Privacy Policy

CricClubOS (“we”, “us”, or “our”) is committed to protecting your privacy. This Privacy Policy explains what personal information we collect, how we use it, and the choices you have. By using the CricClubOS platform (the “Service”), you agree to the practices described in this policy.

1. Who We Are

CricClubOS is a software-as-a-service platform that helps amateur and community cricket clubs manage their members, teams, finances, net sessions, events, and more. In data-protection terms, CricClubOS acts as both a data controller (for account and usage data we collect directly from you) and a data processor (for personal data that Club Admins upload about their Members).

If you have questions about this policy, contact us at privacy@cricclubos.com.

2. Information We Collect

We collect information in the following ways:

• Account information: When a Club Admin registers, we collect their name, email address, and the club name.
• Member information:Club Admins may add Members to the Service, providing the member’s name, phone number, and optionally their email address.
• Club verification documents: As part of reviewing and approving a new Club, we may ask you to provide documents to verify that you own or are authorised to operate the Club. We use these only to confirm ownership and retain them no longer than necessary for that purpose.
• Bot-protection data:Our sign-up form is protected by Google reCAPTCHA. To assess whether an interaction is automated, reCAPTCHA collects hardware and software information (such as device and application data) and sends it to Google for analysis. This use is subject to Google’s Privacy Policy and Terms of Service.
• Financial and operational data: Fee records, subscription payments, prize-money distributions, session attendance, and other club-management data entered into the Service.
• Usage data: Log files, IP addresses, browser type, device identifiers, pages visited, and actions taken within the Service.
• Communications: If you contact us for support or send us feedback, we retain those communications.
• Cookies and similar technologies: We use session cookies and local-storage tokens to keep you signed in and remember your preferences (e.g., colour theme). We do not use advertising or tracking cookies.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service.
• Process subscription payments and manage billing through our payment processor.
• Send transactional emails (account verification, password reset, invoices, and important service announcements).
• Respond to support requests and improve the Service based on feedback.
• Monitor and analyse usage to detect bugs, prevent abuse, and improve reliability and performance.
• Comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information to third parties. We do not use Club Data for advertising purposes.

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, we process personal data under the following legal bases:

• Contract performance: Processing necessary to provide the Service you have subscribed to.
• Legitimate interests: Security monitoring, fraud prevention, and product improvement, where these interests are not overridden by your rights.
• Legal obligation: Where we are required by law to retain or disclose information.
• Consent: For any optional communications beyond transactional emails, where we will ask for your explicit consent.

5. Club Admins and Member Data

Club Admins are responsible for ensuring they have a valid legal basis to collect, store, and process personal information about their Members within CricClubOS. This includes obtaining informed consent from Members where required by applicable data-protection law.

We process Member data solely on the instructions of the Club Admin and only for the purposes of providing the Service. We will not access Member data except to provide technical support (with the Club Admin’s authorisation) or where required by law.

6. How We Share Information

We share personal information only in the following limited circumstances:

• Service providers: We engage trusted third-party vendors to help operate the Service (e.g., cloud hosting, email delivery, payment processing, identity and authentication). These vendors are contractually bound to handle data only as instructed and in accordance with this policy.
• Legal requirements: We may disclose information if required by law, court order, or governmental authority, or to protect the rights, property, or safety of CricClubOS, its users, or the public.
• Business transfers: If CricClubOS is acquired or merges with another entity, your information may be transferred as part of that transaction. We will provide notice before your personal data is transferred and becomes subject to a different privacy policy.

7. Data Retention

We retain personal data for as long as your account is active or as needed to provide the Service. After account deletion or subscription cancellation:

• Club Data (member records, financials, etc.) is retained for up to 30 days to allow you to export it, then permanently deleted.
• Billing records and invoices are retained for up to 7 years as required by financial regulations.
• Anonymised or aggregated usage statistics that cannot identify individuals may be retained indefinitely.

8. Data Security

We implement industry-standard technical and organisational measures to protect your personal information against unauthorised access, loss, misuse, or alteration. These include:

• Encryption in transit (TLS 1.2+) and at rest.
• Role-based access controls so only authorised personnel can access production data.
• Regular backups and disaster-recovery procedures.
• Authentication managed through a dedicated identity provider (Keycloak) with support for strong passwords and session management.

Despite our best efforts, no method of transmission over the internet or electronic storage is 100% secure. We encourage you to use a strong, unique password for your CricClubOS account.

9. Your Rights

Depending on where you are located, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Ask us to correct inaccurate or incomplete data.
• Erasure:Ask us to delete your personal data (“right to be forgotten”), subject to legal retention obligations.
• Restriction: Ask us to restrict processing of your data in certain circumstances.
• Data portability: Receive your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at privacy@cricclubos.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data-protection authority.

10. Cookies

We use only strictly necessary cookies required to operate the Service:

• Session cookies: Maintain your authenticated session while you are logged in.
• Preference cookies: Store your UI preferences such as light/dark theme, persisted in localStorage.

We do not use analytics, advertising, or third-party tracking cookies. You can disable cookies in your browser settings, but this will prevent you from logging in to the Service.

11. Third-Party Services

CricClubOS integrates with or relies on the following categories of third-party services:

• Cloud infrastructure: Our servers and database are hosted on reputable cloud providers that maintain SOC 2 and/or ISO 27001 certifications.
• Payment processing: Subscription payments are handled by a PCI-DSS-compliant payment processor. We never store full card numbers.
• Email delivery: Transactional emails are sent through a third-party email service.
• Bot protection:Our sign-up form uses Google reCAPTCHA to detect and block automated abuse, subject to Google’s privacy policy.
• AI features: Certain AI-powered features (e.g., the club chat assistant) may send anonymised or contextual data to an AI provider. No personally identifiable Member data is shared without explicit disclosure.

Each provider is subject to their own privacy policy. We encourage you to review those policies where relevant.

12. Children’s Privacy

The Service is not directed at children under 13 years of age. We do not knowingly collect personal information directly from children under 13. Club Admins who add youth players to the Service are responsible for obtaining appropriate parental or guardian consent as required by applicable law.

13. International Data Transfers

Your personal data may be stored and processed in countries outside your country of residence, including countries that may not provide the same level of data protection as your home country. Where such transfers occur, we ensure that appropriate safeguards are in place (e.g., Standard Contractual Clauses under GDPR).

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will post the revised policy on this page, update the effective date, and notify you by email or in-app notification at least 14 days before the changes take effect. Your continued use of the Service after the effective date constitutes your acceptance of the updated policy.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data-handling practices, please contact us at:

privacy@cricclubos.com