Privacy policy

Draft for review, not yet approved by bookahit. Details marked “to confirm” are checked before this policy is published.

bookahit is the booking and court-access system run by bookahit for tennis clubs. This policy explains what personal information bookahit holds about you, why, who sees it, and how to see, correct or delete it. Your club also has its own privacy policy for what it does with its members' information.

What we collect

Your account: name, email address, password (stored only as a one-way hash) and, if you connect it, your Google account's ID and email.
A mobile number, if you add one for texts from clubs, and when you confirmed it with the code we texted to it.
Children you add under Family: their names and, if you give it, year of birth.
Your bookings, the people on them and their gate codes; lessons, club sessions, camps, ladders, competitions and their results.
Records from the club's gates: when a booking's code or your phone opened a gate, and check-ins.
What your club records about you: membership type, dates and number, and your role if you're on the club's team.
Things you choose to add: a partner profile (level, availability), player ratings (WTN, UTR), your news and text choices. If you're on a booking that's opened to others, the club's signed-in players see your first name and initial on that game, and if you opened it or joined it, also the level you gave and your ratings.
For holiday camps, medical details and an emergency contact, only if you agree, and deleted a set time after the camp.
Messages from your club, and the emails and texts bookahit sends you.
If you ask about bookahit for your club (the For clubs page), or we approach your club: your name, email, phone and role at the club, your club's ABN if you give it, who referred you if you tell us, and what you tell us, with our notes on the enquiry, to reply to and follow up your club's enquiry. An enquiry that doesn't go ahead is de-identified a year after it closes.
If you pay for a booking by card: what you paid, when, and any refund. You type your card details on Stripe's payment page; they never reach bookahit.
If you book without an account, at a club that allows it: the name and email you give (and, for 10 minutes, a code that confirms the email), and the booking. If you make a bookahit account later with the same email, those bookings become part of it.
If you buy a gift voucher: what you paid, the voucher's code (kept encrypted, so it can be sent again), what's been spent from it, and the name, email and message you give for the person it's for, who's emailed the voucher. If someone buys you one: your name and email, only to send it to you, cleared 90 days after its last day. If your club gives you credit: each change to it, with the club's note.
If you allow notifications in the phone app: the app's notification token for your phone, so bookahit can send booking reminders and messages from your club. It's removed when you sign out of the app, or when your phone stops accepting notifications.
If you add a booking to Apple Wallet or Google Wallet: the pass shows your club, court, time and gate code. bookahit makes Apple Wallet passes for your phone to keep; Google keeps Google Wallet passes so it can show them on your phone.
At clubs whose cameras are connected to bookahit, the club's team can watch them live and see stills. bookahit doesn't record anything: footage stays on the club's own recorder, and every live view is logged.
If you're a coach: your coach profile (photo, headline, experience, qualifications, what you coach and your years coaching), the clubs you apply to with any note to them, and your lesson prices.

We don't sell personal information or use it for advertising. bookahit doesn't record your location: when you press Open gate at a club that checks it, your phone's location is sent once to confirm you're at the club, and isn't kept. Apart from the notification token above, it keeps no identifiers of your device; our hosting provider keeps short-term technical logs (such as IP addresses) to run and protect the service.

How we collect it

From you (your account and bookings); from your club (memberships, the club team); from other players who add you to a booking by email; from Google if you sign in with Google; from Stripe (whether a payment went through or was refunded); from your club's access controller when a gate opens; and from ABN Lookup, the Australian Business Register's public search, for the ABN a club gives on the For clubs page.

Why we use it

To run bookings: confirmations, reminders, gate codes, opening gates by phone and switching court lights.
To let your club run its club: its team sees bookings, members and attendance, and reports.
To take card payments for court hire for clubs that charge for courts (through Stripe, paid to the club's own Stripe account), and to refund them; and to sell a club's gift vouchers and keep track of them and of the credit a club gives you.
To send club news by email (every email has an unsubscribe link) and texts only if you said yes.
To keep accounts safe: sign-in protection, two-step sign-in, and a log of changes and remote help.
With your consent only, Google Analytics, to understand how the site is used (you can change your choice on the help page).

Automated decisions

Your club's booking rules (how far ahead you can book, members-only times, limits per day) are applied automatically from the club's settings, and waitlists move up in order. Your club can explain or change any of these.

Who sees it

Your club's team (admins and staff), and coaches for their lessons.
Other players on your bookings, sessions and ladders see your name.
A coach's profile and prices are public on the pages of each club that has approved them. Before that, only the coach and the clubs they applied to see it.
bookahit's support team, when your club asks for help; each visit is logged and the club can see it.
When you pay by card, Stripe and your club, which receives the payment in its own Stripe account.
Service providers that run parts of bookahit for us: Vercel (hosting) and our database host; Resend (email); Twilio (texts); Stripe (card payments); Expo, then Apple or Google (phone notifications); Apple and Google (Wallet passes); Google (sign-in and, with consent, analytics); YouTube (when you play a video); and Inner Range's SkyTunnel, the access-control maker's link to your club's gates where the club uses it.
ABN Lookup (the Australian Business Register, an Australian Government service): what you type in the ABN field on the For clubs page, from our server, to find your club.
Anyone the law requires us to tell.

Videos from YouTube

Clubs' Online lessons pages show coaching videos from YouTube, and bookahit uses YouTube API Services for them: our server asks YouTube whether each video may be played on the page, which sends nothing about you. Nothing on the page is loaded from YouTube until you press play. When you do, YouTube's player loads from YouTube (in its privacy-enhanced mode). YouTube then receives information such as your IP address and browser details, and it may store or read cookies or similar technologies on your device. YouTube's use of that information is covered by the Google Privacy Policy. By playing these videos you agree to be bound by the YouTube Terms of Service.

Overseas

bookahit's servers and database are in Sydney. These service providers may store or process information outside Australia, as their own policies say:

Resend (email): keeps email data in the United States.
Twilio (texts): its main processing is in the United States.
Stripe (card payments): may transfer information to the United States and India.
Expo (phone notifications): servers outside Australia, including in the United States.
Apple (Wallet passes, notifications to iPhones): generally stored by Apple in the United States.
Google (sign-in, analytics with consent, YouTube, Google Wallet, notifications to Android phones): servers around the world.
Inner Range SkyTunnel (where a club's gates connect through it): servers around the world.

Keeping it safe, and for how long

Passwords are hashed; gate codes, controller keys and camp medical details are encrypted. We keep your information while you have an account. You can delete your account at any time, in the app or at Delete your account: your sign-in and contact details are removed straight away and your future bookings are cancelled. Clubs keep their records of what already happened (past bookings, memberships, check-ins, results and accepted terms) without your name, email or phone number.

Seeing and correcting your information

Your details, bookings, memberships and choices are on your Account page, where you can change them. For anything else, or a copy of what we hold, contact the contact details on this page once published. Information your club recorded (such as your membership) can also be corrected by your club.

Questions and complaints

Contact the contact details on this page once published. We'll reply within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).