Privacy Policy

ArenaPilot is a sports facility management platform developed and operated by YoTechSYS. It helps gyms, turfs, courts and sports academies manage members, collect payments, automate renewals and understand their revenue from a single dashboard.

In this policy, “ArenaPilot”, “we”, “us” and “our” refer to YoTechSYS operating the ArenaPilot platform. “You” refers to the person reading it — whether you run a facility, work at one, or are a member of one.

We wrote this policy to be read, not to be survived. If anything here is unclear, write to [email protected] and we will explain it in plain language.

ArenaPilot is business software. That means two different relationships run through the same product, and your rights depend on which one applies to you.

Where we act as a processor, the facility is the controller (a “Data Fiduciary” under India’s DPDP Act) and we are the processor (a “Data Processor”). If you contact us directly about member data, we will route your request to the relevant facility rather than act unilaterally on their records — and we will tell you that we have.

This policy does not cover the independent practices of a facility that uses ArenaPilot, or any third-party site we link to.

We collect only what the product needs to work. There is no data brokerage in our business model — we do not buy personal data, and we do not sell it.

Information you give us

• Account and identity — your name, mobile number, email address and, if you sign in with Google, the basic profile information Google returns (name, email, profile picture). We verify mobile numbers with a one-time password (OTP).
• Facility details — your facility’s name, type, address, operating hours, branches, plans, pricing and staff roles.
• Member records you enter — the details a facility records about its members and enquiries: name, contact details, plan, membership dates, attendance, payment and dues history, and any documents or notes it chooses to upload.
• Payment records — the amount, mode (cash, UPI, card, bank transfer), date and status of payments recorded against a member, plus invoices generated from them.
• Communications — messages you send us for support, demo requests, and early-access sign-ups.

Information we collect automatically

• Crash diagnostics — if the Android app crashes, an automatic report describing the failure. See “Cookies, storage & analytics” below for exactly what one contains and what is stripped out of it. We do not record which screens you open or which features you use.
• Device and technical data — see “Device information”.
• Log data — timestamps, error traces and security events generated when the app calls our servers. These are retained for reliability and abuse prevention.

We use personal data for these purposes and no others:

• To provide the service — authenticate you, render your dashboard, store your records, generate invoices and reports, and keep the platform working across your devices.
• To send operational messages — OTPs, renewal and dues reminders, receipts, and service notices such as downtime or security advisories.
• To take payment — to start, renew, or end your ArenaPilot subscription, and to meet tax and accounting obligations.
• To support you — to answer your questions and diagnose faults you report.
• To improve the product — to understand which features are used and where people get stuck, using aggregated and de-identified analytics wherever it will do the job.
• To keep the platform safe — to detect fraud, abuse and unauthorised access, and to enforce our Terms & Conditions.
• To meet legal obligations — to comply with applicable law and respond to valid legal process.

We do not use your data, or your members’ data, to train machine learning models for other customers, and we do not sell or rent it to advertisers or data brokers.

If you are in the European Economic Area or the United Kingdom, the GDPR requires us to name a lawful basis for each use. Ours are:

Under India’s Digital Personal Data Protection Act, 2023 (DPDP Act), we process personal data either with your consent or for the “legitimate uses” the Act permits — including where you have voluntarily provided data for a purpose you have not objected to, and where processing is required to comply with law. Where we rely on consent, we ask for it in clear language, at the point it matters, and you can withdraw it as easily as you gave it.

ArenaPilot uses cookies and similar browser storage. We keep the list short and we do not run third-party advertising or cross-site tracking cookies.

Analytics, specifically

We do not run analytics. ArenaPilot ships no analytics or product-telemetry SDK — not Google Analytics, not Firebase Analytics, not a third-party alternative — on the marketing site, in the web dashboard or in the Android app. No behavioural event is recorded about you, and no advertising or cross-site tracking identifier is collected. We do not use an advertising ID.

If we introduce analytics later, we will say so here and update our Google Play Data Safety declaration before the release that enables it.

Crash diagnostics

The Android app uses Firebase Crashlytics, provided by Google, to report crashes and errors so we can fix them. A report contains the error type, the code location it happened in (a stack trace), the app version, and basic device and OS information.

It is deliberately built not to carry personal data: error messages are scrubbed before they are sent, so member names, phone numbers, email addresses, payment amounts, one-time codes and sign-in tokens are stripped and replaced with a placeholder. Reports are tagged with a random identifier generated on your device that lets us group several crashes as coming from one installation. That identifier is not your account, your facility or your phone number, and it tells us nothing about who you are.

Device information

When you use ArenaPilot on the web or on our Android app, we automatically receive:

• Device type, operating system and version, and (on the web) browser type and version.
• Screen size and language, so we can render the right layout.
• A pseudonymous app-instance identifier, used to keep your session valid. The Android app additionally generates a random identifier stored only on your device, used to group crash reports from the same installation. Neither identifies you, and neither is an advertising identifier — we do not collect one.
• Your IP address, which our infrastructure necessarily receives in order to deliver a response, and which we use for security and abuse prevention.

Location

The Android app never asks for or receives your location. It requests no location permission of any kind, so there is nothing to switch off. On the web dashboard, your browser may offer to share precise location for optional conveniences such as pre-filling your facility’s address during setup; that always requires your explicit permission and can be revoked in your browser at any time. Separately, we derive an approximate location (city or region) from your IP address for security and abuse prevention; this is not precise location and cannot be switched off without blocking the service itself, because every internet request carries an IP address.

In-app notifications

Renewal alerts, staff updates and similar messages appear in ArenaPilot’s own notification centre, which you see when you open the app or the dashboard. They are stored with your facility’s data and shown only to the person they are addressed to.

Push notifications (Android app)

The Android app can send push notifications for operational events — new enquiries, renewals due, payments recorded — and occasional product announcements. Android asks for your permission first: the app requests the notification permission only after you have signed in and reached the dashboard, and you can decline or turn it off at any time in your device settings without losing any other functionality.

To deliver a push, Firebase Cloud Messaging (a Google service) issues a device registration token for your installation. We store that token against your staff or owner account under your facility so the right device is notified, and we delete it when you sign out. The token identifies a device installation, not you personally, and is never shared with anyone other than Google as the delivery provider. Notification content is limited to the same information already shown in the app.

Email notifications

Transactional email — OTP and sign-in mail, receipts, renewal reminders, staff invitations and security notices — is sent through Resend, our email delivery provider. These messages are part of the service and are not marketing, so they are not subject to an unsubscribe link; if you no longer want them, close your account. Any genuine marketing email we send is separate, requires your consent, and carries a one-click unsubscribe that we honour.

WhatsApp notifications

ArenaPilot may use a member’s or customer’s phone number to provide WhatsApp communications on behalf of the relevant facility. These operational and service communications may include membership information, payment confirmations and receipts, renewal or expiry reminders, account and service updates, and other facility-related notifications.

Server-side messaging is provided through Meta’s WhatsApp Business Platform / WhatsApp Cloud API. Necessary messaging information, such as the recipient’s phone number and message content, may be transmitted to Meta/WhatsApp for delivery and related functionality. ArenaPilot may also process message identifiers and delivery or status events where necessary to operate the feature. Meta/WhatsApp also processes information under WhatsApp’s privacy policy.

Where ArenaPilot opens WhatsApp on your device with a suggested message, you still review and send it yourself from your own account. Marketing or promotional WhatsApp communications must follow applicable consent and opt-in requirements and your communication preferences. We do not sell personal information because this integration exists. For privacy or data requests, contact [email protected]; for facility-controlled member data, you may also contact your facility.

Your ArenaPilot subscription

Subscription payments to ArenaPilot are processed by Razorpay Software Private Limited, an RBI-authorised payment aggregator. When you pay, your card, UPI or netbanking credentials are collected and processed by Razorpay on their own systems under their privacy policy.

Payments your members make to you

Payments a member makes to a facility are, by default, recorded in ArenaPilot rather than collected through it — your staff mark a payment as received in cash, UPI, card or bank transfer. In that case ArenaPilot holds a bookkeeping record, not a payment instrument, and no financial credentials pass through us.

We keep transaction records for as long as tax and accounting law requires — see “Data retention”.

We keep our vendor list deliberately small. Each one is bound by a contract limiting them to processing data only for us, and each is named here so you can read their terms yourself.

Our primary data store is hosted in India. Some providers above process data outside India — including in the United States and the European Union — and some deliver content from a global edge network. Where personal data protected by the GDPR moves outside the EEA or UK, we rely on the European Commission’s Standard Contractual Clauses or an adequacy decision, and on our providers’ own transfer frameworks. Under the DPDP Act, we may transfer personal data outside India except to territories the Indian government restricts; we monitor that list and will comply with it.

We do not sell your personal data. We do not share it for cross-context behavioural advertising. We disclose it only in these situations:

• With your facility — if you are a member, your record is visible to the facility that registered you and to the staff it authorises.
• With the service providers named above — strictly to run the platform, and only for that.
• On your instruction — for example when you export a report or share an invoice.
• For legal reasons — where we are compelled by a valid, binding legal request. We assess each request, and where we are permitted to notify you before disclosure, we will.
• In a business transfer — if YoTechSYS is involved in a merger, acquisition or sale of assets, data may transfer to the successor, who will remain bound by this policy or a materially equivalent one. We will notify you before your data becomes subject to a different policy.

We keep personal data only as long as it serves the purpose it was collected for, or as long as the law requires — whichever is longer.

When a retention period ends, we delete the data or irreversibly de-identify it so it can no longer be linked to you.

Security is a first-class concern, not a footnote. In summary: all traffic is encrypted with TLS (HTTPS) in transit and data is encrypted at rest; access is authenticated by Firebase Authentication and authorised by Firestore Security Rules enforced server-side; staff permissions are role-based and least-privilege; and every facility’s data is strictly isolated from every other.

Our Security page sets out our controls, our infrastructure, our monitoring and how to report a vulnerability responsibly.

No system is perfectly secure, and we will not pretend otherwise. If a personal data breach occurs that is likely to affect you, we will notify you and the relevant authority — including the Data Protection Board of India under the DPDP Act, and, where the GDPR applies, the competent supervisory authority within 72 hours of becoming aware of it.

You have real, exercisable rights over your personal data. Depending on where you live, these include:

• Access — a copy of the personal data we hold about you, and information about how we use it.
• Correction — to fix data that is inaccurate, incomplete or out of date.
• Erasure — to have your data deleted where we have no overriding legal reason to keep it.
• Portability — to receive your data in a structured, machine-readable format, or have it sent to another provider where technically feasible.
• Restriction and objection — to limit or object to processing based on our legitimate interests, including profiling.
• Withdraw consent — at any time, where we relied on your consent. Withdrawal does not undo processing already carried out lawfully before you withdrew.
• Nominate — under the DPDP Act, to nominate someone to exercise your rights if you die or become incapacitated.
• Complain — to us first, and then to a regulator. See “Grievance redressal”.

How to exercise them

Email [email protected] from the address or with the mobile number registered to your account. We may ask you to verify your identity — we will not hand your data to someone claiming to be you. We respond within 30 days. If a request is genuinely complex we may extend this, and we will tell you why before the 30 days expire. Exercising your rights is free; we only charge for requests that are manifestly unfounded or repetitive, and we will say so first rather than surprise you.

You can close your ArenaPilot account and have your data deleted. There is no retention trap and no “contact your account manager” maze.

How to delete your account

• From the Android app — the fastest route, and it needs no help from us. Sign in as the facility owner and go to Profile → Account → Delete account. You confirm by typing your facility name, and the deletion starts immediately.
• If you cannot open the app — email [email protected] from your registered email address with the subject “Delete my account”, or call +91 93856 21610. We verify that the request genuinely comes from the account owner before we act.

Full step-by-step instructions, the exact list of what is erased and what we must keep, live on our account deletion page.

What happens next

• Your account is deactivated immediately and sign-in stops working.
• We keep the data for a 15-day grace period, so an accidental or malicious deletion can be reversed — contact us within that window and we will restore the account.
• After the 15-day grace period, your account, facility and member records are permanently and automatically deleted from our live systems — this is irreversible and runs on its own, on a daily purge schedule, without waiting for anyone at ArenaPilot to approve it — and age out of backups within 30 days after that.
• Exception: payment, invoice and tax records are retained for the statutory period described in “Data retention”. We cannot delete these, because Indian law requires us to keep them.

Export your data first. Deletion is permanent and we cannot recover it afterwards. Ask us for an export before you delete, and we will provide it.

ArenaPilot is business software and is not directed at children. You must be 18 or older to hold an ArenaPilot account.

We recognise that sports academies legitimately enrol children as members. Where a facility records a member under 18, the facility is the controller of that record and is responsible for obtaining verifiable consent from a parent or legal guardian, as the DPDP Act requires. Facilities must not use ArenaPilot to track a child’s behaviour or to direct advertising at children — both are prohibited by the DPDP Act and by our Terms.

If you believe a child’s data has reached us without proper consent, write to [email protected] and we will act promptly.

If you are unhappy with how we have handled your personal data or your request, we want to hear it first — most issues are a misunderstanding we can fix quickly.

• Grievance Officer, ArenaPilot (YoTechSYS) — email [email protected] with “Grievance” in the subject line, or call +91 93856 21610.
• We acknowledge every grievance within 72 hours and aim to resolve it within 30 days, as the DPDP Act and India’s IT Rules require.

If we cannot resolve it, you may escalate: in India, to the Data Protection Board of India; in the EEA or UK, to your local supervisory authority or the UK Information Commissioner’s Office. You are entitled to complain to a regulator without going through us first — we would simply rather earn the chance to put it right.

We update this policy when the product or the law changes. When we do, we revise the “Last updated” date at the top of this page.

If a change materially affects your rights — a new purpose, a new category of data, or a new class of recipient — we will give you at least 30 days’ notice by email or an in-app notice before it takes effect, and where the law requires consent, we will ask for it rather than assume it. We will not quietly broaden what we do with your data and rely on you not reading this page.

ArenaPilot is developed and operated by YoTechSYS. For any question about this policy, a data request, or a grievance:

• Email — [email protected]
• Phone — +91 93856 21610
• Web — yotechsys.in

We read every message that arrives at this address, and a person — not an autoresponder — will reply.