Privacy Policy

This Privacy Policy explains what personal data Megged collects, why we collect it, how we use and share it, and the choices and rights you have. It covers the Megged website, the booking and tournament platform, and any account you create — including accounts created using Google Sign-In.

1. Who we are

Megged is operated by Megged Sports Tech Pvt Ltd, a company registered in India (“Megged”, “we”, “us”). For the purposes of India’s Digital Personal Data Protection Act, 2023 (DPDP Act) we act as the Data Fiduciary for personal data processed through the platform; where the GDPR applies we act as the data controller.

2. Data we collect

• Account data — name, email address, profile photo, phone number (if you add one), city and preferred football formats.
• Profile and sporting data — player or coach profile details, team and squad membership, match participation, statistics and highlights you upload.
• Booking and transaction data — venues and slots booked, tournament and ticket purchases, invoices, GST details where applicable, payment status and reference numbers.
• Content you submit — listings, feedback, support messages, media uploads and consent records.
• Technical data — IP address, device and browser type, pages viewed, approximate location derived from your IP, and error diagnostics.
• Optional sensitive data — medical or fitness information and guardian details, only where you (or a guardian) explicitly provide them for player safety features.

We do not store full card numbers, UPI credentials or bank passwords. Card and UPI payments are processed by our payment gateway; we receive only the transaction outcome and reference identifiers.

3. Google Sign-In

When you choose “Sign in with Google”, Google authenticates you and shares a limited set of profile information with us based on the scopes you approve — typically your name, email address, email-verified status, profile picture URL and a stable Google account identifier. We use this only to create and secure your Megged account and to sign you in.

• We never receive or store your Google password.
• We request the minimum scopes needed for sign-in and do not request access to Gmail, Drive, Contacts or Calendar.
• We do not use Google account data for advertising, and we do not sell it.
• You can revoke Megged's access at any time in your Google Account under Security → Third-party apps with account access. Revoking access stops future Google sign-ins; it does not by itself delete your Megged account.

Megged’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. How we use your data

• Create and administer your account, and authenticate sign-in.
• Provide the service: venue availability and bookings, tournament registration, squads, tickets, officials and payouts.
• Send transactional communications such as booking confirmations, schedule changes, payment receipts and safety alerts.
• Handle payments, invoicing, GST compliance, refunds and settlements with venues and organizers.
• Maintain platform integrity: moderation, fraud prevention, abuse detection, audit trails and role-based access control.
• Improve the product using aggregated, non-identifying usage analytics.
• Comply with legal obligations and enforce our Terms of Service.

We do not sell your personal data, and we do not use your data to train third-party advertising profiles. Marketing messages are sent only where you have opted in, and every marketing message includes an opt-out.

5. Legal basis for processing

• Consent — optional features such as location sharing, medical data, public portfolio visibility and marketing.
• Performance of a contract — providing bookings, tournaments, ticketing and payouts you request.
• Legal obligation — tax, accounting and statutory record-keeping.
• Legitimate interests — security, fraud prevention and service improvement, balanced against your rights.

6. Sharing and service providers

We share data only as needed to run the service:

• Venue managers and tournament organizers receive the details necessary to fulfil your booking or entry (such as your name, contact and squad list).
• Payment gateway and banking partners, to process payments, refunds and payouts.
• Cloud hosting, database, storage and email or messaging providers acting as processors under contract.
• Analytics and error-monitoring services, limited to technical and usage data.
• Authorities or advisers where required by law, court order, or to protect rights and safety.
• A successor entity in the event of a merger, acquisition or reorganisation, subject to this policy.

7. Cookies and similar technologies

We use strictly necessary cookies and local storage to keep you signed in, remember your selected theme and city, and protect against abuse. We may use privacy-respecting analytics to understand aggregate usage. You can clear or block cookies in your browser, but sign-in and some features will stop working.

8. How long we keep data

We keep personal data for as long as your account is active and for as long as needed for the purposes above. Booking, invoice and tax records are retained for the statutory period required under Indian law. Optional data tied to a consent is deleted or anonymised when you withdraw that consent. Detailed retention periods per data category are published alongside our published policy record.

9. How we protect data

• Encryption in transit (TLS) and at rest for stored records and uploads.
• Row-level access control in the database, so records are readable only by the accounts entitled to them.
• Role-based administrative access with approval workflows and audit logging.
• Private media storage with short-lived signed links instead of public files.
• Least-privilege secrets management; payment secrets are never exposed to the browser.

No system can be guaranteed perfectly secure. If a personal data breach affects you, we will notify you and the relevant authority as required by applicable law.

10. Your rights and choices

• Access a copy of the personal data we hold about you.
• Correct or complete inaccurate data from your profile settings or by contacting us.
• Delete your account and associated personal data, subject to records we must retain by law.
• Withdraw a consent at any time in the Consent Centre.
• Object to or restrict certain processing, and request portability of data you provided.
• Nominate another person to exercise your rights in the event of death or incapacity, as provided under the DPDP Act.
• Complain to us first, and to the Data Protection Board of India (or your local supervisory authority) if unsatisfied.

To exercise any right, email us using the contact details below. We respond within 30 days and may ask you to verify your identity.

11. Children and guardians

Megged is not intended for children under 13. Players under 18 may participate only with verified guardian consent, and guardians can review, correct or withdraw their child’s data at any time. We do not use children’s data for behavioural advertising or tracking.

12. International transfers

We aim to store primary data in India. Where a processor operates outside India, transfers are made under appropriate contractual safeguards and only to countries permitted under applicable law.

13. Changes to this policy

We may update this policy as the platform evolves. We will change the “last updated” date above and, for material changes, notify you in the app or by email before the change takes effect.

14. Contact us

Grievance Officer / Privacy contact — Megged Sports Tech Pvt Ltd, India.
Email: privacy@megged.in

See also our Terms of Service, payments & compliance and the Consent Centre.