Privacy Policy

Who controls your data

Sports Assistant BD operates the platform and controls platform accounts, booking-directory activity, support and security records. Contact us using the details below.

An academy or venue decides how it uses the records it collects for its operations. We host and process those records on its behalf. Contact that organization about its records, or contact us for help with platform accounts and privacy requests.

Information we collect

Account and profile information includes names, phone numbers, email addresses, passwords stored as hashes, and profile photos. Academy records may include addresses, dates of birth, gender, blood group, government or birth-certificate identifiers, membership, attendance, training and performance information. Fields depend on the organization and feature.

Bookings include venue, ground, date and time, booker contact details, team and participant information, messages, booking status, photos, reviews and owner replies. Financial records include fees, dues, invoices, expenses, amounts, method labels and transaction references for payments collected outside the app. We do not request payment-service passwords, PINs, OTPs, or card or bank-account login credentials. Do not put those secrets in notes or references.

Technical information includes login sessions, IP addresses and operational logs, attendance-device identifiers and events, and notification tokens and installation identifiers used for mobile push delivery. Browser cookies and local storage support sessions and preferences. We do not use advertising SDKs or sell personal data.

Attendance-device synchronization can also transmit enrollment data, including biometric payloads where the device sends them. New diagnostic logs redact device credentials and fingerprint/face payloads before storage; legacy diagnostics and backups require review under the retention process.

How we use information

We use information to operate accounts, academy records, attendance and access control, venue discovery and bookings, team coordination, invoices and reports; to deliver requested notifications by SMS, email or push; and to provide support and prevent abuse.

Camera and photo access lets you choose or capture an image for a feature you use. Notification permission controls mobile push alerts. Optional profile fields and photos can be omitted where the form permits. Disabling notifications does not delete your account.

Who can see information

Authorized academy or venue staff can see the operational records they need. Venue owners receive booking details; booking managers and permitted participants can see relevant team and booking information.

Venue listings, listing photos, published reviews, reviewer display names and owner replies are public. Player portfolios are private by default. Authorized staff can publish a portfolio after confirming permission from the adult member or child’s guardian; the published name, photo, member code, sports statistics and match notes/photos are then public. Staff can make it private again, but previously saved copies cannot be recalled. The gallery and roster are listed for people with relevant booking access. Anyone receiving a direct photo link may open it; share images and links carefully. Registration or roster links can be forwarded: share them only with intended recipients. Do not publish another person’s private details or images without permission.

We may disclose information where necessary to comply with law, protect people or investigate abuse. Public content and information you deliberately share are not private academy records.

Service providers and hosting

Our current backend server host is Contabo. We also use infrastructure and domain services, MiMSMS for SMS, configured email providers for email, and Google Firebase Cloud Messaging for mobile push notifications. These services receive the data needed for their functions, such as recipients and message content or notification tokens. Support email is processed by the mailbox provider.

Hosting and service providers may process information outside Bangladesh. Access is limited according to the service and our arrangements with the provider. We do not use these services to sell your information or deliver third-party advertising.

Adults and children’s records

Account holders must be at least 18. A parent, guardian or authorized adult staff member manages a child’s records; the child must not sign in using that adult’s account. Organizations must obtain any required guardian consent before entering a child’s information.

Guardians can request access, correction or deletion of a child’s records through the organization or the privacy contact below. Do not upload children’s photos or identifiable information to public listings or reviews without appropriate authorization.

Retention and deletion

We keep active records while needed to provide the service. Closing an account does not by itself erase every organizational record. We review verified deletion requests and remove or anonymize personal data that is no longer needed. We aim to complete this within 30 days of verification and explain any delay.

Specific records may need to be retained for a genuine legal, accounting, security or unresolved-dispute reason. We identify the retained categories, reason and expected retention period when responding to a request, restrict access and minimize identifying data where possible. Backups are handled through the backup-retention process; deletion records must be reapplied if a backup is restored. We do not promise automatic deletion simply because an academy subscription expires.

Your choices and requests

You can request access, correction or account and associated-data deletion. Use Request account deletion in the app or the account-deletion page on this website; no active subscription is required. A support email request is sufficient to start the process. We verify ownership without asking for passwords, payment PINs or OTPs.

For privacy and deletion requests email sportsassistantbd@gmail.com. Include your account phone number or email and, if applicable, the academy or venue. Do not send an identity document unless we separately explain why a minimal verification step is necessary.

Security

App and website traffic uses HTTPS. Access controls restrict non-public records to authorized users and operators. Attendance devices may use device-specific connections configured by the organization; place devices on a trusted network and follow the connection guidance. No system is perfectly secure.

Changes

We update this policy when our practices change and show the revision date above. Material changes should be communicated to affected users.