Privacy Notice

Surfbase Sport Clubs & Facilities Management L.L.C, Unit CN-01 (Shop 01), Cityland Mall, Wadi Al Safa 4, Dubai, United Arab Emirates, is the controller of your personal data. Questions and requests: privacy@surfbase.com.

• Account and contact details: name, email, phone or WhatsApp number.
• Waitlist details: your surfing level, which Founding card interests you, how you found us, the friends who joined with your link, your place in line.
• Membership and purchases: cards and bookings, payment status and invoices. Card payments are handled by Stripe; we do not see or store your full card number.
• Club use: sessions, skill-map progress, café and shop vouchers, the safety waiver you sign, and health information you choose to give us for your safety.
• App and device: whether you installed the app, notification settings, and technical data such as IP address, browser and device type.
• Messages: what you write to us by email, WhatsApp or in the app chat, including voice notes.
• Investor enquiries: if you ask about becoming a shareholder — your answers about investor status, interests and possible conflicts of interest.

• To run your account, waitlist place, membership, bookings and vouchers, and to tell you when the Founding presale opens — because you ask us to (performance of a contract with you).
• To keep you safe in the water and meet legal duties, such as tax invoices and record-keeping — legal obligation.
• To send you news and offers by email, WhatsApp or push notifications — only with your consent, which you can withdraw at any time.
• To understand how the site and app are used, measure our ads and improve them — with your consent where required.
• To answer an investor enquiry and check eligibility and conflicts of interest — because you ask us to, and to meet legal requirements on who may receive investment information.

We do not sell your personal data.

Some replies in our chat and WhatsApp are written by our AI assistant, Anna, which runs on a third-party AI service. You can always ask to speak to a person. Anna does not make decisions that have legal or similarly significant effects on you, and she never contacts people who have made an investor enquiry — those are handled only by our team.

Our team, on a need-to-know basis, and service providers who process data for us under contract:

• hosting and database: Supabase, DigitalOcean;
• payments: Stripe;
• email delivery: Resend, Google Workspace;
• messaging: WhatsApp (Meta);
• AI services: Anthropic (chat assistant), OpenAI (voice-note transcription);
• analytics and ad measurement: Google Analytics, Meta Pixel (Meta).

We may also share data where the law requires it, for example with tax or regulatory authorities.

Some of these providers store or process data outside the UAE. We transfer data only as permitted by the UAE data protection law — to countries with adequate protection or under contractual safeguards that require the provider to protect your data to the same standard.

• Account and membership data: while your account is active and for 2 years after it closes.
• Invoices and payment records: 5 years, as UAE tax law requires.
• Waitlist data, if you never buy: until 12 months after Founding sales close, unless you ask us to delete it earlier.
• Marketing consent: until you withdraw it.
• Investor enquiries: 3 years after the last contact.
• Technical logs: up to 12 months.

You have the right to:

• get a copy of your personal data and information about how it is used;
• receive your data in a structured, machine-readable form and have it sent to another controller;
• correct inaccurate data, and have data deleted when it is no longer needed or was processed unlawfully;
• restrict or object to processing, including at any time to direct marketing;
• object to decisions based only on automated processing that significantly affect you;
• withdraw consent at any time — this does not affect what was done before.

Write to privacy@surfbase.com. We reply within 30 days. Every marketing email has an unsubscribe link, and you can switch notifications off in the app.

If you are not satisfied with our answer, you can complain to the UAE Data Office.

We use cookies needed for the site and app to work (for example, to keep you logged in), analytics cookies (Google Analytics) to understand visits, and the Meta Pixel to measure our ads on Instagram and Facebook. You can block analytics and advertising cookies in your browser settings without losing access to the site.

We protect your data with access controls, encryption in transit and logging of staff access. If a data breach is likely to affect your rights, we will inform you and the UAE Data Office as the law requires.

Accounts are for adults. Data about children who surf at the club is given to us by a parent or guardian and used only to provide sessions safely.

If we change this notice in a way that matters, we will tell you in the app or by email before the change takes effect.