Privacy Policy

GrabSlot, registered in India. Operator of the GrabSlot mobile app and grabslot.app website. Registered office: [placeholder Hyderabad address]. We are the Data Fiduciary under the DPDP Act for personal data collected through our services.

• Account data: name, mobile number, email, profile photo (optional), city, sports you play, skill level.
• Booking data: courts and coaches you book, dates and times, payment amount, cancellation history.
• Payment data: handled by our payment gateway (placeholder: Razorpay / Cashfree). We do not store full card or UPI credentials on our servers — only the gateway's reference token and the last four digits of the instrument.
• Device & usage data: device type, OS, app version, IP address, approximate location (only if you grant permission), crash reports, and aggregated analytics events.
• Communications: messages you send to support, partner inquiries, and feedback you submit.

• To run your bookings — finding venues, processing payments, sending WhatsApp confirmations, handling cancellations and refunds.
• To improve the service — anonymized analytics, bug reports, A/B testing of features.
• To keep the platform safe — fraud detection, abuse prevention, enforcing our Terms.
• To communicate — booking confirmations, reminders, support replies, and (if you've opted in) occasional updates about new sports, venues, or features.

• Venue partners receive only the booking details they need — your first name, phone number (for venue contact only), sport, slot, and court.
• Coaches receive the same booking details for sessions they accept.
• Service providers: payment gateway, SMS/WhatsApp provider, cloud hosting, analytics, customer support tools. Each is bound by a data processing agreement.
• Law enforcement: only on a valid legal order, and only the minimum data required.
• We never sell your personal data.

All payments are processed by our payment gateway. We are PCI DSS scope-limited — we do not store full card data on our servers.

Refunds follow the timeline in our Shipping & Cancellation page. Typically 5–7 business days back to the source instrument.

• The website uses a minimal set of cookies: a session cookie, a consent preference cookie, and an analytics cookie (placeholder: Plausible / Google Analytics).
• You can refuse analytics in the consent banner without losing site functionality.

• Account data: while your account is active, plus 18 months for tax and dispute records.
• Booking & payment data: 7 years, in line with Indian tax record requirements.
• Support communications: 24 months.

Under the DPDP Act, you can: access your data, correct it, withdraw consent, ask us to erase data not required by law, and complain to the Data Protection Board.

To exercise any of these, email support@grabslot.app with the subject 'DPDP Request'.

GrabSlot is intended for users aged 18 and above. We do not knowingly collect personal data from anyone under 18 without verified parental consent. If you believe we have, email us and we will delete the account.

Encryption in transit (TLS 1.2+) and at rest (AES-256). Role-based access controls. Regular security reviews. We disclose material data breaches to affected users and the Data Protection Board as required by law.

Our infrastructure is hosted in India. If a sub-processor stores data outside India, we ensure the transfer is permitted under the DPDP Act.

We may update this policy. Material changes are notified via app or email at least 7 days in advance. The effective date at the top of the page always reflects the latest version.

Grievance Officer: [Name placeholder], GrabSlot, [Address placeholder]. Email: grievance@grabslot.app. We respond to grievances within 30 days as required by Indian law.