Editing Privacy concerns and data handling at Hack Club (section)

== Governance and Response ==
The response to these disclosures became a point of contention. The researcher reported that initial contact with Hack Club staff, some of whom were teenage interns, yielded legally inaccurate responses, including the claim that GDPR did not apply to the US-based organization and that advice had been sourced from ChatGPT. Leadership was criticized for being dismissive of formal breach notifications. Furthermore, the dedicated GDPR contact email (gdpr@hackclub.com) was taken offline shortly after the issues were raised publicly, with operations staff later explaining it was a temporary solution managed by a part-time contributor.

Hack Club's leadership acknowledged the need for improved policies. The COO stated in a Slack message that the organization was in the process of assembling its policies for publication. In internal discussions, staff expressed a philosophy that the need for formal policy documents was a sign of underlying issues but agreed that clarity for users was necessary.