Privacy Policy

1. Introduction

Yugora LLP ("Yugora", "Playify", "we", "us") operates the Playify mobile application and any associated website (the "Platform"), which lets users discover and book sports turfs, arenas, gyms and related facilities ("Venues"), join matches and Tournaments and connect with other players, and lets Venue owners ("Owners") list and manage their Venues.

This Privacy Policy explains what personal data we collect, why, how we use, share, store and protect it, and your rights under Indian law, including the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules made under it as they come into force, the Information Technology Act, 2000 and rules under it, and the Consumer Protection (E-Commerce) Rules, 2020. By creating an account or using the Platform you agree to this Policy. If you do not agree, please do not use the Platform.

2. Definitions

"You" means any individual who uses the Platform, whether as a person booking a Venue or as an Owner.

"Personal Data", "Data Fiduciary", "Data Principal" and "Processing" have the meanings given in the DPDP Act. Yugora LLP is the Data Fiduciary for the Platform; you are the Data Principal.

3. Information We Collect

We collect only what is reasonably necessary to provide and improve the Platform.

3.1 Information you provide

• Account details: name, email address, mobile number, date of birth, gender (optional) and profile photo.
• Owner KYC and business details: business name, address, PAN, GSTIN, bank account/UPI details, Venue ownership or lease proof, Venue photographs and insurance details, collected for verification, settlements and tax compliance (including under Razorpay Route KYC norms).
• Booking details: Venue, sport, date, time slot, number of players and special requests.
• Social and gameplay information: profile and sports preferences, friend and group connections, chat messages, polls, media you share, Solo Queue and Tournament registrations, team rosters, scores and statistics.
• AI feature inputs: goals, training or fitness details and prompts you enter when using AI features. These are optional.
• Communications: messages to support, reviews, ratings, reports and feedback.

3.2 Information collected automatically

• Device information: device model, operating system, identifiers, app version, IP address and notification token.
• Usage data: screens viewed, features used, searches, session duration, and crash or diagnostic logs.
• Location: with your permission, approximate or precise device location to show nearby Venues and Solo Queue matches and to help verify check-in.
• Access logs: QR scans and smart-lock entry events (time, booking ID and credential or device ID) for security and dispute resolution.
• Cookies and similar technologies on any web dashboard, for session management and analytics (Section 11).

3.3 Information from third parties

• Payment status and transaction identifiers from Razorpay. We do not receive or store your full card number, CVV or UPI PIN.
• Sign-in data from Google/Firebase if you choose to sign in that way.

We do not intentionally collect sensitive data such as medical records, biometric data or religious or political beliefs. Please do not enter such information in open text fields (reviews, chat, support or AI prompts).

4. How We Use Your Information

• Create and manage your account and authenticate you.
• Process Bookings, payments, refunds and Owner settlements.
• Run Solo Queue, Find Nearby Players, communities, chat, Tournaments, scoreboards and leaderboards.
• Provide AI features and personalise recommendations (nearby Venues, preferred sports).
• Send booking confirmations, reminders and service notifications by SMS, email, push and WhatsApp.
• Provide customer support and resolve complaints and disputes.
• Detect, investigate and prevent fraud, abuse, cheating and security incidents.
• Comply with law, regulatory requests and lawful orders (including CERT-In directions and Sections 69/69A of the IT Act).
• Send promotional messages only where you have opted in; you can opt out at any time.
• Internal analytics, product improvement and research, using aggregated or de-identified data where possible.

5. Legal Basis and Consent

We process your Personal Data on the basis of your free, specific, informed consent given clearly at the point of collection (for example on a consent screen before registration or when you enable location, notifications or AI features), or where the law permits processing without consent, such as to fulfil a Booking you requested, to comply with law, or to respond to a medical or safety emergency. Consent to optional features and marketing is separate from accepting the Terms. You can withdraw consent at any time in the app settings or by writing to the Grievance Officer; withdrawing is as easy as giving consent. Withdrawal does not affect processing already done and may make some features unavailable.

6. Sharing and Disclosure

We do not sell your Personal Data. We share it only as follows:

• Venue Owners: your name, contact number and booking details needed to honour your reservation. Owners receive this as independent Data Fiduciaries and may use it only to fulfil the Booking.
• Other users: limited profile information you choose to make visible; team rosters to the Tournament Organizer; match participants in Solo Queue (name/profile as shown in the app). We do not show your precise location to other users.
• Payments: Razorpay, an RBI-authorised payment aggregator, for payments, refunds and settlements. Card/UPI credentials are handled by Razorpay and are not stored on our servers.
• Service providers acting on our behalf: Supabase (database and authentication), Railway and Vercel (hosting), Google Firebase (authentication, push notifications and related services), Google Maps (location services), WhatsApp Business (messaging), and providers of SMS/OTP delivery and AI services. Each is bound by contract and by its own security practices.
• Authorities: where required by law, a valid court order, or a directive under the IT Act or CERT-In directions.
• Business transfers: in a merger, acquisition or sale of assets, subject to equivalent privacy protection.
• With your consent for any other purpose.

7. Data Storage and Security

Your data is primarily stored on Supabase infrastructure and is encrypted at rest and in transit (TLS/HTTPS). We use Row-Level Security so that Users and Owners can access only their own data, role-based access controls, rate limiting and secure secret management. Owner KYC documents are kept in private storage with restricted access. Although we take reasonable technical and organisational measures, no method of transmission or storage is completely secure and we cannot guarantee absolute security.

8. Data Retention

We keep Personal Data only as long as needed for the purposes in this Policy or as required by law. Our Data Retention Schedule sets out the periods for each category. Examples: financial and tax records for up to 8 years; server and security logs for at least 180 days as required by CERT-In directions. When no longer needed, data is deleted or irreversibly anonymised.

9. Your Rights

Under the DPDP Act, 2023 you have the right to:

• access a summary of the Personal Data we hold about you, how it is processed and who it is shared with;
• correct, complete or update your Personal Data;
• request erasure of your Personal Data, subject to legal retention requirements;
• withdraw consent at any time;
• nominate another person to exercise these rights if you die or become incapacitated; and
• have your grievance addressed by us and, if unresolved, complain to the Data Protection Board of India.

Exercise these rights through the in-app Privacy Settings ("Download My Data", "Delete My Account") or by writing to the Grievance Officer from your registered email or phone number. We verify your identity first, acknowledge requests within 3 working days and respond within 15 days. We may decline a request only where the law requires us to keep the data or the request is repeated or unfounded, and we will tell you why.

10. Children

The Platform is for people aged 10 and over. We do not knowingly collect Personal Data from children under 10 and do not allow accounts for them. Where children under 10 use Venue facilities under adult supervision, no account or data collection from the child is needed.

Under the DPDP Act, a person under 18 is a "child". For users aged 10 to 17, we process Personal Data only after obtaining verifiable consent from their parent or lawful guardian, and the parent or guardian may exercise the child's rights under Section 9 on their behalf. For these users we do not carry out tracking or behavioural monitoring, do not show targeted advertising, and do not process their data in any way likely to harm their well-being. Some features, such as Find Nearby Players, chat with people outside their friend list, location-based matching and AI features, may be restricted or unavailable to users under 18.

If a parent or guardian believes a child under 10 has an account, or that we hold a child's data without their consent, contact the Grievance Officer and we will verify and delete it.

11. Cookies and Tracking Technologies

Any web dashboard may use cookies for session management, security and analytics. Non-essential and analytics cookies are used only with your consent through a cookie banner. You can also control cookies through your browser. The mobile apps do not use browser cookies; device identifiers are described in Section 3.2.

12. Automated Processing and AI

We use automated processing to rank Venues, detect fraud and abuse, generate AI suggestions and build Tournament brackets. None of these decides anything with legal or similarly significant effect on you without a route to human review; you can ask the Grievance Officer to have a person review any restriction placed on your account or payout. See the AI Use Policy.

13. Third-Party Links and Services

The Platform may link to or integrate services such as Google Maps, Razorpay and WhatsApp Business. This Policy does not apply to those services; please review their privacy policies.

14. Cross-Border Data Transfer

Some providers (for example Google/Firebase, Railway, Vercel and AI or messaging providers) may process data on servers outside India. We send only what is needed, use providers under contractual security commitments, comply with any restrictions notified by the Government of India, and, where feasible, keep our primary database in India (Mumbai). You can limit such transfers by turning off optional features such as AI and location.

15. Data Breach Notification

If a personal data breach occurs, we will notify affected Users and the Data Protection Board of India as required by the DPDP Act and Rules, and report reportable cyber incidents to CERT-In within 6 hours as required by the CERT-In Directions, 2022.

16. Changes to This Policy

We may update this Policy to reflect changes in practice or law. We will notify material changes in the app or by email before they apply and update the "Last Updated" date.

17. Grievance Officer and Contact

In accordance with the Information Technology Act, 2000, its rules and the DPDP Act, 2023:

We acknowledge complaints within 24 hours and resolve them within 15 days, or such other period as the law prescribes. If unresolved, you may approach the Data Protection Board of India.

18. Governing Law

This Policy is governed by the laws of India. Subject to your statutory rights, the courts at Pune, Maharashtra have exclusive jurisdiction.