Privacy Policy (PDP)
Summary version v1 · updated 17 July 2026. The full document is being prepared with legal counsel.
In effect since 17 July 2026.
Who does what
Under Law No. 27 of 2022 on Personal Data Protection (PDP): the club or community is the controller of its fans' data, and fanhub. is the processor that runs the platform on the club's instructions.
Data we process
- Fans: email, name, phone number (optional, when buying), memberships, points, and transaction and attendance history at the clubs they follow.
- Club organisers: name, email, and dashboard account data.
Consent
When you sign up, the required consent (Terms & Conditions and Privacy Policy) and permission to receive promotions are two separate checkboxes: promotions are always optional and can be withdrawn at any time.
How data is protected
- Each club's data is isolated at the database level (row-level security).
- Every time an organiser opens a fan's personal data in the dashboard, it is recorded (audit log).
- Data is never sold. fanhub. does not pass a club's data to anyone else beyond what running the service needs (payments, delivery, email).
Service providers and where data is
fanhub. runs this service with the following providers, each acting as a processor on fanhub.'s instructions:
- Vercel (web hosting, United States)
- Railway (API and database, Singapore)
- Google Cloud (database backup copies, Indonesia)
- Resend (email delivery)
- PostHog (analytics, European Union)
- Sentry (error reporting)
This notice is updated whenever a processing location changes.
Your rights
Fans can ask for access to, correction of, or deletion of their data through their club or directly with fanhub. A club can export its fans' data at any time. The data stays the club's, including after it stops using fanhub.
Analytics
fanhub. uses PostHog to count page usage, with servers in the European Union. Only usage events such as a page being opened or a button being pressed are sent, with no personal data: name, email, phone number and address are never included. There is no screen or session recording.
Contact
Privacy questions, and requests for access, correction or deletion of data: fanhub@kultura.co.id.
Change history
- 27 September 2026 · Google Cloud added as a processor for database backup copies, in Indonesia. The move no longer carries a deadline; this notice is updated when a location changes.
- 22 September 2026 · Service providers and data location section added: each processor and its country, and the planned move of the database to Jakarta.
- 16 September 2026 · Analytics section added. The list of fan data aligned with email sign-up. Contact changed to an email address.
- 17 July 2026 · First summary version.