How CourtPilot Bookings uses information about players and venue teams, who can access it, and how to raise a privacy request.
Prepared for review: October 2, 2026. This notice covers CourtPilot Bookings. Venue operations and external services have their own privacy responsibilities.
Who handles your information
CourtPilot provides the booking website and tools. Your selected venue uses your booking information to manage its courts, contact you, review payments, and handle booking concerns.
Venue staff have access according to their assigned venue and role. Authorized CourtPilot platform administrators can inspect records across venues for platform operations and support.
Use the venue's contact details for its booking or payment decisions. You can contact CourtPilot about information handled by the booking website.
Information we collect
We receive information that you enter, that a venue enters for a booking, and that is generated while the service operates.
Player details: name, email, phone number, and optional booking notes.
Booking records: venue, courts, dates, times, add-ons, prices, booking and payment status, references, and changes made by venue operators.
Payment evidence: payment method, reference, uploaded receipt, and any cancellation or refund attachment supplied for your booking.
Venue-team records: account and contact details, assigned access, sign-in information, notifications, and operational activity history.
Inquiry and support records: contact details, messages, venue inquiries, and related review history retained from earlier contact workflows or supplied for support.
Technical information: network and browser information processed for hosting and bot protection, and security, rate-limit, and service logs. Avoid adding unrelated personal or sensitive information to notes or receipts.
Why information is used
Booking details are used to take the steps you request when booking a court and to provide the booking service. Required contact fields let the venue identify and contact you and let CourtPilot deliver booking messages; a public booking cannot be submitted without them.
We use booking information to reserve court time, calculate prices, let the venue review payment, and send booking updates and secure receipt links.
Access checks, bot checks, rate limits, and activity records support security, misuse prevention, troubleshooting, and accountability. Any reliance on legitimate interests must be assessed against your rights.
Records may also be needed to meet applicable legal obligations or address a dispute. The applicable basis depends on the purpose and type of information.
Reading this notice or accepting venue rules is not blanket permission for unrelated marketing. Where consent is the applicable basis, it must be specific to that use.
Payments and private booking links
Customers pay the venue directly through GCash, Maya, or bank. Venue staff check if payment came in and approve bookings. CourtPilot provides booking and listing software and does not hold customer booking payments.
Receipt images are stored privately and accessed through protected booking views and temporary links. They are not public venue images.
Your manage-booking link gives access to your booking without a player account. Keep it private; do not post it in comments or share it with other players.
Never provide wallet or bank passwords, one-time codes, or account access. Crop unrelated transactions and balances from a receipt before uploading it.
Service providers and external links
CourtPilot uses Supabase for database, administrator sign-in, and file storage; Resend for booking email delivery; and Cloudflare for website hosting and bot protection. These services process information needed for their functions and may process it outside the Philippines.
Booking emails can contain contact and booking details and a private manage link. Protect access to your email account.
Venue photos and published venue contact details are public. Customer payment receipts are kept separately.
Opening Facebook or another external contact link takes you to a separate service with its own privacy policy. Start a privacy inquiry without sending private evidence.
Cookies and browser drafts
Administrator sign-in uses session cookies. Booking and bot-protection features may also use browser storage or service cookies needed for those features.
During checkout, this browser tab can store a draft containing your contact details, notes, payment reference, selected courts, and temporary hold information so you can recover after a refresh. Receipt image files are not saved in that draft.
The app clears the draft after a successful submission or when it detects an expired or invalidated hold. Browser session restoration can affect how long tab storage remains; on a shared device, clear the site's browsing data after use.
Removing cookies or browser storage may sign you out or remove an unfinished checkout.
How long information is kept
Payment images, booking history, and technical records have different retention rules. Removing an image does not remove the booking, reference, customer details, or activity history.
Payment proof images remain while a linked booking is active. The current cleanup rule makes an image eligible for removal when every linked booking is in a final status and has not been updated for at least 90 days. Removal depends on a successful cleanup run.
Cancellation and refund attachments stop being available through the booking view 90 days after upload. Their stored files are removed separately by cleanup.
Booking, customer, and audit records currently have no automatic deletion schedule. A fixed retention period for these records still needs to be established; you may ask for review of information held about you.
Records needed for an applicable legal obligation or unresolved claim may have to be retained. Backups and service-provider records can have separate retention periods.
Your privacy rights
Under the Philippine Data Privacy Act, you may request information about processing, access to your personal data, correction of inaccurate information, and erasure or blocking where applicable. Other rights include objection, withdrawal of consent where processing relies on it, data portability where applicable, and raising a complaint with the National Privacy Commission.
Requests need identity verification and a review of the information, purpose, and any lawful reason to retain it. A booking reference alone is not proof of identity.
A privacy request does not automatically cancel a booking, issue a refund, or erase every operational record. Venue booking decisions and privacy requests are handled separately.
There is no self-service delete-all button. Start with a privacy inquiry so the appropriate next steps can be discussed.
How to raise a privacy concern
Message the official CourtPilot Facebook page and say that you have a privacy request. Briefly describe whether it concerns access, correction, deletion, or a possible data exposure.
For the first message, do not send an ID, full receipt, password, one-time code, or private manage-booking link. Ask how to complete identity verification and provide details safely.
If information may have been exposed, report the affected page and approximate time without posting personal information publicly.
This draft does not yet identify the operator or designated privacy contact. These details and the request-handling arrangements must be finalized before this notice is adopted.
Next step
Start a privacy inquiry
Use the official CourtPilot page. Start with the type of request, without sending private documents or booking links.