Data and privacy

Rowbot is designed with privacy in mind. Your club's data is isolated from other clubs, and members only see what their role permits. This page explains what data we hold, how to export it, and how to handle requests from members.

What data Rowbot holds

Club-level data

• Club profile (name, subdomain, logo, settings)
• Membership types, pricing and subscription configuration
• Payment provider credentials (stored securely by Stripe / GoCardless - Rowbot does not store raw card or bank details)
• Event and session records
• Equipment inventory

Member-level data

• Name, email address and profile photo
• Membership status, role and group memberships
• Training log entries and activity data
• RSVP responses and attendance records
• Custom field values (e.g. date of birth, emergency contact) configured by the club
• Payment history and subscription status
• Notification preferences

Data we do NOT store

• Raw payment card numbers or bank account details (these are held by Stripe and GoCardless respectively)
• Authentication passwords (Rowbot uses magic links and OAuth - no passwords are stored)

Exporting member data

Exporting a single member's record

Club admins can export a member's full record from their member profile:

1. Go to Manage > Members and open the member's profile.
2. Scroll to the bottom and tap Export member data.
3. A JSON file containing all personal data held for that member downloads immediately.

This export covers: profile fields, custom field values, membership history, training log entries, attendance records and payment history.

Exporting all members

To export the full member directory:

1. Go to Manage > Members.
2. Tap the Export button in the top-right corner.
3. Choose CSV or JSON format.
4. The file downloads containing all active and inactive member records.

Handling data subject requests (GDPR)

Under GDPR and similar legislation, members have the right to access, correct and erase their personal data. Here's how to handle each type of request.

Data retention

Rowbot retains data for as long as your club's subscription is active. When a club's account is closed:

• All club and member data is scheduled for deletion after 90 days.
• You can request an export during this window by contacting support@rowbot.app.
• After 90 days, the data is permanently deleted from all systems.

Individual member records (when deleted by an admin) are removed immediately except for anonymised financial and attendance records, which are retained for audit purposes.

Security

Rowbot uses industry-standard security practices:

• Data is encrypted in transit (TLS 1.3) and at rest (AES-256)
• Multi-tenant isolation means each club's data is strictly separated
• Access is gated by role-based permissions - no member can see another member's data beyond what their role allows
• Payment credentials are handled entirely by Stripe and GoCardless under their PCI-DSS compliance programmes

For security incident reports or vulnerability disclosures, contact security@rowbot.app.