Privacy Policy

This Privacy Policy explains how RecFlow ("RecFlow", "we", "us") collects, uses, and shares information when you use our websites, the organizer dashboard, and the player marketplace (together, the "Service"). RecFlow is operated from the United States.

Who this policy covers

RecFlow serves two kinds of users. Organizers are the sports facilities, clubs, and individuals who run bookable sessions and pay for a RecFlow subscription. Players are the people who browse and book those sessions; the player marketplace is free to use. Where an organizer collects information from players through RecFlow, that organizer decides how that information is used for its own purposes and RecFlow processes it on the organizer's behalf.

Information we collect

Information you give us

• Account details — your name, email address, and a password, which our authentication provider stores only as a salted hash.
• Organizer and business details — facility or organization name, location, sport, description, logo, and the information needed to set up payouts, including bank or payout details you provide to Stripe.
• Onboarding responses — the answers you give in our setup questionnaire (for example organization type, number of spaces, weekly session volume, and goals), used to recommend a plan and improve the product.
• Bookings and session data — sessions you create or book, capacity, pricing, attendance and check-in records, waitlist status, and discount codes.
• Support and communications — messages you send us and our correspondence with you.

Information collected automatically

• Product usage data — when an organizer creates a facility or session, sends an announcement, or a facility receives its first booking, we record the event name, timestamp, account ID where applicable, facility ID, and limited event details such as session status, announcement audience and recipient count, or the fact that a report was viewed. We use these server-side records to understand and improve RecFlow. We do not put player contact details or message contents in product analytics.
• Log data — IP address, timestamps, and error reports generated by our hosting and infrastructure providers.
• Cookies and similar technologies — see our Cookie Notice.

Payment information

Card payments are processed by Stripe. RecFlow does not receive or store full card numbers. We receive limited transaction information from Stripe such as the amount, currency, payment status, card brand, the last four digits of the card, and the associated booking.

How we use information

• Provide, operate, and secure the Service, including creating sessions, taking bookings, running check-ins, and issuing discount codes.
• Process payments from players and payouts to organizers, and bill organizer subscriptions.
• Send transactional messages — booking confirmations, reminders, receipts, waitlist notifications, and account, security, and service notices.
• Provide customer support and respond to your requests.
• Monitor, troubleshoot, and improve the Service, and develop new features.
• Detect, investigate, and prevent fraud, abuse, and violations of our Terms.
• Comply with legal obligations and enforce our agreements.

Where the GDPR or UK GDPR applies, our legal bases are performance of a contract (to provide the Service), legitimate interests (to secure and improve the Service and prevent fraud), consent (where we ask for it, such as for non-essential cookies), and compliance with legal obligations.

How we share information

Between organizers and players

When a player books a session, the organizer receives the information needed to run it — typically name, email, booking and payment status, number of spots, and check-in status. When you view an organizer's public listing, information that organizer has chosen to publish is shown to you.

Service providers

We share information with vendors who process it on our behalf under contract:

• Stripe — payment processing, subscription billing, and payouts.
• Supabase — database, authentication, and file storage.
• Vercel — application hosting and content delivery.
• Resend — sending transactional and account email.
• Anthropic — the AI Marketing Studio. When an organizer uses it, their requests, any reference images they attach, and the public details of the session being promoted (the same details shown on the marketplace) are sent to Anthropic's Claude service to draft marketing. Player names, emails and bookings are never sent.
• Sentry — error monitoring. When something goes wrong, technical details about the error (the page, what failed, and internal record IDs such as a booking ID) are sent so we can fix it. We configure it not to send IP addresses, cookies or what you typed.
• Google — reCAPTCHA on sign-in and sign-up, which receives information about your device and how you interact with the page to tell people from bots; and, only if an organizer connects it, Google Calendar, which receives their sessions' titles, times and locations.
• Zoom — only if an organizer connects it, to create meetings for their virtual sessions (session titles and times).

These providers are authorized to use your information only to provide services to us.

Legal and safety

We may disclose information where we believe it is reasonably necessary to comply with a law, regulation, legal process, or governmental request; to enforce our Terms; to detect or prevent fraud or security issues; or to protect the rights, property, or safety of RecFlow, our users, or the public.

Business transfers

If RecFlow is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or use of your personal information.

We do not sell your personal information

RecFlow does not sell personal information and does not share it for cross-context behavioral advertising.

Data retention

We keep personal information for as long as your account is active and as needed to provide the Service. After an account is closed, we retain information as required for legitimate business purposes such as financial record-keeping, dispute resolution, fraud prevention, and legal compliance, then delete or anonymize it. Transaction records are generally retained for at least seven years to meet tax and accounting requirements. Product usage event records are deleted after 13 months.

Security

Information is encrypted in transit using TLS. Card data is handled entirely by Stripe, a certified PCI DSS Level 1 service provider, and never touches RecFlow's servers. Access to organizer and player data is separated by tenant using database row-level security, and staff access is limited to what is needed to operate and support the Service. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, email privacy@recflow.us. We will verify your request and respond within the time required by applicable law. You can also update most account information directly in your settings. If a request concerns information an organizer collected from you as a player, we may refer you to that organizer or act on their instructions.

If you are in the EEA or UK and believe we have not addressed your concern, you may lodge a complaint with your local data protection authority. If you are a California resident, you may exercise the rights described above and will not be discriminated against for doing so.

International users

RecFlow is operated in the United States and our providers are located in the United States. If you access the Service from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country.

Children's privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Rec sports often involve minors: where an organizer registers or books on behalf of a minor, the organizer is responsible for providing any required notices and obtaining any required parental or guardian consent. If you believe a child has provided us personal information, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you by email or through the Service before they take effect, and we will update the "Last updated" date above.

Contact us

Questions about this policy or our data practices: privacy@recflow.us.