies members: only as described in the visibility and Trip rules above.
  • Professional advisers, authorities, courts, regulators, or other parties: where disclosure is required by law or reasonably necessary to protect rights, safety, security, or the integrity of the service.

We do not sell personal information, rent it to advertisers, or use it for third-party behavioural advertising.

7. International processing

Our service providers may process information in countries outside the UK. Where UK data-protection law applies, we use an appropriate transfer mechanism or other safeguard for restricted transfers, such as an adequacy decision, the UK International Data Transfer Agreement, the UK Addendum to standard contractual clauses, or another lawful safeguard.

You can contact us for more information about the safeguards relevant to a particular provider.

8. How long we keep information

We keep information only for as long as it is needed for the purposes described in this policy, unless a longer period is required or permitted by law.

  • Active account and profile information is kept while your account is active.
  • You can request account deletion from Settings. Deletion removes or anonymises the active profile and access information. We may retain Trip records, participation details, safety snapshots, reports, ratings, and related evidence where needed for safety, dispute handling, legal claims, legal obligations, or audit.
  • Push subscriptions are removed when you disable notifications, delete your account, or when the browser reports that the subscription is no longer valid.
  • Security, diagnostic, and backup records may persist for a limited period under the retention practices of our infrastructure providers.

9. Your rights

Depending on where you live and subject to applicable exceptions, you may have the right to ask us for access to your personal information, correction of inaccurate information, deletion, restriction of processing, portability, objection to processing based on legitimate interests, and withdrawal of consent.

You can make many changes directly in Settings, including updating profile information, notification preferences, account email controls, and account deletion. To exercise a privacy right or ask a question, email privacy@supbuddies.net. We may need to verify your identity before responding.

If you are in the UK, you can complain to the Information Commissioner’s Office (ICO). We would appreciate the opportunity to address your concern first, but you have the right to contact your supervisory authority.

10. Cookies and browser storage

The service uses cookies, local storage, session storage, and similar browser mechanisms that are necessary for authentication, security, routing, preferences, onboarding progress, and referral links. Browser push notifications also require a device subscription. The marketing-site waitlist form currently validates the email address in your browser but does not submit it to a mailing-list provider.

You can restrict browser storage through your browser settings, but some app features may not work correctly if essential storage is blocked.

11. Security

We use access controls, authentication, protected storage, limited visibility rules, and other reasonable technical and organisational measures designed to protect personal information. No internet service can guarantee absolute security. Please choose a strong account credential through our authentication provider and contact us promptly if you believe your account has been misused.

12. Changes to this policy

We may update this policy when the service, law, or our processing changes. We will update the date at the top of this page and take reasonable steps to draw attention to material changes. Your continued use of SUP Buddies after an update means the updated policy applies to future processing.

13. Contact us

SPO Investments Ltd
42b Morfa Rd
Swansea, SA1 2EN
UK

privacy@supbuddies.net