Privacy Policy

1. Our approach

Queo Technologies builds Kreeda Sports Academy for sports academies, coaches, parents and students. Many of our users are children, so we treat privacy as a core product requirement, not an afterthought. This policy explains how we handle personal data in line with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000 and related rules.

2. Our role

• For Academy Data (student, parent, attendance, fee, grading and media records added by an Academy), the Academy is the data fiduciary and decides how the data is used. Kreeda acts as a data processor on the Academy's behalf.
• For account data of Academy owners, website visitors and billing contacts, Kreeda is the data fiduciary.
• If you are a parent or student and want to access or correct data held by your Academy, contact the Academy first. We will help the Academy respond.

3. Data we process

• Account data: name, email address, mobile number, role, hashed password, language and notification preferences.
• Student data added by Academies: name, date of birth, photo, guardian details, batch/branch, attendance, performance and fitness metrics, grades or levels, certificates, event and tournament participation.
• Fee and billing data: invoices, amounts, due dates, payment status and gateway transaction references. We do not store card numbers, UPI PINs or bank passwords.
• Communication data: in-app notifications, announcements, support tickets and message delivery status for email, SMS and WhatsApp.
• Technical data: device and browser type, IP address, push-notification tokens, and security logs used to protect accounts and investigate abuse.

4. Why we use it

• To provide the Service: running classes, attendance, fees, grading, events, tournaments and the parent app.
• To verify identities with one-time passwords and keep accounts secure.
• To send service messages such as fee reminders, class updates and receipts that the Academy or you have enabled.
• To process subscription payments and prevent fraud.
• To provide support, fix problems and improve the product using aggregated, de-identified usage information.
• To comply with law, tax and accounting obligations.

We do not sell personal data, and we do not use student or parent data for advertising.

5. Children's data

• Children's profiles are created by Academies, not by children themselves. Academies must obtain verifiable consent from a parent or guardian before adding a child's data.
• We do not track children for behavioural monitoring or targeted advertising.
• Digital sports passports are private by default. They become public only if the Academy or guardian chooses to share them.
• Parents can ask the Academy — or us — to review, correct or delete their child's data.

6. How we protect data

All traffic to Kreeda is encrypted in transit with HTTPS/TLS. Passwords are stored only as salted bcrypt hashes. Sensitive integration secrets, such as WhatsApp Business access tokens, are encrypted with AES-256-GCM before they are stored. Every Academy's records are isolated by tenant, and each user sees only what their role allows. Changes to fees, grades and student records are recorded in audit logs. Read the full details on our Security page.

7. Sharing

We share personal data only as needed to run the Service:

• With the Academy you belong to, and with users that Academy authorises.
• With service providers that act on our instructions: cloud hosting, email delivery, SMS/OTP, push notifications, QueoTech Payment Hub and Easebuzz for payments, and Meta for WhatsApp messages the Academy chooses to send.
• With authorities where required by law or to protect the rights and safety of users.

8. Storage and retention

Data is stored on cloud servers. We keep Academy Data while the Academy's account is active. After an account is closed, the Academy can request an export within 30 days, after which data is deleted or anonymised, except records we must keep by law (such as invoices and payment records) for the legally required period.

9. Your rights

• Access a summary of your personal data and how it is processed.
• Correct, complete or update inaccurate data.
• Erase data that is no longer needed, subject to legal retention.
• Withdraw consent — for example, opt out of WhatsApp or marketing messages.
• Nominate another person to exercise your rights in case of death or incapacity.
• Raise a grievance with us and, if unresolved, with the Data Protection Board of India.

10. Cookies and local storage

This public website does not use advertising or tracking cookies. The Kreeda app uses browser storage to keep you signed in, remember preferences and let the PWA work offline. Clearing site data signs you out.

This website saves your chosen language in your browser's local storage. On your first visit, if your browser language does not tell us your preference, the website may ask a third-party geolocation service (GeoJS) for your approximate state, based on your IP address, only to suggest a language once. We do not store this location, and it is never linked to an account.

11. Changes

We will update this policy as the product and law evolve, and change the "Last updated" date. Material changes will be notified in the app or by email.