Privacy Policy

Last updated: 10 November 2026

This policy explains how Subastra (“we”, “us”), an unregistered business run by its owner in Malappuram, Kerala, India, handles personal data when you use subastra.app. We follow India’s Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.

1. Data we collect

• Account details: your name, email address and password (stored only in scrambled, encrypted form; we never see it).
• Workspace content you add: league, team and player names, player details, photos, videos, logos, bids and results.
• Payment details you submit: the plan, amount, UTR / reference number, and optionally the payer’s name and UPI ID. We do not collect card numbers, bank account numbers or UPI PINs.
• Technical data: basic logs such as sign-in times, IP address and browser type, used for security and to fix problems.

2. Why we use it

• to create and secure your account and workspace;
• to run the auction, scoring and display features you use;
• to check payments and switch on plans;
• to send service emails, such as sign-in links, password resets, payment confirmations and important notices;
• to prevent abuse and keep the service safe;
• to meet legal obligations.

We do not sell your data, show advertising, or use advertising trackers.

3. Player and participant data

When an organiser adds players or other people to a workspace, the organiser decides what is added and is responsible for having their permission (and a parent’s or guardian’s permission for anyone under 18). We store and process that data only on the organiser’s instructions, to provide the service. Players who want their data changed or removed can contact the organiser, or us at [email protected] and we will pass the request on and help.

4. Who we share data with

We use trusted service providers to run Subastra. They process data only on our behalf:

• Supabase: database and sign-in (servers in Mumbai, India);
• Cloudflare: website hosting, security and email forwarding;
• Resend: sending service emails.

Some of these providers may process limited data outside India under their own security and privacy commitments. We may also share data if required by law or to protect people’s safety. Anything you choose to make public (for example a public score link or broadcast screen) can be seen by anyone with the link.

5. How long we keep it

• Account details: while your account is open, and up to 90 days after you ask us to delete it.
• Workspace content: for trials never upgraded, up to 30 days after the trial ends; for paid plans, up to 180 days after the plan ends, unless you renew.
• Payment records: as long as Indian tax and accounting law requires (usually up to 8 years).

6. Security

Each workspace is separated by database security rules so customers cannot see each other’s data. Connections are encrypted (HTTPS), passwords are never stored in readable form, and administrator access needs a second-factor code. No system is perfectly secure; if a data breach affects you, we will tell you and the authorities as the law requires.

7. Cookies and storage

We use only what is needed to keep you signed in and remember your choices (browser storage). We do not use advertising or tracking cookies.

8. Your rights

You can ask to access, correct, update or delete your personal data, withdraw consent, or nominate someone to act for you. Email [email protected] from your account email. We will reply within 30 days. Withdrawing consent may mean we can no longer provide the service to you.

9. Children

Accounts are for people aged 18 or over. We do not knowingly create accounts for children.

10. Grievance contact

Grievance contact: the Subastra owner, [email protected], Malappuram, Kerala, India. We acknowledge complaints within 48 hours and aim to resolve them within 15 days. If you are not satisfied, you may complain to the Data Protection Board of India.

11. Changes

We may update this policy. The date at the top shows the latest version, and we will email account owners about important changes.