Privacy Policy

[Legal name of the company that runs CricOps]("we", "us") provides CricOps. There are two kinds of information in it, and our role differs for each:

• An academy's records(its students, guardians, coaches, attendance, fees, matches and documents). The academy decides what to record and why, so the academy is responsible for it (under Indian law, the "data fiduciary"). We store and process it on the academy's behalf and under its instructions.
• Account and billing information of the people who sign in and of the academy as our customer. For this we decide how it is used, and we are responsible for it.

If you are a parent or student and have a question about your own records, start with your academy. If you are not sure who to ask, write to us.

People who sign in (owners, admins and coaches): name, email, phone number, role, the branches they can access, and a password, which we store only in scrambled (hashed) form. We also keep the time of their last sign-in and, for each signed-in device, the browser identifier and when it signed in.

Students and applicants, as entered by the academy: name, date of birth, gender, playing role, phone, email, address, city and pincode, an emergency contact, enrolment and batch details, attendance, fee and payment records, and match and performance statistics. A photograph may be added.

Guardians: name, relationship, phone and email.

Coaches and staff: name, contact details, title, qualifications, experience and joining date.

Documents an academy chooses to upload, such as age proof, ID proof, medical fitness certificates, parental consent forms and photographs. Some of these are sensitive. Academies should upload only what they need.

Subscription payments: the plan, amount, date, status and payment method type (for example UPI or card), and the identifiers Razorpay gives us. Payments are taken by Razorpay on its own pages. We never see or store your card, UPI or bank details.

Activity and security records: an audit log of important actions (who changed what, and when) and technical logs used to keep the service running and secure.

We do not use advertising or analytics trackers on CricOps.

• To provide CricOps to the academy: showing and keeping its records, sending in-app notices, and calculating attendance, dues and statistics.
• To sign people in and keep accounts secure, including limiting repeated failed attempts.
• To take and record payments for plans, issue receipts, and apply a plan's limits and features.
• To keep the service reliable, investigate problems and prevent misuse.
• To tell academies about changes to the service, their plan, or this policy.
• To meet legal obligations.

We do not sell personal information, and we do not use students' information for advertising.

Most students are under 18. Students and parents do not have CricOps accounts: an academy's staff enter and use the information. The academy is responsible for getting a parent or guardian's consent before recording a child's information, and for recording only what it needs. We do not track or profile children for behavioural or advertising purposes, and we do not send them marketing.

• The academy's own people. Owners see their whole academy. Admins and coaches see what their role and branch allow; a coach sees only their own batches.
• CricOps platform administrators.They manage accounts (names, emails and roles), plans and subscriptions, and see totals such as the number of students, not the student records themselves. They can read an academy's records only if the academy's owner opens a time-limited support window, and those actions are logged.
• Service providers who help us run CricOps, only as needed to do so: Razorpay (payments), [Hosting and database provider and the region where data is stored] (hosting and database), [Document storage provider] (document storage) and [Email provider] (email).
• Authorities, when the law requires it.

We use only what the service needs:

• Sign-in cookies, which keep you signed in. They are not readable by scripts on the page and are used for nothing else.
• Your browser's local storage, for preferences such as light or dark theme, notices you have dismissed, and match scoring that is waiting to be sent if your connection drops.

You can clear these in your browser at any time. You will be signed out.

• Connections are encrypted (HTTPS).
• Passwords are stored hashed, never in readable form.
• Access is checked on the server for every request, by role and branch, and one academy can never see another's records.
• Uploaded documents are kept in private storage and opened through short-lived links.
• Repeated wrong passwords lock an account for a while, and important actions are written to an audit log.

No system is perfectly secure. If a breach affects personal information, we will tell the affected academies and the authorities as the law requires.

We keep an academy's records while its account is open. Within the academy, staff can mark students inactive and archive branches; this keeps history that fees and attendance depend on. After an academy closes: [How long an academy's data is kept after it closes, and how it can be exported or deleted]. Records of payments to us are kept as long as tax and accounting law requires.

Under India's Digital Personal Data Protection Act, 2023 you may ask to see the personal information held about you, have it corrected or completed, have it erased where the law allows, nominate someone to act for you, and complain if something has gone wrong. For a child, a parent or guardian makes the request.

Requests about an academy's records usually need the academy to act, so please contact the academy first. You can also write to us at [Support and privacy contact email], and we will help the academy respond. We may need to confirm who you are before we act.

If you have a concern, write to our grievance officer: [Name and designation of the grievance officer], [Grievance officer's email]. We aim to acknowledge it promptly and resolve it within a reasonable time. If you are not satisfied, you may approach the Data Protection Board of India once it is in place.

We may update this policy. We will post the new version here with its effective date and, for significant changes, tell academy owners in the app or by email.

[Legal name of the company that runs CricOps]
[Registered office address]
[Support and privacy contact email]