Security & privacy

Built to be trusted with your town's data.

What we collect, what we don't, and how we keep it separate.

This page describes our design approach. It is not a certification claim. MyRecTime does not currently hold SOC 2 or other third-party attestations. If your procurement process needs a security questionnaire, contact us.

Payments

Card details are entered with, and processed by, a PCI-DSS compliant payment processor. They never pass through or get stored on MyRecTime systems. Coaches don't pay, so coach accounts never involve payment data at all.

Separation between towns

Every town's locations, facilities, reservations and people are stored under that town. Staff and coaches see only the town they belong to.

Roles and access

Staff (admin) and coach roles have different permissions, and changes such as approvals, closures and plan changes are recorded in an activity log. Admins manage facilities, approvals and people; coaches reserve and manage their own bookings. Access can be deactivated without deleting history.

Sign-in

People sign in with a one-time code sent to their email, so there are no passwords to reuse or leak. Changing a sign-in email requires a code sent to the new address, and the person's other sign-ins are ended and the old address is notified.

Data we collect

Names, email addresses, contact phone numbers, team names, reservations and facility information. We collect only what's needed to run reservations, and we don't sell personal data.

Questions from your IT or legal team

Send them to us. We'll answer plainly, including where we don't yet have something you need.

Contact us