Legal · Effective 23 September 2026
Privacy Policy
This policy explains what personal data TouchGrass collects, why, who else touches it, and what you can ask us to do with it. We collect the minimum a booking needs - we do not run advertising trackers, we do not sell data, and we never see your card details.
Who controls your data
TouchGrass, at the address given at the foot of this page, decides what personal data is collected and why. Questions, requests and complaints about your data go to the same address, and reach a person rather than a queue.
What we collect
We collect only what a booking, an entry pass and a tournament draw actually require.
- Identity and contact details - your name, email address and phone number. You give these whether you book as a guest or hold an account.
- Account details - if you create an account, the sign-in identifiers held by our authentication provider, Clerk. Your password, if you use one, is held by Clerk and never by us.
- Booking records - which activity you registered for, when, the entry fee, your entry pass reference, your invoice, and whether you were checked in at the venue.
- Date of birth - collected only for tournaments that run age categories, because the draw is built from it. We do not ask for it otherwise.
- City - recorded as Nashik by default so activities can be listed regionally.
- Payment references - the gateway order, payment and refund identifiers for your booking. We do not receive or store your card number, UPI PIN, CVV or bank credentials at any point.
- Player profile details - position, skill tier and a short bio, if you choose to add them. These are optional and you can clear them at any time from Settings.
- Messages you send us - the contents of a contact form or host enquiry, so we can reply to it.
What we do not collect
TouchGrass runs no third-party analytics, no advertising pixels and no cross-site trackers. We do not build an advertising profile of you, we do not sell or rent personal data, and we do not share it with data brokers.
The only cookies set are the ones our authentication provider needs to keep you signed in, and they exist for that purpose alone.
Why we use it, and on what basis
- To perform our contract with you - taking your booking, issuing your entry pass and invoice, checking you in, processing a refund when one is due, and telling you if an activity is cancelled or rescheduled.
- To meet legal obligations - keeping invoice and payment records for the period tax and accounting law requires.
- For our legitimate interests - keeping the platform secure, preventing fraudulent payments and abusive bookings, applying rate limits, and maintaining an internal audit log of administrative actions.
- With your consent - optional profile details, and any marketing email we send. You can withdraw consent at any time without affecting your bookings.
Who else processes it
We use a small number of established service providers. Each receives only what its function requires, and none is permitted to use your data for its own purposes.
- Clerk - authentication and account management.
- Supabase - the database that stores bookings, profiles and invoices.
- Razorpay - payment processing and refunds. Razorpay is your payment data's controller for card and bank details; its own privacy policy governs those.
- Resend - delivery of transactional email such as booking confirmations, entry passes, invoices and cancellation notices.
- Vercel - hosting and delivery of the website itself.
WhatsApp handoff
After a booking we may offer a WhatsApp link to the match group or to our ops desk, pre-filled with your name and booking reference so whoever answers knows who you are. Using it is entirely your choice - opening the chat is what sends the message, and nothing is sent if you do not. Once you are in a WhatsApp conversation, WhatsApp's own privacy terms apply to it.
Where your data is held
Our providers operate infrastructure in several countries, so your data may be processed outside India. Where that happens we rely on the provider's contractual data protection commitments, including standard contractual clauses where they apply.
How long we keep it
- Booking, invoice and payment records - retained for eight years from the end of the financial year they fall in, which is the period Indian tax and accounting law requires. These cannot be deleted on request while that obligation runs.
- Account and profile data - for as long as your account is open, and deleted within 30 days of you closing it, except for records held under the line above.
- Guest booking contact details - for three years after the activity, so we can reissue an entry pass or resolve a payment query.
- Contact form and host enquiry messages - for two years after we close the conversation.
- Rate limit and security records - 90 days.
Your rights
Under India's Digital Personal Data Protection Act 2023 you can ask us to do the following, and we will respond within 30 days at no charge.
- Access - get a copy of the personal data we hold about you, and a summary of how it has been processed.
- Correction - have inaccurate or incomplete data fixed. Most of it you can edit yourself in Settings.
- Erasure - have your data deleted, subject to the retention obligations in clause 8.
- Withdraw consent - for optional profile details and marketing email, at any time.
- Nominate - appoint someone to exercise these rights on your behalf in the event of death or incapacity.
- Complain - to us first, and then to the Data Protection Board of India if you are not satisfied with how we handled it.
Children
TouchGrass is not intended for children under 16 booking on their own behalf. Where a parent or guardian books for a child, they provide the child's details and consent to their processing for the activity. If you believe a child has given us data without that consent, tell us and we will delete it.
Security
Access to production data is restricted to those who need it. Data is encrypted in transit, payment webhooks are signature-verified before they are acted on, administrative actions are recorded in an audit log, and database access is governed by row-level security policies.
No system is perfectly secure. If a breach occurs that is likely to affect you, we will notify you and the Data Protection Board of India as the law requires, and tell you plainly what happened.
Changes to this policy
We may update this policy. The effective date at the head of this page tells you when the current version took effect, and material changes will be notified by email to account holders where we hold a valid address.
Operator & grievance contact
TouchGrass
Gangapur Road, Nashik, Maharashtra 422013, India
support@touchgrass.in
We acknowledge every written grievance within 48 hours and aim to resolve it within 15 working days of receipt.