Privacy Policy
Effective from October 12, 2026
1. Who processes your data
Courtbee is operated by AI Land s. r. o., company ID 57673136, registered office Opatovská cesta 14, 040 01 Košice – mestská časť Vyšné Opátske. Register entry: Obchodný register Mestského súdu Košice, oddiel: Sro, vložka č. 66265/V.
For questions about personal data, write to us at privacy@courtbee.com.
2. Venues
Sports venues use Courtbee to manage their courts, reservations and trainings. A venue sees its own members, their reservations, training attendance, training group memberships and payments.
For every reservation, the venue receives the name, e-mail address and phone number of the person who made it by e-mail. A venue does not see data that belongs to other venues.
We are responsible for your account — e-mail, password, name, phone, age, language and sign-in records. The venue is responsible for what it keeps about you as its member — membership, training groups, attendance, reservations at that venue, play level and payments. We process that data only on its behalf and on its instructions (GDPR art. 28).
If a venue manager added you, we did not receive your data from you but from the venue. For questions about the data the venue keeps about you, contact the venue directly — tenniskosice@gmail.com.
3. What data we process
| When | Data |
|---|---|
| Registration | E-mail, password (stored only as a hash, never in readable form), first and last name, phone, age and play level. Optionally an address and billing details – we store them but do not use them for anything else yet. |
| A venue manager adds a member | Name, e-mail, phone, age and skill level. |
| Skill level | Stored separately for each venue membership, together with whether it is verified. A coach or venue manager can set and verify it. We record every such change: who made it, when, and the old and new level. |
| Coaches | Name, e-mail, phone, specialty and hourly rate. |
| Login | IP address and browser identification for every login. |
| Use | Reservations, participation in trainings and open sessions, training group membership and its payment status. Payments: amount, variable symbol, status and status history, and notes a venue manager may add to a payment. |
4. Purposes and legal basis
- Running your account, reservations, trainings, payments and e-mails about reservations, payments and setting a password – performance of a contract, Art. 6(1)(b) GDPR.
- Account security and login records – legitimate interest, Art. 6(1)(f) GDPR. This protects accounts from misuse.
- Accounting records of payments – legal obligation, Art. 6(1)(c) GDPR.
- For the data a venue keeps about you as its member, the venue determines the purpose and the legal basis; we process it on its instructions (section 2).
We do not carry out automated decision-making or profiling.
5. Recipients
- Railway – hosting of the application, database and Redis, region EU West (Amsterdam), the Netherlands.
- Resend – sending e-mails.
- Google Fonts and jsDelivr – fonts and icons are loaded from them on every page view, so they receive the visitor's IP address.
- The venue – to the extent described in section 2.
A venue's public calendar shows reservations without names.
6. Transfers outside the EU
We store data with Railway in the EU West (Amsterdam) region in the Netherlands; where any of the providers above processes data outside the European Economic Area, it does so on the basis of a European Commission adequacy decision or standard contractual clauses.
7. How long we keep data
- Account data is kept for as long as the account exists.
- Payment records are kept for 10 years, as accounting law requires.
- A login expires 7 days after it was last used.
- Login records (IP address, browser identification) are kept while the account exists and are deleted when the account is erased.
- E-mail delivery records roll off continuously: we keep the last 100 sent and 1000 failed.
- Database backups contain data until newer backups replace them.
- Server logs (technical operation records that may contain an e-mail address) are kept by the hosting provider for a limited time.
- When a venue stops using Courtbee, the data we processed on its behalf is returned to it or deleted, as agreed with that venue; your account is not affected.
8. Cookies and local storage
| Name | Purpose | Lifetime |
|---|---|---|
better-auth.session_token (prefixed with __Secure- over HTTPS) | Login | 7 days after last use |
PARAGLIDE_LOCALE | Selected language | 400 days |
| Browser local storage | Admin panel sidebar state | Until you clear it |
We use no analytics or advertising cookies.
9. Your rights
You have the right of access to your data, to rectification, erasure and restriction of processing, the right to object and the right to data portability.
Send your request to privacy@courtbee.com. If it concerns data the venue is responsible for (section 2), we pass it on to the venue and tell you so; the venue has to handle it.
You can lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk.
10. Erasing your data
To have your account erased, e-mail privacy@courtbee.com from the address on your account. We handle the request within one month. Past reservations and payments remain in anonymised form because we need them for accounting. Everything else is deleted from our database or anonymised. The data a venue is responsible for — membership, training groups and attendance — is deleted on its instruction, which is agreed in advance, so the request is handled in one go. Backups and e-mail delivery records expire as described in section 7.
11. Minors
Registration accepts ages from 5. A parent or legal guardian should register children under 16.
12. Changes to this policy
This policy is effective from October 12, 2026. If we change it, we will publish the new version on this page with a new effective date.