How Rundesk looks after your families' data
When a family books with you, they trust you with a lot: their child's name, date of birth and school, often an allergy or a medical condition, and a phone number to ring if something goes wrong at the pool or on court.
If you run that business on Rundesk, you're trusting us with it too. This post explains, in plain English, what we collect, where it lives, who can see it and how we protect it. The short version: your families' information is stored in Australia, in a private database that can't be reached from the internet. The legal versions are in our Privacy Policy and Terms of Service.
Your data is yours
The programs, families and bookings you put into Rundesk belong to your business. We only host and process them so the platform can work for you.
We don't sell personal information, and we don't use advertising cookies. We never send marketing to parents who book with you; they hear from Rundesk only about their own bookings.
Who's responsible for what
When a parent books through your Rundesk page, they're dealing with your business. You decide what information to ask for and how you use it to run your classes.
Rundesk stores and processes that information on your behalf. If a parent asks a question about their data, they'll usually come to you first. We're always happy to help you answer it.
What we collect, and why
We collect only what's needed to run bookings, classes and payments.
| Who | What we hold | Why |
|---|---|---|
| Your business | Name, email, phone, ABN, logo, venues, programs, prices, coach details | To set up and run your account |
| Parents | Name, email, phone; bookings, attendance, payments and receipts | To take bookings and send confirmations and reminders |
| Participants | Name, date of birth, school or level; emergency contacts and medical details if you ask for them | To place children in the right class and keep them safe |
| Website visitors | Pages viewed, device, browser and approximate city | To improve our website |
Health information is only collected when it's provided with consent, and only to keep participants safe. We don't store visitors' IP addresses, and detailed website visit records are deleted after about 30 days.
Who can see what
Everyone sees only what they need for their role.
| Person | What they can see |
|---|---|
| You (the business owner) | Your whole business: families, bookings, payments and coaches |
| Your coaches | Only the students in their own classes, with their medical, allergy and emergency details and their parents' contact details. |
| Parents | Their own family's bookings, payments and receipts |
| Other businesses on Rundesk | Nothing. Each business's data is kept separate from every other business. |
That coach rule is deliberate. A casual coach running Tuesday's 4pm class needs to know that a child has asthma and who to call if something goes wrong. They don't need to see families from classes they don't teach.
Children's information is provided by a parent or guardian when they book. It's used only to manage that child's bookings and keep them safe. Parents can ask to see, correct or delete it at any time.
Where your data lives
Rundesk is hosted in Australia. Your business's information is stored in a managed database in an Australian data centre, kept separate from the servers that run the booking platform.
| Information | Where it's kept | How it's reached |
|---|---|---|
| Programs, prices and sessions | Our private database in Australia | Only by the Rundesk application |
| Bookings, enrolments, make-ups and credits | Our private database in Australia | Only by the Rundesk application |
| Card payments and refunds | Stripe | By Rundesk's servers, using a secret key that never reaches a browser |
| Email and SMS delivery | Our email and SMS providers | By Rundesk's servers, using secret keys that never reach a browser |
| Backups | Automatic backups of the database, in Australia | Only by the people who administer Rundesk's hosting account |
The database has no public access. It can't be reached from a web browser or from the internet, only from the Rundesk application itself. Your browser talks to Rundesk, Rundesk talks to the database, and nothing else gets a direct line to your data.
How sign-in and security work
- Encrypted connections.Every page and booking runs over HTTPS, and every connection that crosses the internet is encrypted, including the ones between Rundesk's own systems.
- A private database.The database is never exposed to the internet, and it runs separately from the servers that run the booking platform. A problem on the web side doesn't touch the data store.
- Automatic backups. Backups run on a schedule without anyone having to remember them, so data can be restored after a mistake or a failure.
- Secrets stay on our servers.The keys we use for payments, email and SMS live on our servers and are never sent to anyone's browser.
- No passwords for parents and coaches.They sign in with a one-time code sent to their email. There's no password to reuse, forget or leak.
- Hashed admin passwords. Business owners sign in with a password, which we store hashed. That means we never keep the password itself, and nobody at Rundesk can read it.
- Separate data for each business.Your families and bookings can't be seen from another business's account.
- Access by role. Coaches see their own classes only, as described above.
- Checked on every request.Before an admin can open or change anything, Rundesk confirms they're signed in and that the record belongs to their own business.
No system is completely secure, and we won't pretend otherwise. If something goes wrong, we'll act quickly. If a breach could harm anyone, we'll tell the affected businesses and families promptly, following the approach in the Notifiable Data Breaches scheme.
Payments
Card payments are handled by Stripe, one of the world's largest payment processors. Card numbers go straight to Stripe. Rundesk never sees or stores them.
When a family pays by cash or bank transfer, you simply mark the payment as received in Rundesk.
Who helps us run Rundesk
Like most software, Rundesk relies on a few trusted providers. We share information with them only so the platform can work:
- Amazon Web Services (Lightsail) for our servers and database, in Australia
- Vercel for website hosting and analytics
- Stripe for card payments
- Resend for email delivery
- Our SMS provider for text message reminders
- Upstash for analytics storage
Your families' records are stored in Australia. Payment, email and SMS providers only receive what they need to do their job, such as an email address to send a confirmation to, and some of them process that information outside Australia. We choose providers with strong security practices.
Your part
Security is shared. A few habits make a big difference:
- Keep your admin password to yourself, and don't reuse one from another site.
- Remove a coach's access when they stop working with you.
- Ask families only for the information you actually need.
- Tell us straight away if you think someone has got into your account.
If you leave Rundesk
If you stop using Rundesk, we delete your business's data, except records we're required by law to keep, such as payment records for tax. Copies in routine backups are removed as those backups expire.
Questions?
If you or a parent have any question about how we handle data, email support@rundesk.com.au. We aim to respond within 14 days.