How we handle your data.

Who runs RinkHQ

The data controller is RinkHQ (operator details to be confirmed before launch) — email privacy@rinkhq.app for any data request.

What we collect

• Coaches: name, email, phone, handle, bio, location, home rink, bank details (so parents can pay you), EIHA licence, DBS expiry, payment history.
• Parents: name, email, phone, payment history, booking notes.
• Skaters (children): name, date of birth, age group, position, club, medical notes (with severity), emergency contact, photo consent toggle, profile photo if uploaded.
• System: bookings, reviews, IP address (request logs only), session cookies for authentication.

Why we collect it

To run the booking flow: surface lessons, take registrations, record payments, send reminders, hand the right medical info to the right coach at the right time. We don’t profile, advertise, or sell.

Who sees what

• Coachescan see the data of any parent + skater who has booked with them. They can’t see other coaches’ rosters.
• Parents can only see their own data + their bookings.
• The public sees only what a coach has explicitly published — their profile, their session list, and reviews they have approved for publication.

Row-level security policies in the database enforce these separations — they aren’t just UI conventions.

Children

Player records are entered by the parent and only ever accessed by the coach the parent has booked with. Photo consent is off by default — coaches can’t share imagery of a skater unless the parent has opted in.

Email

We send transactional emails (booking confirmations, reminders, payment nudges, refund notices, review requests) via Resend. We don’t send marketing email and don’t share email addresses with third parties.

Where data lives

Postgres database hosted by Supabase (EU region) and static assets on Vercel’s edge network. Backups run inside Supabase.

A small number of processors receive data to run specific features:

• Supabase — database, authentication, and file storage.
• Vercel — application hosting.
• Resend — transactional email delivery (your email address and the message content).
• Stripe— card payments and coach subscriptions. Card details are entered into Stripe’s own forms and never touch RinkHQ’s servers.
• OpenStreetMap Nominatim — geocoding venue addresses that coaches publish (the venue address only, no personal data).
• Open-Meteo — weather forecasts for rink locations (venue coordinates only, no personal data).

Your rights (UK GDPR)

Access, rectification, erasure, restriction, portability, objection. Email privacy@rinkhq.appfrom the address on your account and we’ll respond within 30 days. You can also complain to the ICO at ico.org.uk.

Changes

We’ll update this page (and bump the date at the top) when anything material changes. Significant changes get an email to active accounts.

See also: Terms of service.