How Rundesk looks after your families' data
When a family books with you, they trust you with a lot: their child's name, date of birth and school, often an allergy or a medical condition, and a phone number to ring if something goes wrong at the pool or on court.
If you run that business on Rundesk, you're trusting us with it too. This post explains, in plain English, what we collect, who can see it and how we protect it. The legal versions are in our Privacy Policy and Terms of Service.
Your data is yours
The programs, families and bookings you put into Rundesk belong to your business. We only host and process them so the platform can work for you.
We don't sell personal information, and we don't use advertising cookies. We never send marketing to parents who book with you; they hear from Rundesk only about their own bookings.
Who's responsible for what
When a parent books through your Rundesk page, they're dealing with your business. You decide what information to ask for and how you use it to run your classes.
Rundesk stores and processes that information on your behalf. If a parent asks a question about their data, they'll usually come to you first. We're always happy to help you answer it.
What we collect, and why
We collect only what's needed to run bookings, classes and payments.
| Who | What we hold | Why |
|---|---|---|
| Your business | Name, email, phone, ABN, logo, venues, programs, prices, coach details | To set up and run your account |
| Parents | Name, email, phone; bookings, attendance, payments and receipts | To take bookings and send confirmations and reminders |
| Participants | Name, date of birth, school or level; emergency contacts and medical details if you ask for them | To place children in the right class and keep them safe |
| Website visitors | Pages viewed, device, browser and approximate city | To improve our website |
Health information is only collected when it's provided with consent, and only to keep participants safe. We don't store visitors' IP addresses, and detailed website visit records are deleted after about 30 days.
Who can see what
Everyone sees only what they need for their role.
| Person | What they can see |
|---|---|
| You (the business owner) | Your whole business: families, bookings, payments and coaches |
| Your coaches | Only the students in their own classes, with medical, allergy and emergency details. No parent contact details. |
| Parents | Their own family's bookings, payments and receipts |
| Other businesses on Rundesk | Nothing. Each business's data is kept separate from every other business. |
That coach rule is deliberate. A casual coach running Tuesday's 4pm class needs to know that a child has asthma and who to call. They don't need every parent's phone number.
Children's information is provided by a parent or guardian when they book. It's used only to manage that child's bookings and keep them safe. Parents can ask to see, correct or delete it at any time.
How sign-in and security work
- Encrypted connections. Every page and booking runs over HTTPS, so information is encrypted on its way between a browser and Rundesk.
- No passwords for parents and coaches.They sign in with a one-time code sent to their email. There's no password to reuse, forget or leak.
- Hashed admin passwords. Business owners sign in with a password, which we store hashed. That means we never keep the password itself, and nobody at Rundesk can read it.
- Separate data for each business.Your families and bookings can't be seen from another business's account.
- Access by role. Coaches see their own classes only, as described above.
No system is completely secure, and we won't pretend otherwise. If something goes wrong, we'll act quickly and notify affected people where the Notifiable Data Breaches scheme requires it.
Payments
Card payments are handled by Stripe, one of the world's largest payment processors. Card numbers go straight to Stripe. Rundesk never sees or stores them.
When a family pays by cash or bank transfer, you simply mark the payment as received in Rundesk.
Who helps us run Rundesk
Like most software, Rundesk relies on a few trusted providers. We share information with them only so the platform can work:
- Vercel for website hosting and analytics
- Stripe for card payments
- Resend for email delivery
- Upstash for analytics storage
Some of these providers store or process information outside Australia, including in the United States. We choose providers with strong security practices and take reasonable steps to make sure they handle information in line with the Australian Privacy Principles.
Your part
Security is shared. A few habits make a big difference:
- Keep your admin password to yourself, and don't reuse one from another site.
- Remove a coach's access when they stop working with you.
- Ask families only for the information you actually need.
- Tell us straight away if you think someone has got into your account.
If you leave Rundesk
If you stop using Rundesk, we delete your business's data, except records we're required by law to keep, such as payment records for tax.
Questions?
If you or a parent have any question about how we handle data, email tom@rundesk.com.au. We'll usually respond within 30 days. If you're not satisfied with our answer, you can contact the Office of the Australian Information Commissioner.