Privacy Policy
Concourse is an operations and intelligence platform for professional baseball clubs, built and operated by TMS&J LLC, trading as 3AM Solutions and Concourse Venues ("we", "us"). This policy explains what information the platform holds, why, who can see it, and what happens to it.
The short version. Concourse holds club business data and the ticket purchase records a club's ticketing system already keeps. We do not sell data, we do not use it for advertising, and we do not combine one club's private data with another's. Each club sees only its own records, alongside information other clubs have already published publicly. To delete data, see Data Deletion.
1. Who this covers
Two groups of people appear in Concourse:
- Club staff who sign in to use the platform. We hold an email address, an encrypted password credential, a club assignment, and a role.
- Ticket buyers and business contacts whose records arrive from a club's own ticketing system or are entered by club staff. We do not have a direct relationship with these people; the club does.
2. What we collect
Club operational data
Ticket sales and attendance, concessions and merchandise settlements, sponsorship agreements, group sales, season ticket records, events, promotions, staffing schedules, field and facility records, work orders, and financial statements including budgets and actuals.
Ticket buyer records
Where a club connects its ticketing system, Concourse receives the buyer records that system already holds. These can include name, company, email address, postal address, telephone numbers, purchase history, seat locations, and whether a ticket was scanned at the gate.
Accounting data
Where a club connects QuickBooks Online, Concourse reads chart of accounts and account balances in order to display expense actuals against budget. This access is read-only. Concourse cannot create, alter, or delete anything in a club's accounting records, and does not read customer lists, payroll detail, or banking credentials.
Social media data
Concourse handles two separate kinds of social media information, and the difference between them matters.
A club's own accounts, with its permission. Where a club connects its Instagram or Facebook account, Concourse reads that account's own performance data: follower counts and audience demographics, the reach and impressions of posts, saves, shares, profile and link taps, and the content and timing of the club's own posts. This requires an administrator of the club's account to authorize it through Meta, and that authorization can be withdrawn at any time. See section 10.
Information other clubs publish publicly. Concourse also collects what other professional baseball clubs put out in the open: an account's follower count and number of posts, and for individual public posts, the caption, media type, date, likes, comments, and view count. This is the same information anyone sees by visiting those accounts, retrieved through Meta's Business Discovery interface. It is used to build league benchmarks so a club can see how its own marketing compares with its peers.
Two limits are worth stating plainly:
- We cannot see private metrics for accounts we are not authorized on. No reach, no impressions, no saves, no audience demographics, no direct messages. Those are available only for a club's own connected accounts.
- We do not collect information about the individuals who engage with a post. We store how many people liked or commented, never who they are. No names, no usernames, no profiles of members of the public.
Access is read-only in every case. Concourse does not post, comment, reply, send messages, follow, or unfollow on any club's behalf, and has no ability to do so.
Technical data
Standard server and authentication logs, including sign-in times and error records, kept for security and troubleshooting.
3. Why we hold it
Solely to provide the platform to the club that owns the data: to display its own operations, calculate its own metrics, and let its own staff do their jobs. We do not use club data or buyer records for advertising, profiling, resale, or training machine learning models.
Publicly published league information, including announced attendance and public social media activity, is used to build the benchmarks that let a club compare itself with its peers. Only already-public information is ever used this way. A club's private operational data is never shown to another club.
4. Who can see it
Access is enforced at the database level, not merely in the interface. Every record carries a club identifier, and database policies restrict each signed-in user to the clubs they are assigned to. A user at one club cannot query another club's data even by circumventing the interface.
Within a club, access is further limited by role. Financial statements and ticket buyer records are restricted to General Manager, Assistant General Manager, and Controller roles. Departmental staff see their own department's data.
3AM Solutions personnel can access club data only as necessary to operate, support, and troubleshoot the platform.
5. Service providers
Concourse runs on infrastructure operated by third parties, each holding data only to provide their service to us:
- Supabase — database, authentication, and storage
- Netlify — application hosting
- GitHub — source control and scheduled data jobs
- Intuit — QuickBooks Online, where a club connects it
- Meta Platforms — Instagram and Facebook data, where a club connects an account, and publicly published information about other clubs
- SFTPHub — secure file transfer for ticketing feeds
We do not sell, rent, or share data with anyone else, and there are no advertising or analytics partners.
6. How it is protected
- All traffic is encrypted in transit over HTTPS; file transfers use SFTP over SSH.
- Data is encrypted at rest by our database provider.
- Row-level security policies are enabled on tables holding club and personal data, and default to denying access rather than granting it.
- Credentials for third-party systems are held in encrypted secret storage, never in source code.
- QuickBooks access tokens are stored encrypted and used only by scheduled server-side jobs.
7. How long we keep it
Club operational data is retained for the life of the club's agreement with us, since season-over-season comparison is a core function of the platform. On termination, we will return or delete the club's data at the club's direction, and delete our copies within 60 days unless law requires otherwise.
Authentication and error logs are retained for a rolling 90 days.
8. Individual rights
Ticket buyers and business contacts: your relationship is with the club, and the club controls those records. Requests to access, correct, or delete a record should go to the club directly. We act on the club's instruction and will support any such request it makes.
Club staff: contact us at the address below to access, correct, or delete your own account information.
Where the GDPR, UK GDPR, or similar law applies, the club is the data controller and 3AM Solutions is a processor acting on its instructions.
9. Disconnecting QuickBooks
A club can revoke Concourse's access to QuickBooks at any time from within QuickBooks Online, under Apps, or by asking us. On revocation we stop retrieving accounting data immediately and delete the stored access tokens. Financial figures already displayed in the platform remain, since they form part of the club's own operating record, and can be deleted on request.
10. Disconnecting Instagram or Facebook
A club can revoke Concourse's access to its Instagram or Facebook account at any time, and does not need to ask us to do it. In Facebook, go to Settings and privacy, then Settings, then Business integrations, find Concourse Venues, and remove it. In Instagram, the equivalent lives under Settings, then Apps and websites.
On revocation we immediately stop retrieving data from that account and delete the stored access tokens. Performance figures already displayed in the platform remain, since they form part of the club's own marketing record, and can be deleted on request. See Data Deletion.
Revoking access has no effect on the public league benchmarks, because those are built from information every club publishes openly rather than from any connection to us.
11. Children
Concourse is a business tool for club staff and is not directed at children. We do not knowingly collect information from anyone under 16.
12. Changes
If this policy changes materially we will update the date above and notify the clubs using the platform. Continued use after notice constitutes acceptance.
13. Contact
TMS&J LLC, trading as 3AM Solutions and Concourse Venues
1510 Houndslow Court, Bel Air, MD 21014, United States
Email: kevin@solutionsfor3am.com
Web: concoursevenues.com
Data deletion: concoursevenues.com/data-deletion.html