ClubBot is a WhatsApp assistant for surf lifesaving clubs. This policy explains what information we collect when you use ClubBot, why we collect it, and how it's handled. We've written it in plain English because we think you deserve to understand it without a law degree.
ClubBot is operated by Delta Work, an AI consultancy based in Sydney, Australia. When you use ClubBot, you're interacting with a service built and managed by Delta Work on behalf of your surf club.
If you have questions about this policy or how your data is handled, contact us at euge@deltawork.ai.
When you message a ClubBot number, we collect and store the following:
| Data | Why we collect it | How long we keep it |
|---|---|---|
| Your WhatsApp phone number | To identify you and send replies back to you | For the duration of your club membership, or until you request deletion |
| Your messages and our replies | To generate answers and maintain short conversation context (last 5 exchanges) | Session context is cleared after each conversation. Full logs kept for 12 months then deleted. |
| Your SLS member number (if you provide it) | To verify your club membership and personalise responses | For the duration of your club membership, or until you request deletion |
| Feedback responses (👍 / 👎) | To measure and improve answer quality | 12 months, then deleted |
| Usage logs (message type, model used, token counts) | For operational monitoring and cost allocation | 12 months, then deleted |
We do not collect your name, email address, location, or any other personal information unless your club administrator has added it to your member profile on your club's behalf.
This is the most important section to understand. When you send a message to ClubBot, here is the path it takes:
Meta (WhatsApp): Your messages travel through Meta's WhatsApp Business Platform. Meta processes message delivery according to their WhatsApp Privacy Policy and Business Tools Terms.
Anthropic: Your message content is sent to Anthropic's Claude API to generate answers. Anthropic's API terms specify that they do not use API inputs to train their models, and data is not retained beyond the API call. See Anthropic's Privacy Policy for details.
ClubBot servers: Your data is stored on Railway's hosting infrastructure. Railway operates servers in the United States. Your data may therefore be processed and stored outside Australia. We take reasonable steps to ensure it is handled securely.
Access to your data is strictly limited:
Your club administrator can see that you are a registered member of their ClubBot. They cannot see the content of your individual messages.
Delta Work (us) can access usage logs and aggregate quality metrics for the purpose of operating and improving the service. We do not read individual member conversations unless investigating a specific technical issue.
No one else. We do not sell, rent, share, or disclose your data to any third party for commercial purposes. We will only disclose data if required to do so by Australian law.
To be explicit:
We do not sell your data to advertisers or any third party.
We do not use your messages to train AI models.
We do not share your WhatsApp number or SLS member number with other clubs or organisations.
We do not send you unsolicited messages. ClubBot only replies when you message first.
Under Australian privacy law, you have the right to:
Access the personal information we hold about you.
Correct any inaccurate information.
Request deletion of your data. We will delete your member record, message logs, and session data within 30 days of a verified request. Note that deletion means you will need to re-register if you wish to use ClubBot again.
Opt out of feedback requests at any time by tapping the 🔇 button when ClubBot asks for feedback.
To exercise any of these rights, contact us at euge@deltawork.ai with your request. We'll respond within 30 days.
We take reasonable steps to protect your data from unauthorised access, loss, or misuse. This includes encrypted connections (HTTPS/TLS) for all data in transit, access controls on our database, and environment-level secret management for API credentials.
No system is perfectly secure. If you become aware of a security concern relating to ClubBot, please contact us immediately at euge@deltawork.ai.
ClubBot is intended for use by surf club patrol members aged 15 and over. The Nippers persona, if active at your club, is intended for use by parents and Nippers coordinators — not directly by children. If you believe a child under 15 has registered with ClubBot without parental consent, contact us at euge@deltawork.ai and we will delete their record promptly.
We may update this policy from time to time. When we do, we'll update the "last updated" date at the top of this page. For significant changes, we'll notify clubs directly so they can inform their members. Continued use of ClubBot after a policy update means you accept the revised policy.
We're happy to explain anything in this policy or discuss how your data is handled.