Privacy policy

The short version

• CLUB360 is a savings program from CORE Insights Group, a procurement firm, not an advertising business. We collect two kinds of information: what you deliberately hand us (a form, a conversation with CAI) and ordinary analytics about how the site is used. We do not sell any of it.
• Anything you send us goes to the CLUB360 team so a person can reply. It is not sold, rented, or traded.
• One analytics tool, Google Analytics, runs on the live site. This page names everything that runs here and tells you how to switch it off.
• Want to see what we hold, correct it, or have it deleted? Use the contact form or the phone number and email address in the footer of every page, and we will do it.

Who we are

This site, club360direct.com, is operated by CORE Insights Group (“CORE”, “we”, “us”), a managed-procurement and advisory firm serving hospitality, foodservice, and recreation operators in the United States. CLUB360 is a savings program from CORE. This policy covers the website and the CAI assistant that runs on it.

Questions, requests, or complaints go to a real person: send them through the contact form, or use the phone number and email address in the footer of every page.

Information you give us

The contact form

The form on our contact page asks for your name, business name, industry, phone number, email address, and an optional message. A third-party form relay, FormSubmit, delivers it to a CLUB360 mailbox so a CLUB Advisor can reply, and the inquiry is also saved as a lead in CORE’s Zoho CRM. It then lives in our email and in our CRM.

The enrollment form

The form on the enrollment page is hosted by Zoho Creator and submits straight into CORE’s Zoho systems. What you enter there is handled by Zoho on our behalf, under Zoho’s terms as well as this policy. A CLUB Advisor uses it to reach out within two business days.

Anything you tell CAI

Covered in its own section below, because it deserves one.

CAI, our AI assistant

CAI is the chat assistant that sits at the bottom of the page. It answers questions about CLUB360 and, if you would like to speak to someone, takes your details. Here is exactly what happens when you use it.

• CAI opens for everyone and sets no cookies. Its session identifier is held in your browser’s sessionStorage, which the browser clears when you close the tab.
• Before CAI will talk to you it runs a Cloudflare Turnstile check, the standard “confirm you are not a bot” test. Cloudflare receives your IP address and basic browser information in order to run it.
• When you open the chat window, the interface code that draws the conversation is fetched from jsDelivr, a public content delivery network. jsDelivr sees your IP address and browser type for that one request, as any web server does. Nothing you type goes to it.
• Your messages are sent to CORE’s chat service, which searches our own CLUB360 reference material held at Upstash with the text of your question, and to Anthropic, whose Claude models write CAI’s replies. Anthropic’s commercial terms state that inputs and outputs from its API are not used to train its models.
• Transcripts are kept for up to 90 days and then deleted automatically. Stored with each one: timestamps, your IP address, the approximate city, region, and country derived from it, whether the conversation produced a lead and, if it did, the name and email address you gave.
• If you give CAI your name and email address, that becomes a lead record in CORE’s Zoho CRM, so a CLUB Advisor can follow up. A copy of the conversation is saved to that CRM record (and, if you are already a CORE client, to your existing contact record) so the person replying knows what you asked. That copy is kept under our CRM retention below, not the 90 days above. Ask us and we will delete it.

Please do not send CAI confidential business information, contract terms, payment details, or anyone else’s personal data. It is a sales assistant, not a secure channel.

Information collected automatically

Like every website, this one is served by a host that keeps standard request logs: IP address, browser and device type, the page requested, and the time. Our host is Vercel. Those logs exist to run and secure the site.

The site’s typefaces are bundled with the site itself, so loading a page does not send a request to a font service.

Analytics and cookies: exactly what runs here

One analytics tool runs on this site: Google Analytics 4 (Google LLC). It records how the site is used: pages viewed, how visitors arrive, roughly where they are, and when a contact form is sent, each tied to a random identifier stored in its cookie rather than to your name. It runs only on deployed builds of the site, never on a developer’s local machine. It sets its own cookies under its own names, and its handling is governed by Google’s privacy policy.

We do not run heatmaps, session recording, A/B testing tools, or advertising pixels here.

Our consent model, stated plainly

This site does not show a cookie notice. Google Analytics loads by default on the live site, and you switch it off at the browser: block or delete cookies in your browser settings, or install Google’s Analytics opt-out add-on. CAI and every form on the site work without analytics.

What we keep in your browser

• Cookies set by Google Analytics under its own names.
• CAI’s session token, in sessionStorage, gone when you close the tab.
• A few sessionStorage flags the site uses to remember, within one tab, that you have already seen the home page arrival and which page you came from. They hold no personal information and disappear when the tab closes.
• Cookies and storage set inside two embedded frames we do not control: the Zoho form on the enrollment page, and Cloudflare’s bot check that guards CAI. Each is set on that provider’s own domain under its own privacy policy.

How we use it

• To answer you, and to come to the conversation already understanding your operation.
• To follow up on an inquiry or enrollment you started, and to send you information you asked for.
• To run and improve the site: what people read, where they lose interest, what we should write next.
• To keep the site working and secure, and to catch abuse.

Who else touches it

We do not sell personal information, and we do not rent or trade it. We share it with the service providers that make the site work, and only so they can do that job:

• Vercel: hosting for the website and for CAI.
• Google LLC: Analytics.
• Zoho Corporation: the CRM and the enrollment form.
• FormSubmit: relays the contact form to our mailbox.
• Anthropic: generates CAI’s replies.
• Cloudflare: the Turnstile bot check that guards CAI.
• jsDelivr: the content delivery network that serves the code for CAI’s chat window when you open it.
• Upstash: the databases behind CAI, holding its transcripts and the CLUB360 reference material it searches with the text of your question.

We may also disclose information where the law requires it, or where it is necessary to protect our rights, our people, or our clients.

If CORE or the CLUB360 program is sold, merged, or reorganized, the information we hold may pass to the new owner, who will be bound by this policy for it.

How long we keep it

• CAI transcripts: up to 90 days in the chat archive, then deleted automatically. The one exception is a conversation that produced a lead: a copy of it is attached to that CRM record and follows the line below.
• Inquiries, enrollments, and leads: held in our email and CRM, including any attached chat transcript, for as long as we have a relationship or a reason to follow up. Ask us to delete yours and we will.
• Analytics: held by Google for the retention period set in our Analytics property, and as aggregated reports after that, under Google’s own policy.

Your choices and your rights

• Turn analytics off: block or delete cookies in your browser, or use Google’s opt-out add-on linked above.
• See it, correct it, delete it: contact us through the contact form or the channels in the footer, and we will tell you what we hold about you, fix it, or delete it, once we are satisfied the request is genuinely yours.

Depending on where you live (California, Colorado, Connecticut, Virginia, and a growing list of other states, or the UK and EU) you may have specific statutory rights over your personal data. We apply the rights above to anyone who asks, wherever you are. We will never charge you for exercising them, and we will never treat you differently because you did.

How a request actually works

Write to us and tell us what you want. Before we act, we have to be satisfied the request really comes from you: usually that means replying from the email address we already hold for you, or answering something only you would know. If we cannot establish that, we will not hand anything over. Giving your information to somebody impersonating you is by far the worse mistake. Where someone is acting on your behalf, we will need reasonable proof that you authorized them.

We aim to answer quickly and will respond within 45 days at the latest, telling you if we need longer and why. We may decline a request that is clearly unfounded, or the same request repeated over and over. Anything genuine, we will simply do.

Security

Traffic to and from this site is encrypted in transit (HTTPS). Access to our CRM and to the CAI transcript store is limited to people at CORE who need it. No system is perfect, and we will not pretend otherwise, which is precisely why CAI asks you not to send confidential information through a chat window.

Children

This is a business-to-business site. It is not directed at children, and we do not knowingly collect information from anyone under 16. If you believe a child has sent us information, contact us and we will delete it.

Where your information is handled

CORE operates in the United States, and our people handle your information there. Some of the service providers listed above, including Cloudflare and Google, operate global networks, so parts of their processing may take place in other countries where they have facilities. If you contact us from outside the US, your information will be transferred to the United States and handled there.

Changes to this policy

If we add a tool, change what we collect, or change how consent works, we update this page and move the date at the top of it. We keep this policy in the same place as the code that runs the site, so the two stay in step.

Talk to a person

Use the contact form, or the phone number and email address in the footer of every page. Our terms of use cover the rest of what it means to use this site. CORE’s own website publishes its own privacy policy.