Privacy Policy

1. Data we collect

When you create a Quriousbit account we collect: your mobile number, your PAN card number and Aadhaar number (for KYC and tax reporting under Section 194BA), your date of birth (to confirm you are 18+), and a selfie photograph (for identity verification). When you add money or withdraw winnings, we collect your bank account number, IFSC code, and UPI ID.

When you use the Quriousbit app or website we automatically collect: device type and OS version, IP address, app usage timestamps, and the contests you enter. We use this data to operate the platform, prevent fraud, and improve the product. We do not collect data outside what is necessary for these purposes.

2. Why we collect it

We collect your PAN and Aadhaar because Indian tax law (Section 194BA) requires us to report fantasy winnings above ₹10,000/year to the Income Tax Department and deduct 30% TDS. We collect your date of birth because fantasy sports is restricted to adults 18+. We collect your bank details to process deposits and withdrawals via UPI, IMPS, and NEFT.

We collect device and usage data to detect fraud (multiple accounts from one device, automated entry scripts, match-fixing patterns) and to improve the platform (which screens you use, which contests perform well, which features you ignore).

3. How long we keep your data

We keep your KYC documents (PAN, Aadhaar, selfie) for 5 years after account closure, as required by the Prevention of Money Laundering Act 2002 (PMLA). Your bank and UPI details are kept for 5 years after the last transaction. Your contest history is kept for 7 years as required by Indian tax law.

Device and usage data is kept for 18 months, then aggregated and anonymised. After account closure, your name and contact details are removed from our marketing systems within 30 days.

4. Who we share data with

We share data with: (1) the Income Tax Department, as required for TDS reporting. (2) Banks and payment gateways (Razorpay, Cashfree) to process deposits and withdrawals. (3) KYC verification vendors (Signzy, Digio) to verify your identity. (4) Cloud hosting providers (AWS, Cloudflare) to host the platform. (5) Analytics providers (Google Analytics, in anonymised form) to understand product usage.

We do not sell your data to advertisers, data brokers, or any other third party. We do not share your data with other fantasy sports platforms. We do not share your data with social media companies except when you explicitly opt in to a share action.

5. Your rights under DPDP 2023

Under the Digital Personal Data Protection Act 2023, you have the right to: (1) access a copy of all personal data we hold about you. (2) correct any inaccurate data. (3) request deletion of your data, subject to our legal retention obligations. (4) withdraw consent for optional data uses (marketing, analytics). (5) nominate another person to exercise your rights in case of death or incapacity.

To exercise any of these rights, email [email protected] with your registered mobile number. We will respond within 15 days, as required by the DPDP Act. There is no fee for a basic access request; we may charge a reasonable fee for excessive or repeat requests.

6. Cookies and tracking

The Quriousbit website uses first-party cookies to keep you logged in and remember your contest preferences. We use Google Analytics with IP anonymisation enabled. We do not use third-party advertising cookies, Facebook Pixel, or any cross-site tracking technology.

You can disable cookies in your browser settings. Disabling cookies will log you out of the website and require you to log in again on each visit, but it will not affect the mobile app.

7. Data security

All data in transit is encrypted with TLS 1.3. All data at rest is encrypted with AES-256. KYC documents are stored on isolated servers with no internet access. Access to KYC data is restricted to 4 staff members, all of whom have signed NDAs and undergone background checks. We are audited annually by a Big-4 firm.

If you discover a security vulnerability in the Quriousbit platform, please email [email protected]. We have a responsible disclosure policy with a 90-day window before public disclosure.

8. Children

Quriousbit is restricted to adults 18+. We do not knowingly collect data from children. If you are a parent and believe your child has created an account, email [email protected] and we will close the account and delete the data within 7 days.

9. Changes to this policy

We may update this policy from time to time. Material changes will be notified to you via in-app notification and email at least 30 days before they take effect. Non-material changes (typo fixes, clarifications) will be posted without notification.

10. Contact us

For any privacy-related questions, email [email protected]. Our Data Protection Officer (DPO) is Vikram J., available at [email protected]. The Grievance Officer under IT Rules 2021 is Anirudh S., available at [email protected]. We respond to all privacy enquiries within 15 days.