Pool Check-in privacy

How this page fits with VendoRFP's Privacy Policy

Pool Check-in™ is a VendoRFP product, operated by VendoRFP Inc. The VendoRFP Privacy Policy applies to Pool Check-in and covers account data. Read it first.

This page adds what is specific to Pool Check-in. It covers the resident and household records, check-in logs and kiosk data that Pool Check-in holds, how long they are kept and who can see them.

Who puts these records here

A community, or the organization that runs it, uploads and manages its own resident list and decides how its staff use Pool Check-in. Pool Check-in stores those records to run the service for that community. Residents do not have Pool Check-in accounts.

What Pool Check-in stores

• The resident list. Each resident’s first and last name and unit address, plus the city, state, ZIP code and resident type (such as owner or renter) when the community includes them.
• Household standing. Whether a household is banned, suspended or behind on dues, with the reason, a note for gate staff, the amount due and its date when the community provides them, and the username of the person who set it. A community can also bar a person by name, with a reason and a note. Lifted entries are kept as a record.
• Check-in records. The household address, the names of residents and guests 16 and older, the number of people under 16, the time, the pool, the label of the device used and the staff member’s username. A check-in can also carry a note. A vendor visit records the company and the person who signed in. When staff check in someone who is not on the list, Pool Check-in records the name and address they type, and saves them for later visits only if the community turns that on.
• Kiosk data. The household PINs a community sets for self check-in. For household QR cards, Pool Check-in stores only a one-way hash of each card’s code. Check-ins made at the kiosk are marked as self check-in.
• Reports, photos and files. Pool rounds, opening and closing reports, inspections and incident reports, with the answers and notes staff enter, any photos they add, the time, the pool, the staff member’s username and the device label. Also the documents a community uploads for its staff. Photos and files are kept in private storage.
• Staff accounts. A username for each account and an email address for an owner who signed up on their own. Pool Check-in keeps a one-way hash of each password, never the password. If an administrator turns on an authenticator code, its key is kept in an encrypted vault and its recovery codes are kept only as hashes. An owner who connects a VendoRFP account also has that account’s id and email address stored.
• Sign-in records. Every sign-in attempt, whether it worked or not, with the time, the username typed, the IP address, the browser’s user agent, the reason a failed attempt failed and, for gate staff, the device label.
• A record of administrative changes. Changes to accounts, devices, integrations, billing and communities, with who made them and when. It holds ids and the names of the fields changed.
• Messages you send us. The name, email address, organization, number of communities and message you enter on the contact form, with the IP address and user agent it came from.
• Billing. For a paid plan, the organization’s Stripe customer and subscription ids and the subscription’s status. Card details are entered on Stripe’s own page and never reach Pool Check-in.

The copy on a gate tablet

While staff are signed in on a registered device, it keeps a copy of the community’s resident list so search keeps working without a connection. The copy holds names, addresses, resident type, household standing with its reason and note, the amount due for a household behind on dues, people barred by name, and the community’s hours, guest limit and pools. It holds no contact details or access codes.

The copy is deleted when staff log out, when the sign-in it was saved under ends, and when a different account or community signs in. It is never used after 72 hours. Check-ins made without a connection wait on the device until they can be sent.

Cookies

Pool Check-in sets no advertising or analytics cookies. It uses four cookies, all needed for the service to work: a sign-in cookie, a cookie that marks a registered gate device, a cookie that remembers which community an administrator is viewing, and a one-time security code that lasts a few minutes while you open Pool Check-in from another VendoRFP app.

Where it is kept and who handles it

• Supabase holds the database and the private file storage, in its US East region (us-east-1).
• Vercel runs the application, also in the US East region.
• Stripe handles subscription billing for paid plans. Pool Check-in sends it the organization’s name, the owner’s email address and Pool Check-in’s own ids.
• VendoRFP’s platform sends Pool Check-in’s email, such as password reset messages and the notice of a call request. When an owner signs up, Pool Check-in sends VendoRFP their email address and organization name so VendoRFP can set up their free VendoRFP account. For a community linked to VendoRFP, Pool Check-in sends the times of check-ins, rounds and inspections by pool, without names or addresses.
• Google Sheets is read only when a community links its resident list to a Google Sheet. Pool Check-in fetches that sheet to update the list.

Who can see it

• The community’s own staff. Gate staff see their community’s list, standing and today’s check-ins on a registered device. A manager sees one community’s figures, list and reports, and can download check-ins more than 24 hours old. An organization’s administrators see the communities in that organization. The server checks every request, so no one sees another community’s records.
• VendoRFP staff. VendoRFP’s platform view shows counts, organization and community names, status and billing. It does not show residents, check-ins, reports or documents. To help with a problem, a VendoRFP administrator can open one organization read-only for up to 60 minutes, after giving a reason and an authenticator code. Every page viewed is logged, and that organization’s administrators can read the log.
• Partner systems the customer connects. Nothing is shared with another system until an organization’s administrator creates an integration and chooses its communities. Its event messages carry ids, counts, times and fields marked as shareable, never names or free text. Its read-only token can read the chosen communities’ records, including the resident list, and every request it makes is logged. The administrator can pause or revoke it at any time.

Pool Check-in does not sell these records or use them for advertising.

How long it is kept

Today Pool Check-in keeps resident lists, standing, check-ins, reports, sign-in records and the change record until the community or organization removes them or asks us to. It does not delete them on a schedule. A sweep that would remove names from check-ins and standing older than three pool seasons is built, but it is switched to report only and changes nothing.

An administrator can edit a community’s resident list or replace it with a new upload, which removes the old entries. The copy on a gate tablet is never used after 72 hours, as described above.

Asking to see, correct or delete records

If you are a resident, start with your community. It manages its resident list and its standing notes and can correct them. You can also write to us through the contact page, and we will work with your community on the request.

If you run a community or work for one, contact us through the same page to get a copy of your records or have them deleted. The VendoRFP Privacy Policy describes the rights that apply to account data.

Changes to this page

When this page changes, the date at the top changes with it.