Built to protect your riders' data
Staff roles, strong sign-in, a full audit log, and tools for subject access requests and erasure. Each park runs on its own isolated database.
- 3
- roles: Administrator, Operations and Fulfilment
- 2FA
- with an authenticator app, or a passkey
- Your own
- isolated database and branded address
Staff accounts and roles
Give each person the access their job needs.
Administrator
Everything in the portal, including managing the team.
Operations
Bookings, check-in and customers. Ideal for front-of-house and seasonal staff.
Fulfilment
Merchandise fulfilment and orders.
There is always at least one active administrator, so you cannot lock yourself out by accident. New people get a temporary password and must choose their own at first sign-in.
Strong sign-in
Passwords alone are not enough, so they do not have to be.
Authenticator apps and recovery codes
Add an authenticator app and one-time recovery codes after the password. Codes cannot be replayed.
Passkeys
Sign in with a passkey on its own. It counts as both factors.
Lockout
Five failed attempts lock an account for 15 minutes, and sign-in attempts are rate-limited by address.
Instant revocation
Deactivating someone, changing their role or password, or removing their second factor ends their existing sessions immediately.
Lost second factor
An administrator can remove a lost authenticator or passkeys, unlock an account, or reset a password.
Compliance tools
Answer data requests in minutes.
Audit log
Every change made in the portal: what was done, by whom, when, and to which customer. Filter by team member.
Subject access requests
Find a customer by email address to see every record you hold about them, then export it as a PDF to give to them.
Scrub data
Anonymise a customer by email address. Their personal details are erased everywhere, so nothing that identifies them remains.
Riders' consent
Riders choose whether to receive marketing, and the choice is respected across every connected tool.
Payments and platform
Established services, set up so your data stays yours.
- Paid straight to youConnect your own Stripe account. Rider payments go directly into it, and refunds reverse cleanly.
- Credentials encryptedAuthenticator secrets and your email provider's password or API key are encrypted at rest.
- Rate-limited and verifiedBooking and sign-in endpoints are rate-limited. Returning riders verify their email with a one-time code before their saved details are used.
- Your own deploymentEach park runs on its own isolated database and branded address, so your data is never mixed with anyone else's.
Find out more about Gravity Pass
Online booking
A mobile-friendly booking site in your colours. Riders pick a day and a session, name their group, pay by card and leave with a QR code.
Check-in
Staff scan the QR code on a rider's confirmation and the whole group is checked in. Use the app on iPhone, iPad, Mac or Android, or the check-in page in your management portal.
Merchandise shop
Sell t-shirts, tubes and tokens from a branded online shop that shares your customers, your Stripe account and your vouchers.
Sessions and pricing
Describe your sessions as repeating slots, attach tickets to them, then add season passes, events and vouchers when you need them.
Waivers and safety
One waiver for the whole park, sent to every adult rider as soon as a booking is paid. Riders sign once and are never asked again.
Marketing
Every rider is saved as a customer. New customers are added to Mailchimp or SendGrid automatically, and opt-outs are respected everywhere.
Branding and email
Booking site, shop and emails all carry your logo, your colour and your wording, sent from your own mail server.
Statistics
Built-in statistics for any date range, based on paid bookings. See when riders ride, when they book and what sells, without a spreadsheet.
Ready to fill your next session?
Tell us about your bike park and we'll show you Gravity Pass in action.
Book a demo