Tournabot Privacy Policy

Effective date: not yet published

Operator / notice issuer: a registered Indian entity whose legal name and office address are not yet published (“Tournabot”, “we”, “us”, “our”).

This Privacy Policy explains how we handle personal data in connection with Tournabot’s software and websites. It is written with India’s Digital Personal Data Protection Act, 2023 (“DPDP”) in mind. Substantive DPDP obligations phase in on the timelines the Government notifies; we design to that standard now.

This is a draft for counsel review. It is not legal advice.

Summary of key points

• Two roles, stated plainly. For an Organisation’s account, billing and staff login data, Tournabot is the Data Fiduciary. For tenant / tournament data (rosters, registrations, results, moderation and similar participant-related records processed to run *your* events), the Organisation is the Data Fiduciary and Tournabot is a Data Processor acting on the Organisation’s documented instructions through the product.
• No player Tournabot accounts. Players never create a Tournabot account. There is no player login, no password and no player credential store. Identity for participants typically arrives via Discord interaction payloads and forms you configure.
• No player age data. Tournabot does not collect player dates of birth or age brackets. Age compliance is an organisation-level attestation and an off-platform obligation of the Organisation.
• No participant money. We do not collect entry fees or prizes; payment data we see for software subscriptions comes through Razorpay.
• Discord is the substrate. Message and interaction data on Discord is also governed by Discord’s own privacy terms.
• India hosting. Tenant data is hosted on infrastructure in India (Mumbai), subject to the sub-processors listed below.
• Your rights. Access, correction, erasure and grievance routes are described in §§6 and 10. Participants should usually start with their Organisation; they may also contact our grievance officer.

1. What information do we collect?

1.1 The Fiduciary / Processor split (read this first)

Counsel must confirm this split, whether a signed Data Processing Agreement is required with each Organisation, and the exact DPDP contractual terms for processors.

We are not the fiduciary for “everything about every player in Indian esports.” That would describe a community operator that runs tournaments itself. We sell software to organisations who run theirs.

1.2 Personal data we collect — Organisation staff (Fiduciary context)

When you create a workspace or sign in to the dashboard we may collect:

• Discord account identifiers obtained through Discord’s OAuth (for example Discord user ID, username, avatar URL);
• email address if you provide one for billing or notifications;
• billing and GST-related particulars needed to recognise your subscription (we do not receive full card numbers or UPI credentials — see payments below);
• support communications you send us;
• security and session data needed to keep you signed in (session cookies that are strictly necessary — not advertising cookies).

1.3 Personal data processed — participants and event operations (Processor context)

Players never create a Tournabot passworded account. Participant-related data reaches us because you use the Services, for example:

• Discord interaction payloads scoped to your guild and flows (Discord ID, display name, and registration details a player submits for an event);
• answers on web registration forms you configure (eligible plans), which may include an email used to deliver a claim code;
• results, screenshots submitted for OCR, highlight clips and overlay assets you upload;
• moderation and conduct records your staff write in the product;
• operational audit events (who on your staff did what, when).

Where you use OCR result intake (including the public OCR API), player identifiers that appear in submitted screenshots — recognised text and roster in-game names — are stored on the call record so support can reconstruct what a caller saw. You share this data with Tournabot under the terms you accepted at signup.

We process this on your instructions as embodied in product configuration and staff actions.

1.4 What we deliberately do not collect

• No player age data — no date of birth, age bracket, guardian consent capture or supporting age document upload in identity, registration or conduct flows.
• No participant payment instruments — we do not collect entry fees; there is no participant card vault on Tournabot.
• No sale of personal data for third-party advertising.

1.5 Payment information (software fees only)

Subscription and add-on payments are processed by Razorpay. We receive payment status, identifiers and invoice metadata needed to activate entitlements and keep tax records. We never see or store your card number or UPI credentials.

1.6 Information automatically collected on our websites

On tournabot.com marketing pages, measurement is intended to be first-party and cookie-less: aggregate visit counting without cross-site advertising profiles, no personal profile, nothing stored on your device for advertising — which is why there is no consent banner to click. Dashboard sessions use strictly necessary cookies to keep staff signed in.

Server logs may include IP address, user agent and request metadata for security and reliability.

On registration, signed ticket-form and staff dashboard session start we may also record a coarse network signal: the address is truncated to a shared network prefix (/24 IPv4 or /48 IPv6), salted and hashed with a server secret, and only the digest is stored — never the raw address. Digests are kept for a short retention window (default 30 days, between 7 and 90) for anti-fraud correlation review by the organisation's own staff. We do not use device fingerprinting (canvas, WebGL, fonts, audio or hardware probing).

1.7 Information from Discord

Discord is an independent controller/fiduciary for data on Discord’s platform under Discord’s own policies. When your community interacts with a bot connected to Tournabot, we receive the API payloads needed to provide the features you enabled (including, on paid tiers with Message Content intent enabled by you, message content required for those features). We process that content to deliver the feature — not to build a cross-tenant advertising profile.

1.8 Information from YouTube (Google)

With the viewer’s consent we ask YouTube, through Google’s YouTube Data API, once whether they subscribe to the organiser’s channel (read-only access). We store only a subscribed / not-subscribed result and an encrypted refresh token used solely to re-run the same check. We read no other YouTube data. Results are deleted on request through the same erasure path as everything else (data-subject request / DSR) and on organisation purge. A Circuit organisation may bring its own Google project, in which case consent is to that organisation rather than to Tournabot’s project.

This section pre-describes the product feature youtube-verify-api landing in the same delivery wave. Questions: the contact page or the contact page.

2. How do we process your information?

We process personal data to:

• provide, operate, secure and support the Services you requested;
• authenticate staff, enforce entitlements and prevent abuse;
• bill for software subscriptions and issue or reconcile GST-related records with Razorpay;
• send transactional messages (for example registration claim codes, billing notices);
• comply with law and respond to lawful requests;
• improve the product using aggregated or de-identified analytics where feasible;
• investigate security incidents and enforce the Terms and Acceptable Use Policy.

Lawful basis (draft). For Fiduciary processing of Organisation account data: performance of a contract with you and compliance with law; where consent is required, we will ask for it in-product. For Processor processing of tenant data: we rely on the Organisation’s instructions and the Organisation’s own lawful basis toward its data principals. Draft — pending counsel review: map each purpose to DPDP consent / legitimate uses under the Act and rules as notified.

We do not sell personal data, and we do not use it for third-party advertising.

Conduct Network. Organisations may write structured conduct records about players in their own events. Cross-organisation reading of those reports is not enabled: it stays switched off at platform level pending independent Indian data-protection counsel review. This Policy will be updated before any such read feature is enabled.

3. When and with whom do we share personal data?

We do not sell personal data.

We share personal data only:

1. With sub-processors who help us run the Services (see §3.1), under contracts that require appropriate protection;
2. With Discord, to the extent interactions occur on Discord’s platform (governed also by Discord’s terms);
3. With Razorpay, for software-fee payments and invoicing;
4. With your own staff and integrations you enable (for example webhooks/API on eligible plans) — that disclosure is your instruction;
5. When law requires disclosure to authorities, or to establish, exercise or defend legal claims;
6. In a business transfer (merger, acquisition, reorganisation), subject to continuing protections.

3.1 Sub-processors (categories we actually use)

DPDP expects transparency about processors. We use the following categories (names may change; we will keep this list honest):

We do not list every vendor trade name here until the production vendor set is frozen by the owner; categories above are binding commitments on *kinds* of processing. Draft — pending counsel review: attach a live sub-processor schedule before publication if required.

3.2 International transfers

Tenant data is hosted in India. If a sub-processor ever processes personal data outside India, we will update this notice and implement transfer safeguards counsel requires. Draft — pending counsel review: confirm cross-border posture.

4. How long do we keep your information?

We keep personal data only as long as needed for the purposes above, including:

• Tournament and community data — follows the Organisation’s plan retention window (as published: for example 45 days on Free, 12 months on Scrim, 24 on Pro, 48 on Circuit), then deletion in the normal cycle;
• Discord application credential records after lapse — up to 12 months to allow re-subscription reconnect, then purge if still dormant;
• Billing and tax records — as long as Indian tax and company law require;
• Security and audit logs — no longer than their purpose needs;
• Support tickets — for as long as needed to resolve and for reasonable follow-up.

When we act as Processor, we delete or return tenant personal data on the Organisation’s instruction and at end of service, subject to legal retention and backup cycles.

5. How do we keep your information safe?

We implement administrative, technical and organisational measures appropriate to the risk, including access control, encryption in transit, tenant isolation patterns in the product architecture, audit logging, and least-privilege operational access.

No method of transmission or storage is 100% secure. You must protect staff credentials and Discord bot tokens. Notify us promptly of suspected unauthorised access to your workspace.

Breach notification will follow applicable law and, where we are Processor, we will notify the Organisation so it can meet its fiduciary duties. Draft — pending counsel review: align with DPDP breach timelines once rules are final.

6. What are your privacy rights?

Under DPDP (as applicable to you), data principals may have rights to:

• access personal data;
• correction of inaccurate or incomplete personal data;
• erasure when data is no longer necessary or consent is withdrawn (subject to legal retention);
• nominate another person to exercise rights in case of death or incapacity, where the Act so provides;
• withdraw consent where processing is consent-based, as easily as it was given;
• grievance redressal and complaint to the Data Protection Board of India.

Participants: because your Organisation is Fiduciary for event data, start with that Organisation. You may also contact our grievance officer; we will help route the request and will not ignore a direct outreach.

Organisation staff: contact us using §9 / §10 for account data we hold as Fiduciary.

We respond to grievances within 3.

7. Controls for Do-Not-Track features

Most web browsers offer a Do-Not-Track (“DNT”) setting. There is no uniform industry standard for recognising DNT signals. Our marketing measurement is designed to avoid third-party advertising tracking and cookie-based cross-site profiles. If a standard emerges that we must follow under Indian law, we will update this section.

8. Do we make updates to this notice?

Yes. We may update this Policy as the product, vendors or law change. The effective date at the top will change. Material changes will be announced to workspace owners before they take effect where required. Continued use after the effective date constitutes acknowledgment of the updated Policy.

9. How can you contact us about this notice?

• Operator: a registered Indian entity whose legal name and office address are not yet published
• Support / privacy email: the contact page

Grievance officer (DPDP)

• Name: name not yet published
• Email: the contact page
• Response window: 3

If you are not satisfied with our response, you may complain to the Data Protection Board of India as provided under DPDP.

10. How can you review, update or delete the data we collect from you?

Organisation staff (our Fiduciary records). Sign in to the dashboard to review profile and workspace settings where exposed. For correction or deletion of account data we hold as Fiduciary, email the contact page or the contact page with enough detail to verify your identity and the workspace concerned. We will respond within 3.

Participants (Organisation is Fiduciary). Ask the Organisation that ran the event. If you contact us directly, we will verify the request as far as practicable and forward it to the Organisation or act on documented Organisation instructions / legal duty.

Exports. Eligible plans offer analytics export and/or API access so Organisations can retrieve tenant data they are Fiduciary for.

Deletion is subject to legal retention (especially billing/tax), security logs, and backup expiry cycles described in §4.