Privacy Policy.

01 Who we are

ArenaFlow ("we", "us", "our") is a software platform for sports academies operated by Qubit3 Technologies LLP, registered in India at D404, Sky Heights, Pisoli, Pune- 40.

You can contact us at:

02 What this policy covers

This policy describes what personal data we collect when you use the ArenaFlow mobile app or web portal, how we use it, who we share it with, and your rights.

It applies to:

• Academy owners and coaches who manage their academy through ArenaFlow
• Students registered by an academy
• Parents of registered students

03 The data we collect

We collect the following categories of personal data:

3.1 Account data

• Full name
• Phone number (used for login and OTP)
• Email address
• Password (stored encrypted with bcrypt — we never see the plain text)
• Profile photo (optional)
• Date of birth (students only)
• Emergency contact (optional)

3.2 Academy operational data

• Attendance records linked to your student or coach profile
• Skill assessments and progress notes recorded by coaches
• Fee payment history
• Batch and class assignments
• WhatsApp consent status

3.3 Payment data

• Razorpay payment tokens (we do NOT store full card numbers — Razorpay handles card data under their PCI-DSS compliance)
• Payment amount, date, mode, and receipt number
• Billing address (optional)

3.4 Device and usage data

• Device model and OS version (for crash reports)
• Push notification token
• IP address (for security logging)
• Login timestamps

3.5 Communication data

• Phone number and consent to receive WhatsApp / SMS messages
• Records of automated reminders sent to you
• Support messages you send us

04 How we use your data

We use your data only to:

1. Provide the service — show your attendance, fees, schedules, etc.
2. Process payments — through Razorpay
3. Send legitimate communications — fee reminders, attendance alerts, tournament notifications, sent only when you (or your academy) have enabled the relevant automation
4. Improve the app — anonymous crash reports and usage analytics
5. Comply with the law — including India's Information Technology Act 2000, DPDP Act 2023, and GST regulations for invoicing

05 Who we share your data with

We share data only with the following categories of third parties, and only to the extent needed to deliver the service:

We never share data with advertising networks, data brokers, or social media companies.

06 Where your data is stored

All data is stored on servers physically located in India (Mumbai region). Backups are encrypted and retained for 30 days.

07 How long we keep your data

08 Your rights

Under India's DPDP Act 2023, you have the right to:

• Access — the personal data we hold about you
• Correct — inaccurate data (you can edit your profile directly in the app)
• Erase — your data (contact your academy first; for platform-level data, email us)
• Withdraw consent — at any time (e.g., opt out of WhatsApp reminders)
• File a complaint — with the Data Protection Board of India

09 Children

ArenaFlow is used by sports academies that may register minor students. We do not knowingly collect data from children under 13 without parental consent — minor student accounts are created by the academy under their existing legal relationship with the parent.

Parents have full access to their children's data via the Parent portal in the app.

10 Security

We protect your data with:

• TLS encryption in transit (HTTPS only)
• Bcrypt hashing of all passwords
• Multi-tenant database isolation (each academy in its own database)
• Sanctum token authentication (revocable per-device)
• OTP-based login with rate limiting
• Regular security patches
• Encrypted backups

11 Cookies and tracking

The ArenaFlow web portal uses essential cookies for login session management. We do not use third-party tracking cookies, analytics cookies, or advertising cookies.

The mobile app does not use cookies. It stores your login token in the device's secure storage.

12 Changes to this policy

We may update this policy from time to time. We'll notify you in the app when a material change happens. The date at the top of this page is always the latest version.

13 Grievance officer

In compliance with the Information Technology Rules 2011: