This Privacy Policy explains what PlayClash collects, how we use it, who sees it, how long we keep it, and your rights. PlayClash is operated by AILAB Solutions, LLC (Delaware, USA).
1. What we collect
You give us:
- Account details — name, email, phone, date of birth, country, chosen sports and position.
- Profile content — photo, bio, team roles, match history, posts, comments, direct messages, uploaded videos and live streams.
- Payment details — handled by Stripe or PayFast; we store only the token, last four digits and brand, never the full card number.
- KYC details (for payout recipients) — government ID image, bank account number.
- Guardian consent (for users under 18) — the guardian's name and email, and their signed-link approval.
We collect automatically:
- Device information — model, OS version, app version, language, approximate time zone.
- Technical logs — IP address, user agent, pages visited, API calls, errors, with a request ID so you can trace a specific interaction.
- Approximate location, only when you grant it — rounded to about one kilometre; we do not store exact GPS coordinates for users (venue coordinates are public).
- Match data — events you record (score, cards, goals, overs) and the derived statistics and rankings.
We receive from third parties:
- Payment status from Stripe and PayFast webhooks.
- Delivery status from push-notification and email providers.
- Social-login identity (name and email) from Google or Apple, if you sign in that way.
2. Why we use it
- To run the service — show you players, teams, matches, venues; collect and remit booking payments; display rankings; keep an audit trail.
- To keep PlayClash safe — detect fraud, abusive behaviour, cheating, duplicate accounts; respond to reports; enforce these Terms.
- To comply with the law — tax reporting, KYC/AML, court orders, government requests we are legally required to answer.
- To improve the service — anonymised, aggregated analytics about which features work. We do not sell this data.
- To contact you — transactional messages (receipts, booking confirmations, security alerts) always; marketing only with your consent and only by email or push, never by phone call.
3. Who sees it
- Other users — your public profile fields (as you configured), your public match record and the posts you share. Direct messages are visible to the recipient; we do not read them, but moderators may read a specific thread if it is reported.
- Venues — your name and contact when you book with them.
- Our vendors, who process data on our behalf under written agreements:
- Hosting & database — AILAB Solutions' Oracle Cloud infrastructure in Jeddah, Saudi Arabia.
- Payments — Stripe (USA/EU/India/UAE) and PayFast Pakistan.
- Email — Resend (USA).
- Push notifications & sign-in — Google Firebase (USA), Apple (USA).
- Video & media — Cloudflare R2 and Cloudflare Stream (USA/global).
- Error logging — our own infrastructure; we do not use Sentry or similar.
- Authorities, only when required by valid legal process.
- We never sell your personal data to a third party.
4. International transfers
Our servers are in Jeddah; some of our vendors are in the USA, EU and elsewhere. When your data crosses borders we rely on the vendor's standard contractual clauses or an equivalent safeguard.
5. How long we keep it
- Your profile, posts and match history — while your account is active, plus a 30-day grace period after you delete the account so you can recover it.
- Ledger entries, bookings, invoices and KYC — seven years after the entry, as required by financial record-keeping laws.
- Approximate location — 90 days, then deleted.
- Audit log and anti-fraud signals — up to two years.
- Direct messages — until you or the recipient deletes them, or two years after the account closes.
- Guardian consent records — until the child turns 18 plus three years.
6. Your rights
Regardless of where you live, you can:
- See what we hold about you (Settings → Download my data).
- Correct your profile.
- Delete your account (Settings → Delete account). Financial records are retained as noted in section 5.
- Object to a specific use of your data by writing to [email protected].
- Withdraw a consent you earlier granted (push, marketing email, location). It stops the future use; it does not undo past use.
- If you are in the EU or UK and believe we have mishandled your data, you may complain to your national data protection authority.
7. Children
PlayClash is not intended for children under 13 and we do not knowingly collect data from them. If you believe a child under 13 has given us data, write to us and we will delete it. Users aged 13–17 need a parent's or legal guardian's verified consent, as described in the Terms; their accounts have strict defaults (private profile, no DMs from strangers, no public location, no wallet, no public search).
8. Security
We encrypt data in transit (TLS 1.2+) and at rest. Access to production is limited to a short list of named operators, each with multi-factor authentication; every admin action is written to an append-only audit log. We back up the database nightly to a separate, encrypted store. If a breach materially affects you, we will tell you within 72 hours.
9. Changes
We may update this Policy. Material changes will be notified in-app at least 30 days before they take effect; the current version is always this page.
10. Contact & data protection
AILAB Solutions, LLC · 1209 N Orange Street, Wilmington, DE 19801, USA · [email protected]