Start with less data. Expand access only when value and permissions are clear.
The architecture separates portable identity from private CRM and treats connectors as explicitly authorised access.
Data minimisation
The initial Audit should use the minimum information required. We prefer anonymised IDs and do not request passwords, card data, identity documents or private-message content for the initial diagnostic.
Tenant isolation
Spend, visit history, churn status, segmentation, notes and communication history remain private per club/tenant. Portable identity does not turn private CRM into cross-club data.
Booking connectors
A connector is enabled only when authority and technical access exist. We do not bypass APIs, contracts or access restrictions. Two-way sync, locking and conflict prevention enter only when supported and tested.
White-label and cross-club identity
Club apps and the cross-club network may share a consented identity layer while keeping tenant-private context separate. Public profile and portable level do not imply CRM sharing.
Media integrations
Recording/streaming requires its own consent, entitlement and privacy rules. Video providers retain their own policies and capabilities; FillMyCourt does not assume recording rights merely because a booking exists.
Analytics
Website events measure pages, referrer/UTM, CTAs, simulators, demo and forms. Form-field content is not sent into the event layer.