Buddy Balls Privacy Policy

Last updated: [TO DECIDE: date of approval]

This policy explains what personal data Buddy Balls collects, why, who we share it with, how long we keep it, and how you can see, change or delete it. It covers the Buddy Balls player app, the Buddy Balls referee app and our website at supersquadsports.com.

In this policy, "Buddy Balls", "we", "us" and "our" mean Respin Alpha Company (registration number P20003631), which runs Super Squad, Brunei Darussalam. "You" means the person using our apps or website.

1. What we collect

1.1. Data you give us

• Phone number. You sign in with your phone number and a one-time code we send by SMS.
• Profile: full name, username, email, gender, date of birth and profile photo.
• Emergency contact: a name and phone number we can call if something happens to you at a game.
• Squads: squads you create or join, and invites you send or accept.
• Reviews: ratings and comments you leave after a game or on a product.
• Messages to us: anything you send when you contact support.

1.2. Data created when you use Buddy Balls

• Bookings and orders: games and positions you book, merchandise you buy, coupons you use, cancellations and refunds.
• Payments: the amount, the payment method type (card, Pocket QR or Pocket Biller), the result and the payment reference. We never see or store your full card number. You enter card details on Pocket's own secure payment page.
• Refund Value: your balance and every credit and spend.
• Game day: when and how you checked in (the venue and the time, never a location trail), whether the referee marked you absent, the score, your goals, assists and saves, any cards and player of the match recorded by the referee, and your points, level, medals and rankings.
• Notifications: a push token for your device, so we can send you reminders, and the messages in your in-app inbox.

1.3. Data collected automatically

• Device and log data: device type, operating system, app version, IP address, and the date and time of requests. Our logs never contain your login codes, your session token or your full phone number.
• Website visits: we use Cloudflare Web Analytics, which counts page visits without cookies and without tracking you across other sites.
• App usage: the player app uses PostHog for usage analytics: which screens and steps are used, so we can improve the app. Each event carries a random ID (and, once you sign in, your internal account ID), the app version and your phone's system, never your name or phone number. PostHog stores this data in the United States.

1.4. Device permissions. The app only asks when it needs them, and you can turn each one off in your phone's settings:

• Camera: to take a profile photo.
• Photos: to choose a profile photo.
• Location: to show venues near you and directions to them, and to check you in when you arrive at a venue. For check-in we keep only which venue you arrived at and when, not your location.
• Notifications: to send booking confirmations, game reminders and updates.

1.5. What we do not do. We do not sell your personal data. We do not show advertising, and we do not use advertising or tracking tools in the apps.

2. How we use your data

• To create and secure your account, and to sign you in.
• To take bookings, hold positions while you pay, and confirm them.
• To take payments, give refunds and keep your Refund Value balance.
• To run games: check-in, attendance, results, points and rankings.
• To run squads, reviews and the shop, including in-store pickup.
• To send you booking confirmations, reminders and updates.
• To contact your emergency contact if something happens to you at a game.
• To answer your questions and settle disputes.
• To prevent fraud and misuse, for example limiting how many login codes a number can request.
• To keep accounting and tax records, and to meet our legal duties.

3. What other players can see

3.1. Your username, profile photo, level, stats, badges, rankings and squad can be seen by other players in the app, in game line-ups and leaderboards.

3.2. When someone shares a link to your player profile, the same information is shown on our website to anyone with the link.

3.3. Your phone number, email, date of birth and emergency contact are never shown to other players.

3.4. Referees and venue staff see the names and check-in status of players booked on the games they run. Staff may see your emergency contact when they need it for your safety.

4. Who we share data with

We share data only with the service providers who help us run Buddy Balls, and only what each one needs:

| Provider | What for | What they get | |---|---|---| | Cloudflare | Hosts our apps' server, database, photos and website | All data stored in Buddy Balls | | Pocket Pay, by ThreeG Media (Brunei) | Takes payments | Order amount and reference. You give your card details directly to Pocket | | Bird (formerly MessageBird), or Twilio as a backup | Sends login codes | Your phone number and the code | | Expo, Apple and Google | Deliver push notifications | Your device's push token and the notification text | | Google Maps | Shows maps of venues | Map requests from your phone | | PostHog | Counts how the app is used | Usage events with a random ID or your internal account ID, never your name or phone number |

We may also share data when the law requires it, to protect someone's safety, or if Buddy Balls is sold or merged, in which case this policy continues to apply.

Some of these providers store data on servers outside Brunei. We choose providers that protect data to a high standard.

5. How long we keep data

• Your account and profile: until you delete your account.
• Login codes: 5 minutes, and only in a form that cannot be read back.
• Sessions: a sign-in ends after 90 days without use, or when you log out.
• Bookings, orders and payments: kept for 3 years for accounting and tax, even after you delete your account, but with your name and contact details removed.
• Server logs: [TO DECIDE BUD-74: number] days.

6. Deleting your account

6.1. You can delete your account at any time, in the app under Profile, Settings, Delete account, or on our website at supersquadsports.com/delete-account.

6.2. When you delete your account, we delete your profile, photo, emergency contact, push tokens and sessions. Booking and payment records are kept for accounting with your personal details removed, as set out in section 5. See our Delete your account page for details.

7. Your rights

7.1. You can see and change most of your profile in the app. To change your gender or date of birth, contact us.

7.2. You can ask us for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it. Contact us using the details in section 10. We will reply within 1 day.

7.3. You can turn off push notifications, camera, photos and location access at any time in your phone's settings.

8. Keeping data safe

8.1. All data travels between your phone and our servers encrypted. Login codes and sign-in tokens are stored only in a form that cannot be read back. Our payment keys live only on our servers. Staff access to our admin tools needs a separate sign-in and is logged.

8.2. No system is perfectly secure. If a data breach puts you at serious risk, we will tell you promptly.

9. Children

9.1. You must be 13 or older to use Buddy Balls. If you are under 18, you need a parent or guardian's consent to create an account and book games.

9.2. We do not knowingly collect personal data from children under 13. If we learn that we have, we will delete it.

10. Contact us

If you have a question about this policy or your data, contact us:

• Email: support@supersquadsports.com
• WhatsApp: +673 899 3369
• Address: iCentre, Anggerek Desa Tech Park, Brunei-Muara BB3713, Brunei Darussalam

11. Changes to this policy

11.1. We may update this policy. If a change is important, we will tell you in the app at least 30 days before it takes effect. The date at the top shows when it last changed.

12. Language

12.1. This policy is available in English and Malay. If the two versions differ, the English version applies.