Privacy Notice

Last updated 11 October 2026

What we collect

• Account details: your email address, and your password in hashed form if you set one. If you sign in with Google, we receive your name, email address, whether Google has verified it, and your Google Workspace domain if you have one. We do not receive your photo.
• Membership: your plan, its status and renewal date. Stripe handles your card details; we never see or store full card numbers.
• What you do on the site: votes, ratings, reminders (deleted once we have emailed you that the show is out), your audio language and subtitle choices.
• Technical data: IP address, browser and device type, and server logs needed to run and protect the service. Your IP address is also used for a few minutes to limit repeated sign-in attempts, and stored with your consent choices as proof of consent.

Why we use it, and on what legal basis

• To provide your account, membership and the features you use (performance of our contract with you).
• To take payments and keep financial records (contract, and legal obligation).
• To send emails you need, such as sign-in links, receipts and reminders you asked for (contract).
• To keep the service secure, prevent fraud and vote manipulation, and fix problems (our legitimate interests).
• To send news about new shows, only if you have agreed (consent, which you can withdraw at any time).

We do not sell your personal data. We do not use advertising tools, and we do not send your votes, ratings or messages to any AI provider or use them to train AI models.

Who we share it with

• Stripe, which processes payments and acts as merchant of record. We share your email address and an internal account number with Stripe.
• Our hosting provider, which runs our servers and database in the European Union.
• Cloudflare, which provides the network, content delivery and DNS in front of the site, and stores our video and image files (these contain no personal data).
• Google, if you choose to sign in with Google, and for Google Analytics if you allow analytics cookies.
• Our email provider, to send sign-in and service emails.
• Professional advisers, and authorities where the law requires it, or a buyer if the business is sold.

We store your account data, votes, ratings and preferences on our own servers in the European Union, and our database and its backups stay in the EU. Cloudflare passes your requests through its network on the way to those servers. Some of the providers above, such as Stripe and Google, process data outside the European Economic Area, including in the United States. Where they do, we rely on safeguards such as the European Commission's standard contractual clauses or the EU-US Data Privacy Framework. You can ask us for a copy of the relevant safeguards.

Cookies and analytics

Essential cookies keep you signed in (for up to two weeks) and protect forms against forgery. With your permission, your browser's local storage remembers choices such as your language and sound setting. We do not use advertising cookies.

If you turn on analytics in the cookie banner, we use Google Analytics, loaded through Cloudflare Zaraz, to understand which pages, shows and episodes people use. It collects pages viewed, approximate location, device and browser type, and how you arrived, using a pseudonymous identifier; it does not receive your name or email. Nothing from Google Analytics loads until you agree. You can change your choice at any time from Cookie settings in the footer, and Google keeps the data for up to 14 months. Our legal basis is your consent.

How long we keep it

• Account data: while your account is open. You can delete your account yourself in Account, Your data; it is deleted straight away, apart from records the law requires us to keep.
• Requests to export or delete data: we keep a short record (your account number and a scrambled form of your email) for 24 months to show we handled them.
• Payment records: Stripe keeps these under its own retention rules; we keep subscription records for as long as tax law requires.
• Server logs: for a limited period, only as long as needed to run and protect the service.
• Backups: our database is backed up daily, and backups are kept for 7 days, so deleted data can remain in a backup for up to a week.
• Marketing preferences: until you withdraw consent.
• Consent records (your cookie choices, acceptance of the Terms and marketing choices, with the date, version, IP address, country and browser type): for as long as we need to show what you agreed to.

Your rights

Under the GDPR you can ask to access, correct, delete or move your data, restrict or object to how we use it, and withdraw consent at any time. You can download your data and delete your account yourself in Account, Your data. For anything else, email us. If you live in California, you also have the right to know what we collect, to have it deleted, and not to be treated differently for using these rights; we do not sell or share personal data for cross-context advertising. Email privacy@cliffhangers.club and we will reply within one month. You can also complain to the Commissioner for Personal Data Protection in Cyprus or to the data protection authority where you live.

Children

Cliffhangers is for adults aged 18 and over. We do not knowingly collect data from anyone younger. If we learn that a minor has an account, we will close it and delete their data.

Security

We use encryption in transit, hashed passwords, access controls and providers with strong security records to protect your data. No system is perfectly secure, so please use a strong password and keep your sign-in links private.

Changes

If we change this notice, we will update the date at the top, and tell you in advance by email or on the site if the change is significant.