Privacy Policy

ArenaPilot is a sports facility management platform developed and operated by YoTechSYS. It helps gyms, turfs, courts and sports academies manage members, collect payments, automate renewals and understand their revenue from a single dashboard.

In this policy, “ArenaPilot”, “we”, “us” and “our” refer to YoTechSYS operating the ArenaPilot platform. “You” refers to the person reading it — whether you run a facility, work at one, or are a member of one.

We wrote this policy to be read, not to be survived. If anything here is unclear, write to info@arenapilot.in and we will explain it in plain language.

ArenaPilot is business software. That means two different relationships run through the same product, and your rights depend on which one applies to you.

Where we act as a processor, the facility is the controller (a “Data Fiduciary” under India’s DPDP Act) and we are the processor (a “Data Processor”). If you contact us directly about member data, we will route your request to the relevant facility rather than act unilaterally on their records — and we will tell you that we have.

This policy does not cover the independent practices of a facility that uses ArenaPilot, or any third-party site we link to.

We collect only what the product needs to work. There is no data brokerage in our business model — we do not buy personal data, and we do not sell it.

Information you give us

• Account and identity — your name, mobile number, email address and, if you sign in with Google, the basic profile information Google returns (name, email, profile picture). We verify mobile numbers with a one-time password (OTP).
• Facility details — your facility’s name, type, address, operating hours, branches, plans, pricing and staff roles.
• Member records you enter — the details a facility records about its members and enquiries: name, contact details, plan, membership dates, attendance, payment and dues history, and any documents or notes it chooses to upload.
• Payment records — the amount, mode (cash, UPI, card, bank transfer), date and status of payments recorded against a member, plus invoices generated from them.
• Communications — messages you send us for support, demo requests, and early-access sign-ups.

Information we collect automatically

• Usage data— which screens you open, which features you use, and the events listed in “Cookies, storage & analytics” below.
• Device and technical data — see “Device information”.
• Log data — timestamps, error traces and security events generated when the app calls our servers. These are retained for reliability and abuse prevention.

We use personal data for these purposes and no others:

• To provide the service — authenticate you, render your dashboard, store your records, generate invoices and reports, and keep the platform working across your devices.
• To send operational messages — OTPs, renewal and dues reminders, receipts, and service notices such as downtime or security advisories.
• To take payment — to start, renew, or end your ArenaPilot subscription, and to meet tax and accounting obligations.
• To support you — to answer your questions and diagnose faults you report.
• To improve the product — to understand which features are used and where people get stuck, using aggregated and de-identified analytics wherever it will do the job.
• To keep the platform safe — to detect fraud, abuse and unauthorised access, and to enforce our Terms & Conditions.
• To meet legal obligations — to comply with applicable law and respond to valid legal process.

We do not use your data, or your members’ data, to train machine learning models for other customers, and we do not sell or rent it to advertisers or data brokers.

If you are in the European Economic Area or the United Kingdom, the GDPR requires us to name a lawful basis for each use. Ours are:

Under India’s Digital Personal Data Protection Act, 2023 (DPDP Act), we process personal data either with your consent or for the “legitimate uses” the Act permits — including where you have voluntarily provided data for a purpose you have not objected to, and where processing is required to comply with law. Where we rely on consent, we ask for it in clear language, at the point it matters, and you can withdraw it as easily as you gave it.

ArenaPilot uses cookies and similar browser storage. We keep the list short and we do not run third-party advertising or cross-site tracking cookies.

Analytics, specifically

We use Firebase Analytics (GA4), provided by Google, on our marketing site and in the app. It records product events with a pseudonymous identifier, plus coarse technical data such as device type and approximate region derived from your IP address. We use it to measure feature adoption and fix drop-off points — not to build advertising profiles, and we have not enabled Google Signals or ads personalisation.

You can refuse analytics by using your browser’s “Do Not Track” or tracking-protection settings, blocking analytics domains, or using a browser that restricts them. Refusing analytics does not limit any ArenaPilot feature. On our marketing site we do not load analytics before you interact with the page.

Device information

When you use ArenaPilot on the web or on our Android app, we automatically receive:

• Device type, operating system and version, and (on the web) browser type and version.
• Screen size and language, so we can render the right layout.
• A pseudonymous app-instance or device identifier, used to keep your session and to route push notifications to the right device.
• Your IP address, which our infrastructure necessarily receives to deliver a response, and which we use for security, abuse prevention and coarse (city or region level) analytics.

Location

Precise location is used for optional conveniences such as pre-filling your facility’s address during setup. You can revoke the permission at any time in your browser or Android settings, and we stop receiving it immediately. Separately, we derive an approximate location (city or region) from your IP address for security and analytics; this is not precise location and cannot be switched off without blocking the service itself, because every internet request carries an IP address.

Push notifications

We use Firebase Cloud Messaging (FCM), provided by Google, to deliver push notifications such as renewal alerts and staff updates. FCM requires a device token to route a message to your device; we store that token against your account and delete it when you sign out or disable notifications. Push is opt-in at the operating-system level — your device asks you first, and you can revoke it any time in your system settings.

Email notifications

Transactional email — OTP and sign-in mail, receipts, renewal reminders, staff invitations and security notices — is sent through Resend, our email delivery provider. These messages are part of the service and are not marketing, so they are not subject to an unsubscribe link; if you no longer want them, close your account. Any genuine marketing email we send is separate, requires your consent, and carries a one-click unsubscribe that we honour.

WhatsApp notifications

Facilities can contact members over WhatsApp from within ArenaPilot. It is worth being precise about how this works: ArenaPilot does not send WhatsApp messages on your behalf and does not transmit your member data to WhatsApp or Meta. We open WhatsApp on your own device with the recipient and a suggested message pre-filled — you review it and press send yourself, from your own WhatsApp account.

Once you send it, that message lives in WhatsApp and is governed by WhatsApp’s privacy policy, not this one. If we later introduce server-side WhatsApp Business messaging, we will update this policy and obtain consent before enabling it.

Your ArenaPilot subscription

Subscription payments to ArenaPilot are processed by Razorpay Software Private Limited, an RBI-authorised payment aggregator. When you pay, your card, UPI or netbanking credentials are collected and processed by Razorpay on their own systems under their privacy policy.

Payments your members make to you

Payments a member makes to a facility are, by default, recorded in ArenaPilot rather than collected through it — your staff mark a payment as received in cash, UPI, card or bank transfer. In that case ArenaPilot holds a bookkeeping record, not a payment instrument, and no financial credentials pass through us.

We keep transaction records for as long as tax and accounting law requires — see “Data retention”.

We keep our vendor list deliberately small. Each one is bound by a contract limiting them to processing data only for us, and each is named here so you can read their terms yourself.

Our primary data store is hosted in India. Some providers above process data outside India — including in the United States and the European Union — and some deliver content from a global edge network. Where personal data protected by the GDPR moves outside the EEA or UK, we rely on the European Commission’s Standard Contractual Clauses or an adequacy decision, and on our providers’ own transfer frameworks. Under the DPDP Act, we may transfer personal data outside India except to territories the Indian government restricts; we monitor that list and will comply with it.

We do not sell your personal data. We do not share it for cross-context behavioural advertising. We disclose it only in these situations:

• With your facility — if you are a member, your record is visible to the facility that registered you and to the staff it authorises.
• With the service providers named above — strictly to run the platform, and only for that.
• On your instruction — for example when you export a report or share an invoice.
• For legal reasons — where we are compelled by a valid, binding legal request. We assess each request, and where we are permitted to notify you before disclosure, we will.
• In a business transfer — if YoTechSYS is involved in a merger, acquisition or sale of assets, data may transfer to the successor, who will remain bound by this policy or a materially equivalent one. We will notify you before your data becomes subject to a different policy.

We keep personal data only as long as it serves the purpose it was collected for, or as long as the law requires — whichever is longer.

When a retention period ends, we delete the data or irreversibly de-identify it so it can no longer be linked to you.

Security is a first-class concern, not a footnote. In summary: all traffic is encrypted with TLS (HTTPS) in transit and data is encrypted at rest; access is authenticated by Firebase Authentication and authorised by Firestore Security Rules enforced server-side; staff permissions are role-based and least-privilege; and every facility’s data is strictly isolated from every other.

Our Security page sets out our controls, our infrastructure, our monitoring and how to report a vulnerability responsibly.

No system is perfectly secure, and we will not pretend otherwise. If a personal data breach occurs that is likely to affect you, we will notify you and the relevant authority — including the Data Protection Board of India under the DPDP Act, and, where the GDPR applies, the competent supervisory authority within 72 hours of becoming aware of it.

You have real, exercisable rights over your personal data. Depending on where you live, these include:

• Access — a copy of the personal data we hold about you, and information about how we use it.
• Correction — to fix data that is inaccurate, incomplete or out of date.
• Erasure — to have your data deleted where we have no overriding legal reason to keep it.
• Portability — to receive your data in a structured, machine-readable format, or have it sent to another provider where technically feasible.
• Restriction and objection — to limit or object to processing based on our legitimate interests, including profiling.
• Withdraw consent — at any time, where we relied on your consent. Withdrawal does not undo processing already carried out lawfully before you withdrew.
• Nominate — under the DPDP Act, to nominate someone to exercise your rights if you die or become incapacitated.
• Complain — to us first, and then to a regulator. See “Grievance redressal”.

How to exercise them

Email info@arenapilot.in from the address or with the mobile number registered to your account. We may ask you to verify your identity — we will not hand your data to someone claiming to be you. We respond within 30 days. If a request is genuinely complex we may extend this, and we will tell you why before the 30 days expire. Exercising your rights is free; we only charge for requests that are manifestly unfounded or repetitive, and we will say so first rather than surprise you.

You can close your ArenaPilot account and have your data deleted. There is no retention trap and no “contact your account manager” maze.

How to delete your account

• Email info@arenapilot.in from your registered email address with the subject “Delete my account”, or call +91 93856 21610.
• We verify that the request genuinely comes from the account owner.
• We confirm what will be deleted and what we are legally required to keep, before we do anything irreversible.

What happens next

• Your account is deactivated immediately and sign-in stops working.
• We keep the data for a 30-day grace period, so an accidental or malicious deletion can be reversed. Tell us to skip it and we will delete immediately.
• After the grace period, your account, facility and member records are permanently deleted from our live systems within 90 days of your request, and age out of backups within 30 days after that.
• Exception: payment, invoice and tax records are retained for the statutory period described in “Data retention”. We cannot delete these, because Indian law requires us to keep them.

Export your data first. Deletion is permanent and we cannot recover it afterwards. Ask us for an export before you delete, and we will provide it.

ArenaPilot is business software and is not directed at children. You must be 18 or older to hold an ArenaPilot account.

We recognise that sports academies legitimately enrol children as members. Where a facility records a member under 18, the facility is the controller of that record and is responsible for obtaining verifiable consent from a parent or legal guardian, as the DPDP Act requires. Facilities must not use ArenaPilot to track a child’s behaviour or to direct advertising at children — both are prohibited by the DPDP Act and by our Terms.

If you believe a child’s data has reached us without proper consent, write to info@arenapilot.in and we will act promptly.

If you are unhappy with how we have handled your personal data or your request, we want to hear it first — most issues are a misunderstanding we can fix quickly.

• Grievance Officer, ArenaPilot (YoTechSYS) — email info@arenapilot.in with “Grievance” in the subject line, or call +91 93856 21610.
• We acknowledge every grievance within 72 hours and aim to resolve it within 30 days, as the DPDP Act and India’s IT Rules require.

If we cannot resolve it, you may escalate: in India, to the Data Protection Board of India; in the EEA or UK, to your local supervisory authority or the UK Information Commissioner’s Office. You are entitled to complain to a regulator without going through us first — we would simply rather earn the chance to put it right.

We update this policy when the product or the law changes. When we do, we revise the “Last updated” date at the top of this page.

If a change materially affects your rights — a new purpose, a new category of data, or a new class of recipient — we will give you at least 30 days’ notice by email or an in-app notice before it takes effect, and where the law requires consent, we will ask for it rather than assume it. We will not quietly broaden what we do with your data and rely on you not reading this page.

ArenaPilot is developed and operated by YoTechSYS. For any question about this policy, a data request, or a grievance:

• Email — info@arenapilot.in
• Phone — +91 93856 21610
• Web — yotechsys.in

We read every message that arrives at this address, and a person — not an autoresponder — will reply.