Privacy Policy

1. Who We Are

Clutch Merchandise LLC ("Clutch," "we," "us") operates the athlete profile and NIL platform at app.clutchicons.com and the marketing site at clutchicons.com. Questions about this policy can be directed to connect@clutchicons.com.

2. Information We Collect

We collect the following categories of information:

Account information: Email address and password (stored hashed) when you create an account.
Profile information: Name, sport, school, bio, social links, and profile photo that you voluntarily provide.
Usage data: Pages visited, referral source, and interactions with the platform (e.g., which merch tiles you click), collected anonymously for funnel analytics.
Device and connection data: IP address, browser type, and operating system, collected automatically when you use the Service.
Communications: Any messages you send to us via email or support channels.

We do not collect payment card numbers directly. Payment processing for any merchandise purchase is handled by Shopify and their payment partners.

3. How We Use Your Information

To create and manage your account and athlete profile.
To send transactional emails (account confirmation, password reset, payout notices) via Resend.
To administer NIL agreements and merchandise programs you opt into.
To understand how athletes use the platform and improve the Service.
To detect and block fraudulent or automated signup activity (bot protection).
To respond to your support requests.

We do not sell your personal information to third parties. We do not use your information for targeted advertising.

4. Third-Party Services

We use the following sub-processors to operate the Service. Each processes your data only as necessary to provide their service to us:

Supabase — database and authentication. Stores your account credentials and profile data on servers in the United States.
Resend — transactional email delivery. Receives your email address to send confirmation and notification emails.
Cloudflare Turnstile — bot detection and CAPTCHA protection on the signup form. See the Turnstile Addendum in Section 9 below for details on what Cloudflare processes.
Shopify— merchandise store at clutchicons.com. Governed by Shopify's own privacy policy for any purchase you make.

5. Data Retention

We retain your account information for as long as your account is active or as needed to operate the Service. If you request account deletion, we will delete your profile data within 30 days, except where retention is required by law (e.g., financial records for NIL payout transactions).

6. Children's Privacy

Athletes under 13 may only use the Service through an account created and managed by a parent or legal guardian. We do not knowingly collect personal information directly from children under 13. If you believe a child under 13 has provided us with personal information without parental consent, please contact us at connect@clutchicons.com and we will promptly delete it.

7. Your Rights

You may request access to, correction of, or deletion of your personal data at any time by emailing connect@clutchicons.com. Residents of California (CCPA) and the EU/UK (GDPR) have additional rights described below:

Right to know what personal data we hold about you.
Right to request deletion of your personal data.
Right to opt out of the sale of personal data (we do not sell personal data).
Right to data portability.
Right to lodge a complaint with your local supervisory authority.

8. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the effective date at the top of this page. For material changes, we will notify you by email or in-app notice. Continued use of the Service after the effective date constitutes your acceptance of the updated policy.

9. Cloudflare Turnstile Privacy Addendum

Last updated: June 18, 2025

1. Introduction

Turnstile, developed by Cloudflare, Inc. (Cloudflare), is a pro-privacy website security tool that processes minimal Signals (as defined below) solely to protect web properties against malicious activity by distinguishing human users from bots and blocking bot traffic.

Cloudflare does not control whether a website chooses to use Turnstile; instead, we make Turnstile available to any website that is looking for a way to detect and block bot traffic.

2. Scope of This Addendum

This Turnstile Addendum is supplemental to Cloudflare's main Privacy Policy. It provides additional information specific to your use and interaction with Turnstile. This Addendum also applies to the personal data processed using Cloudflare's Challenge Platform, and any reference to "Turnstile" in this addendum applies equally to the Challenge Platform.

The Cloudflare Privacy Policy continues to apply to your use and interaction with Turnstile, except where this Turnstile Addendum provides more specific information. In those cases, the more specific information will apply instead.

3. Information Cloudflare Collects

Cloudflare Turnstile processes a variety of client-side signals ("Signals") such as client IP address, TLS Fingerprint, User-Agent Header and Sitekey and associated origin. Cloudflare does not have the ability to directly identify any individuals from any of the Signals Turnstile collects, including IP addresses.

4. How Cloudflare Uses Information It Collects

(i) Bot detection and blocking

Turnstile is a tool to protect web properties by distinguishing human users from bots and blocking any detected bot traffic that could otherwise harm the safety and security of that property. It does so by evaluating the Signals listed above specific to both the website visitor and the website visited. The purpose of collecting these Signals is not to identify, profile or target any individuals but solely to detect and block bots. The Signals collected by Turnstile are strictly necessary for this purpose.

Cloudflare is a data processor of Signals that we process to provide the Turnstile service to our customers. If you have questions, or wish to exercise any data protection rights, regarding Cloudflare's processing of Turnstile data to provide our service, please contact the relevant website operator.

(ii) Improving Turnstile's bot detection capabilities

Cloudflare also processes the Signals described in this Privacy Notice to improve Turnstile. This is necessary to refine and improve our bot detection algorithms in order to respond to evolving bot threats, and to maintain the security of the web properties that website visitors choose to visit.

Cloudflare is a data controller of Signals that we process to improve Turnstile's bot detection capabilities. Cloudflare's Privacy Policy governs their processing of Signals for this purpose.

5. Notice to EU and UK Residents

To the extent that the data described in the Turnstile Privacy Notice qualifies as personal data, then:

When processing this personal data as a processor to protect our customers' websites, our customers, as controllers, determine the lawful basis of this processing, and Cloudflare processes this data under their instruction and on their behalf.
When processing this personal data as a controller, Cloudflare relies on its legitimate interests in improving the effectiveness of Turnstile's bot detection capabilities.

6. Cookies

The Signals collected by Turnstile are strictly necessary for the purpose of detecting and blocking bots. For more information about the cookies used by Cloudflare, please check Cloudflare's Cookie Policy and Turnstile Developer Docs.

Contact for Turnstile Privacy Concerns

If you have questions or concerns about this Turnstile Privacy Notice or your personal data processed through Turnstile, please contact Cloudflare's Data Protection Officer at dpo@cloudflare.com.

10. Contact

Privacy questions? connect@clutchicons.com

Clutch Merchandise LLC
Florida, United States