Privacy Policy

1. About This Policy

This Policy describes our data collection, processing, and sharing practices. It applies to all users of the Platform: Athletes, Coaches, Scouts, Agents, and Teams/Academies.

2. Personal Data We Collect

2.1 Account and Registration Data

When you register, we collect:

• Full name or team/academy name
• Email address and password (stored as a secure cryptographic hash via Firebase Authentication)
• User role: Athlete, Coach, Scout, Team/Academy, or Agent/Talent Manager
• Primary sport (for example Cricket, Football, Basketball, Athletics, Badminton, Wrestling)
• Athletics-specific events where applicable (for example sprints, field events)
• Date of birth and calculated age (for individual accounts)
• Location: country, state or union territory, city
• Height (optional, individual accounts only)

2.2 Profile Data

Users may add the following to their profiles:

• Profile photograph (avatar) and banner image
• Biography and playing position
• Public contact email address
• Phone number (used for identity verification via OTP; stored and marked verified or unverified)
• Tournament participation records and player rankings
• Team memberships and club or academy affiliations

2.3 User-Generated Content

• Posts (text, photographs, and video highlights or reels)
• Comments, reposts, and reactions
• Direct messages and chat conversations
• Tournament registration details and performance statistics
• Queries submitted through the Radar talent-discovery feature

2.4 Automatically Collected Technical Data

• Device type, operating system version, browser or app version
• IP address and inferred geographic location
• Usage logs: pages visited, features used, search queries, session duration
• Social graph data: follow relationships and connection history
• Notification interaction events (opens, dismissals)
• Crash reports and error logs
• Security event records, including attempts to access an account, conversation or other resource that you are not authorised to access, together with the IP address, device identifier and account identifier associated with the attempt

2.5 Identity Verification (Planned)

Identity verification through DigiLocker — India’s government-backed digital identity system, via the Meri Pehchaan Single Sign-On service — is planned and is not yet available on the Platform. We do not collect, receive, or store any DigiLocker or Aadhaar-linked identity data today.

When identity verification launches it will be optional and initiated only by you; its own consent will be captured on a dedicated screen at the point of use, stating the exact attributes requested and the purpose for which they will be used; and this Policy will be updated to describe that processing in full before the feature goes live.

Phone number and date of birth are treated as Sensitive Personal Data or Information ("SPDI") under the SPDI Rules and are processed with heightened care.

3. Purposes of Processing

3.1 Platform Operations

• Creating and maintaining your account
• Displaying your public profile to other Platform users
• Enabling social features: posts, follows, connections, messaging, notifications
• Processing tournament registrations and computing player rankings
• Sending transactional communications (email verification, password reset, platform alerts)

3.2 Talent Recruitment and Scouting

A core purpose of the Platform is facilitating athlete discovery by legitimate recruiters and scouts. We process your data to:

• Surface athlete profiles to verified scouts, coaches, agents, and talent managers registered on the Platform
• Provide structured athlete data, including name, age, sport, position, location, height, performance statistics, rankings, and highlight video content, to recruiters affiliated with verified tournaments hosted on or integrated with the Platform
• Power the Radar AI talent-discovery feature, which enables natural-language queries against athlete data on behalf of scouts and recruiters
• Generate data exports and reports delivered to verified tournament operators and their affiliated recruitment staff

Athlete Data Principal Consent: By registering as an Athlete, you provide explicit and informed consent under the DPDP Act for your profile data to be shared with verified tournament recruiters as described in Section 5.1.

3.3 Advertising and Personalisation

• Serving targeted advertisements based on your profile, sport, location, interests, and Platform behaviour
• Personalising your content feed and recommendations
• Measuring advertising effectiveness and reach

We do not serve targeted advertising to users under the age of 18.

3.4 Analytics and Service Improvement

• Analysing usage patterns to improve Platform features and performance
• Conducting sports participation research and developing new services
• Detecting and preventing fraud, abuse, and violations of our Terms

4. Cookies and Tracking Technologies

We and our third-party partners use cookies, web beacons, mobile advertising identifiers (for example GAID, IDFA), and similar tracking technologies to maintain sessions, personalise content, deliver advertisements, and analyse Platform traffic.

You may disable cookies in your browser settings; however, doing so may impair Platform functionality. Our mobile applications use equivalent device-level identifiers, which can be reset through your device settings.

5. Sharing of Personal Data

ALLFORONE SPORTS TECHNOLOGIES PRIVATE LIMITED does not sell personal data. We share personal data only in the circumstances described in this Section. We do not share or disclose the content of private messages exchanged between users, except where required by law under Section 5.3.

5.1 Verified Tournament Recruiters

Athlete personal data, including name, age, height, location, sport, position, performance statistics, rankings, highlight videos, and public contact information, is shared with recruiters who have been verified by, or are affiliated with, tournaments hosted on or integrated with the Platform. This sharing is a fundamental feature of Athlete accounts and forms a core purpose for which consent is sought at registration.

5.2 Data Processors and Service Providers

We engage the following categories of trusted processors who act on our behalf:

• Firebase and Google Cloud (Google LLC): authentication, database, analytics, and push notifications
• Media storage and transformation providers: profile photographs, banners, and highlight videos
• Email delivery service providers: transactional and service communications
• Cloud hosting and infrastructure providers

These processors are bound by data processing agreements and are restricted to processing data solely to provide services to AllFor1.

5.3 Law Enforcement and Regulatory Authorities

We may disclose personal data to government authorities, law enforcement agencies, or courts where required by applicable Indian law, court order, or lawful government direction under the IT Act or any other statute. We will endeavour to provide notice to the Data Principal before such disclosure unless prohibited by law.

5.4 Business Transfers

In the event of a merger, acquisition, asset sale, or restructuring of AllFor1, personal data may be transferred as part of that transaction. We will notify Data Principals before their data becomes subject to a materially different privacy policy.

6. Cross-Border Data Transfers

ALLFORONE SPORTS TECHNOLOGIES PRIVATE LIMITED stores and processes data on cloud infrastructure that may be located outside India. We transfer personal data only to countries or territories notified by the Central Government under the DPDP Act as ensuring adequate data protection, or where appropriate contractual safeguards are in place. By using the Platform, you consent to the transfer of your personal data outside India for the purposes described in this Policy.

7. Data Retention

We retain personal data for as long as your account is active or as needed to fulfil the purposes described in this Policy. Upon account deletion:

• Active profile and content are removed from production systems within 30 days
• Backup copies may be retained for up to 90 days
• Data required for legal, regulatory, or tax compliance may be retained for periods mandated by law
• Anonymised or aggregated data derived from your account may be retained indefinitely and does not constitute personal data

Security event records, including refused access attempts and the IP addresses associated with them, are retained for no longer than 90 days and are then deleted automatically. They are kept separately from your profile data, are used only to detect and investigate misuse of the Platform, and are not used for advertising, personalisation or any purpose unrelated to security.

8. Rights of Data Principals

Under the DPDP Act, you have the following rights as a Data Principal.

8.1 Right to Access Information

You have the right to obtain a summary of the personal data we hold about you and the processing activities carried out on that data. Most of your data is accessible directly within the Platform’s Settings and Edit Profile pages.

8.2 Right to Correction and Erasure

You may request correction of inaccurate or misleading personal data, or erasure of personal data that is no longer necessary for the purpose for which it was collected, subject to legal retention obligations. Account deletion is available via Settings, Danger Zone, Delete Account.

8.3 Right to Grievance Redressal

You have the right to have any grievance regarding the processing of your personal data redressed. Please contact our Grievance Officer (Section 11) within the timelines specified below.

8.4 Right to Nominate

You may nominate another individual to exercise your rights under the DPDP Act in the event of your death or incapacity. Please contact our Grievance Officer to register a nomination.

8.5 Withdrawal of Consent

You may withdraw consent for any or all processing activities at any time by contacting our Grievance Officer or deleting your account. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Certain withdrawals may render the Platform non-functional for your account.

9. Children’s Data (Persons Under 18)

Competitive sport in India is substantially organised in age-group categories, and the Platform is used by athletes under the age of 18. AllFor1 processes the personal data of children only in accordance with Section 9 of the DPDP Act and only on the terms set out below.

9.1 Verifiable Parental Consent

An account for a person under the age of 18 must be created and managed by that person’s parent or legal guardian. By registering such an account, you represent that you are the parent or legal guardian of the child and that you provide verifiable consent on their behalf to the processing described in this Policy. AllFor1 records the identity of the consenting guardian and the date, time, and text of the consent given.

9.2 Restrictions on Processing of Children’s Data

AllFor1 does not, in respect of any user under the age of 18:

• undertake tracking or behavioural monitoring;
• serve targeted or behavioural advertising;
• sell, license, or otherwise monetise personal data;
• carry out any processing likely to cause a detrimental effect on the wellbeing of the child.

9.3 Guardian Rights

A parent or legal guardian may exercise all rights set out in Section 8 on behalf of the child, including access, correction, erasure, and withdrawal of consent. Guardians who believe a child’s data has been collected without proper consent should contact our Grievance Officer immediately, and we will delete that data promptly.

10. Security Measures

ALLFORONE SPORTS TECHNOLOGIES PRIVATE LIMITED implements reasonable security practices and procedures as required under Section 43A of the IT Act and the SPDI Rules, including:

• Encrypted data transmission over HTTPS with TLS 1.2 or above
• Cryptographic hashing and salting of passwords via Firebase Authentication
• OTP-based phone number verification for identity assurance
• Role-based access controls and authenticated API endpoints
• Rate limiting, bot protection, and abuse monitoring systems
• Recording of refused access attempts for security investigation, retained for a limited period and used only to detect and investigate misuse of the Platform
• Encryption of personal data at rest, with access restricted to named application service accounts

No transmission over the internet or electronic storage system is completely secure. While we strive to protect your personal data, we cannot guarantee absolute security. In the event of a data breach affecting your rights or interests, we will notify you and the applicable authority as required under the DPDP Act.

11. Grievance Officer

In accordance with the DPDP Act and the IT Act, ALLFORONE SPORTS TECHNOLOGIES PRIVATE LIMITED has designated a Grievance Officer to address complaints and inquiries regarding the processing of personal data. Grievances will be acknowledged within 24 hours and resolved within 15 days of receipt.

Grievance Officer

Mann Agarwal, Director

Company

ALLFORONE SPORTS TECHNOLOGIES PRIVATE LIMITED

Registered Address

House No M-229/12(5), C-6/S-1, Milroc Woods, Corlim, Corlim IE, Tiswadi, North Goa 403110, Goa

Email

info@allfor1.pro

You also have the right to approach the Data Protection Board of India, once constituted under the DPDP Act, if your grievance is not resolved to your satisfaction.

12. Changes to This Policy

AllFor1 may update this Privacy Policy from time to time. Material changes will be notified to registered Data Principals by email or by a prominent notice on the Platform at least 7 days before the changes take effect. Continued use of the Platform after the effective date constitutes acceptance of the revised Policy. The effective date at the top of this document reflects the most recent revision.

13. Governing Law

This Privacy Policy is governed by the laws of the Republic of India, including the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000. Any disputes arising from this Policy shall be subject to the jurisdiction of the courts at Mumbai, India.