Privacy Policy

Last updated: 2 October 2026

Fresh Club is operated by EYEPIC, S.L. This policy explains how we handle personal information when you visit fresh.club, join our waiting list, receive an invitation, become a member, shop with us, or contact us.

Fresh Club is currently pre-launch and is not accepting purchases or paid subscriptions. The shopping, payment, delivery and subscription descriptions below apply only when those services become available and you use them.

1. Who is responsible for your information

EYEPIC, S.L., a company established in Spain, is the controller of the personal information described in this policy.

Registered address: Calle Isla Madeira 10, Bloque 4, Vivienda 2, 29678 Benahavís, Málaga, Spain
Tax identification number (NIF): B72831258
VAT number: ESB72831258
Privacy enquiries and requests: privacy@eyepic.app
General enquiries: contact@eyepic.app

Please mention “Fresh Club” when contacting us so we can direct your request to the right team. This policy concerns Fresh Club; using our shop does not enrol you in EYEPIC, S.L.’s other services.

2. Information we collect

Waiting list and membership. We collect your name, email address, confirmation status, signup source, product preferences you choose to provide, invitation and referral records, and any separate newsletter choice. When you create an account, we also process your account details and authentication information, including login-code or session records.

Optional Google sign-up and sign-in. If you choose Google, we receive your name, email address, email-verification status and a stable Google account identifier. We use these details to register and verify your requested waiting-list entry, recognise your linked account, and sign you in to the Fresh Club store/platform when you are eligible for access. We retain the identifier so that a change of email does not link you to someone else's account. Google's basic profile response may include a profile picture; Fresh Club does not save or use that picture. We do not request access to Gmail, contacts, Drive or other Google account content, and we do not receive your Google password.

Shopping and subscriptions. We process basket contents, products, sizes, colours, quantities, billing and delivery addresses, contact details, order history, delivery information, payment status and transaction references. For subscriptions, this includes the selected plan, renewal schedule, saved payment reference, and changes, skips or cancellations. If you request a business invoice or use wholesale services, we may also need your business name and tax details.

Payments. The payment provider used at checkout processes the payment details you enter. We receive the information needed to recognise and manage your payment, such as transaction identifiers, payment status, and limited payment-method details. Please do not send full card details or security codes to customer support.

Messages and support. We retain enquiries, correspondence, return or complaint details, and any attachments you choose to send. Please avoid including sensitive information that is unnecessary for your request.

Website use. Our systems receive technical information such as IP address, request time, browser and device information, requested pages and error details. With your analytics permission, we also collect information about visits, navigation, interactions and performance, as described below.

3. Where information comes from

Most information comes from you or your interaction with our website. When you choose Google authentication, the identity details described above come from Google. Payment and delivery providers supply payment confirmations and delivery updates. If someone invites or refers you, we may receive your email address and information linking that invitation to its sender. We use it to handle the invitation and prevent misuse; an invitation does not subscribe you to our newsletter.

Invitation and referral features may show the sender whether their invitation or referral has been used or qualified. They do not give the sender access to your payment details, address or order contents. If you receive an unexpected invitation, you can ignore it or ask us to remove the associated information.

4. Why we use information and our legal bases

To handle your requested waiting-list entry, membership application, account, purchases and subscriptions: taking steps at your request before a contract, and performing our contract with you. This includes confirmations, login messages, renewal administration, delivery and customer support.
To keep records required by law: compliance with legal obligations, including applicable invoicing, tax, accounting, consumer protection and product-safety duties.
To protect the service and resolve disputes: our legitimate interests in preventing fraud and invitation abuse, securing accounts, investigating errors, maintaining reliable services and establishing or defending legal claims. We consider the impact on your rights when relying on these interests.
To administer member-requested invitations and referrals: our legitimate interests in operating these features and preventing abuse, subject to applicable electronic communications rules. We do not treat a referral as permission for unrelated marketing.
To send optional newsletters and promotions: your consent. You may unsubscribe using the link in a message or contact us. Essential messages about your account, requested invitation, purchases or subscription are separate from promotional emails.
To run optional website analytics and browser diagnostics: your consent through Cookie preferences.

Google authorization is separate from your optional newsletter choice. Google identity information is used for the registration, authentication and security functions you request, not sold or used for advertising profiles. If you separately request our newsletter, we use your email address to deliver that newsletter under your separate consent. Choosing Google alone does not subscribe you to marketing.

You can browse without creating an account and decline optional analytics or marketing. If you do not provide information needed for an account, delivery or payment, we may be unable to provide that particular service. Optional preferences and newsletter permission are not conditions of purchase.

5. Cookies and similar technologies

Cookies and browser storage help keep you signed in, remember your basket and choices, and complete checkout. We use necessary storage for requested functions and ask before enabling optional analytics or advertising measurement. You can accept, reject or change optional categories through Cookie preferences in the website footer, including during checkout. Withdrawing permission does not affect processing already carried out lawfully.

The current storefront uses these necessary records:

fresh_club_consent. Remembers acceptance or rejection and the policy revision. Browser lifetime: 180 days.
Spree basket token and basket ID, including separate wholesale baskets. Maintains your basket and checkout. Browser lifetime: Up to 30 days from setting or renewal.
Spree account access token. Keeps you signed in. Browser lifetime: Up to 7 days from setting or renewal.
Spree refresh token. Renews your authenticated session. Browser lifetime: Up to 30 days from setting or renewal.
fresh_club_google_binding. Binds a requested Google sign-in attempt to your browser and prevents login replay. Browser lifetime: Up to 10 minutes; removed after successful customer login.
Country and language preferences. Routes you to your selected shopping region and language. Browser lifetime: Up to one year from setting or renewal.
Invitation and checkout session storage. Carries an invitation or completed-order reference between pages. Browser lifetime: Browser session.

Google authentication. When you choose to continue with Google, your browser connects to Google to display its sign-in button and account selector. Google receives the technical information needed to provide and secure that interaction and may use its own cookies or browser identity features under Google’s Privacy Policy. Fresh Club enables this requested authentication independently of optional analytics or marketing preferences. You can use the email registration and login alternatives instead.

Analytics. With permission, Fresh Club uses OpenPanel to understand visits and interactions. Its script is supplied through openpanel.dev and events are sent to analytics.eyepic.io. The service may receive page and referrer information, browser/device details, timing and interaction data, and technical network information. Optional Sentry browser diagnostics, when enabled, help investigate application errors. Payment and account information should not be entered into public URLs or optional feedback fields.

Advertising measurement. With your marketing-cookie consent, the OpenAI Ads Measurement Pixel measures page views and accepted waiting list signups to attribute conversions to ads in ChatGPT. The SDK loads from bzrcdn.openai.com and sends measurement events to bzr.openai.com, including browser and page context and attribution references. For signup matching, we normalize your email and send its SHA-256 hash rather than the raw address. This hash is still personal data. Our events opt out of future user-level personalization. Newsletter consent remains a separate choice.

Optional marketing record Purpose Browser lifetime __oppref Associates eligible conversions with an OpenAI ad click Up to 30 days; a new URL click reference resets expiry __obref OpenAI browser reference for measurement Up to 365 days openai-ads:waiting-list:* session storage Suppresses repeated signup reporting for the same hashed email within a tab Browser session; removed when marketing consent is withdrawn

The pixel is not loaded before marketing consent. Withdrawing consent stops measurement, removes the pixel's attribution cookies, and reloads the page to dispose of vendor listeners. Events blocked by consent are not replayed after acceptance. See OpenAI's Privacy Policy and Measurement Pixel documentation.

Rejecting optional cookies leaves necessary shopping and account functions available. Browser settings can also delete or block storage, although blocking necessary cookies may prevent login or checkout. The lifetimes above concern browser records, not the retention of orders or other information in our systems.

6. Who receives information

Access is limited to people and organisations that need information for the relevant purpose:

Authorised EYEPIC, S.L. staff and contractors supporting Fresh Club.
Hosting and infrastructure providers, including Hetzner for the shop infrastructure.
Google, when you choose Google sign-in, to provide identity verification under its own privacy notice. Necessary identity information is also processed by our hosting and email providers for the requested Fresh Club functions.
Email delivery providers, including Mailjet for website transactional email, to deliver requested messages.
Payment providers offered at checkout; Stripe supports the subscription integration when available. The provider actually selected processes payment information under its own applicable notice.
Warehousing, fulfilment and delivery partners, who receive the information needed to prepare and deliver your order and handle returns.
The analytics and diagnostics providers described above, subject to the applicable consent choice.
Professional advisers and public authorities where necessary to meet legal obligations or handle claims.

Providers acting on our instructions are subject to appropriate data-processing obligations. Some recipients, such as payment providers or authorities, act as independent controllers for their own legal purposes. We do not sell your personal information. A business reorganisation or transfer may require limited disclosure to advisers or a successor, with appropriate confidentiality and data-protection safeguards and notice of a controller change where required.

7. International transfers

EYEPIC, S.L. operates from Spain. Some service providers or their support teams may process information outside the European Economic Area. Where that happens, the transfer must have an applicable legal safeguard, such as a European Commission adequacy decision or standard contractual clauses with any necessary supplementary measures. You can ask privacy@eyepic.app for information about the destinations and safeguards relevant to your data, including a copy of applicable safeguards with confidential information removed.

8. How long we keep information

We retain information according to its purpose:

Waiting-list and invitation records are needed while your request or invitation is active, and for a proportionate period afterwards to resolve delivery issues and prevent repeat abuse. If you join, information needed for membership becomes part of your account record. You can ask to leave the waiting list at any time.
Google identity links are retained while needed for your waiting-list entry or linked account. Short-lived sign-in challenges expire after 10 minutes and are removed by scheduled cleanup; account/security records follow the criteria below.
Account and subscription information is retained while the relationship is active and afterwards where needed to complete outstanding orders, refunds or disputes.
Orders, invoices and related records are retained for the applicable tax, accounting and legal-claims periods, even if you close your account.
Support and security records are retained for as long as needed to resolve the issue, investigate incidents and meet related legal requirements.
Marketing contact information is used until you withdraw consent or it is no longer needed. We may retain a limited suppression record to respect your objection and evidence of consent where necessary to demonstrate compliance.
Analytics and diagnostic records are retained only for the measurement or investigation period needed for those purposes, then deleted or anonymised.

Where retention is required after a deletion request, we restrict the information to the remaining lawful purpose. Backup copies are removed through the backup replacement cycle and are not used to restart deleted accounts. Contact us for the retention criteria applicable to a particular record.

9. Your rights

Subject to the conditions in data-protection law, you may request access, correction, deletion, restriction of processing and a portable copy of information you provided. You can object to processing based on legitimate interests and object to direct marketing at any time. You can withdraw consent without affecting earlier lawful processing.

You may remove Fresh Club’s Google connection in your Google Account settings or ask us to remove the stored link. Disconnecting Google does not itself remove your Fresh Club waiting-list entry, delete your account, unsubscribe you from a separately requested newsletter, or end an existing Fresh Club session. Use sign-out to end that session; contact us to leave the waiting list, remove an identity link or request account deletion. Email login remains available for eligible customer accounts.

Write to privacy@eyepic.app with enough information to identify your Fresh Club account or request. We may ask for proportionate identity verification. We normally respond within one month; if a permitted extension is necessary because of complexity or the number of requests, we will explain it within that month. Requests are normally free of charge.

You may complain to the Spanish Data Protection Agency (AEPD) or the supervisory authority where you live or work. You do not have to contact us before approaching an authority.

Fresh Club does not use solely automated decision-making that produces legal or similarly significant effects on you. If you believe an account or transaction has been incorrectly restricted, contact us for review.

10. Security, children and changes

We use appropriate technical and organisational measures to protect information, including HTTPS and access controls. No system can eliminate every security risk. Keep login links, codes and account credentials private and tell us promptly about suspected misuse.

Fresh Club accounts and purchases are intended for adults aged 18 or over. We do not knowingly invite children to create accounts. Contact us if you believe a child has provided personal information so we can assess and address it.

We will update this policy when our services or processing change and identify the date of the new version. Material changes will be brought to your attention through an appropriate notice. New uses requiring consent will not rely simply on continued browsing.