The safest data is the data we never hold.
Written for the person who has to sign off on this. The short version: no student information system connection, no full card numbers, and roles that actually restrict what staff can reach.
What Admittee does not hold
No student information system connection. There is no roster sync and no enrolment feed. Nothing arrives here from PowerSchool, Skyward, Infinite Campus or anything else, and no record in Admittee is created by your student system. The reasoning is here — most of what a facility calendar and a box office need is not in an SIS, and every integration into one is a permanent obligation.
What we hold about a child, a parent typed. Registering someone saves a profile under that parent's account — name, date of birth, grade — so it is not re-entered every season. Your own registration forms decide the rest, and they can ask for allergies, medications, a physician or an emergency contact. That is real information about a minor. It is here because your program asked for it, and the obligations that come with it are set out in the Terms and the Privacy Policy.
No full card numbers. Payments run through Stripe. Card details are entered into Stripe's own fields and the full number never reaches Admittee; what we keep is what a receipt shows — brand, last four digits, expiry — which keeps the PCI surface where it belongs.
The people Admittee knows about are the ones who transact with you: buyers, renters, participants and their households. A much smaller and less sensitive set than a student body, and built from what those people actually did rather than from a nightly import.
Inside an account
Roles
What each person can reach is limited by role, including a Finance role for the business office that sees money without seeing everything else.
Facility permissions
Staff who run one building can be scoped to it, with approvals and attribution tied to the facility.
Activity log
A filterable record of who changed what and when, across the account, plus a history drawer on individual records.
Passkeys
Sign-in supports passkeys, so an account does not have to rest on a password somebody reuses.
Direct payouts
Money moves into your own connected Stripe account on your own schedule. We do not hold funds between collection and disbursement.
Your data leaves with you
Exports on the reports that matter, and no contract to exit. Records we keep on purpose — a withdrawn consent, what an agreement said when it was accepted — are named in the Privacy Policy.
Questions
Where is data stored?
In Google Cloud (Firestore), with payments handled by Stripe. Ask us for specifics if your district needs them in writing — we would rather answer a real question than publish a vague reassurance.
Do you hold information about minors?
Yes, where a parent gave it to you through a registration — a name, a date of birth, a grade, and whatever else your form asks. Section 9.7 of the Terms sets out what that makes you responsible for, and section 10 of the Privacy Policy says what it makes us responsible for. Neither of us can hand the other the whole problem.
Do you sell or share data?
No. Buyer and family data belongs to the organization that collected it.
What about marketing consent?
Recorded where it was given, so an opt-in is attributable and an export can be trusted rather than assumed.
Who do we contact about a security question?
Contact us and it reaches the people who build it, not a queue.