Privacy Policy

1. Information we collect

We collect the following categories of information.

Information you give us

• Account information: Your Name, Business Name, Email, Phone Number, and Password.
• Identity and verification (KYC and KYB): Government-issued ID, PAN, Tax identifiers, Business registration documents, beneficial-owner details.
• Financial and settlement: Bank account details, settlement instructions, and records of payments, payouts, refunds, and disputes.
• Communications messages you send us through support, email, WhatsApp, or calls, including recordings where permitted.

Information we collect automatically

• Device and connection: IP address, device type, browser, and operating system.
• Usage: pages viewed, features used, actions taken, and timestamps.
• Cookies and similar technologies: see section 3.

Information we receive from others

• Verification and fraud-prevention providers, who confirm your identity and screen for risk.
• Payment and banking partners, who share transaction and settlement information.
• Publicly available sources and sanctions or watchlists, for compliance checks.

2. How we use your information, and our legal basis

We use your information to:

• create and operate your account, and provide the service, to perform our agreement with you;
• verify your identity and run anti-fraud, anti-money-laundering, and sanctions checks, to meet our legal obligations and protect the platform;
• process payments, payouts, refunds, and disputes, to perform our agreement with you;
• provide support and communicate with you about your account, to perform our agreement and for our legitimate interests;
• improve and secure the product, for our legitimate interests;
• send you service updates, and, where you have agreed, other communications, based on your consent, which you can withdraw at any time; and
• comply with the law and respond to lawful requests, to meet our legal obligations.

We do not sell your personal data, and we do not share it for third-party advertising.

3. Cookies and similar technologies

We use cookies and similar technologies to improve your experience on our platform, for example to remember your preferences and to analyse how you use our services.

4. How we share your information

We share information only as needed, with these categories of recipients:

• Payment and banking partners, so payments can be collected, processed, and settled to you.
• Verification and fraud-prevention providers, to confirm your identity and screen for risk.
• Service providers and sub-processors, who help us run the platform, such as cloud hosting, email, messaging, and analytics, under contracts that require them to protect your data and use it only on our instructions.
• Professional advisors, such as auditors and lawyers, where needed.
• Regulators, law enforcement, and courts, where we are required by law, or to prevent or investigate fraud or abuse.
• A successor entity, if Playto is involved in a merger, acquisition, or sale of assets, in which case your data stays protected under this policy.

5. International transfers

Some of our partners and service providers operate outside your country. Where your information is transferred across borders, we take steps to protect it to the standard required by applicable law, through appropriate contractual and security safeguards.

6. How long we keep your information

We keep your information for as long as your account is active, and after that only for as long as we need to:

• meet legal record-keeping duties. Identity, verification, and transaction records are generally retained for at least five years after the relationship ends, in line with anti-money-laundering, tax, and financial regulations;
• resolve disputes and enforce our agreements; and
• meet other legal or regulatory requirements.

After these periods, we delete or anonymise your information. [Confirm exact retention periods with your compliance and tax advisors before publishing.]

7. How we protect your information

We use appropriate technical and organisational measures to protect your information, including encryption in transit, access controls, least-privilege internal access, and monitoring. No method of storage or transmission is completely secure, but we work continuously to protect your data and review our measures.

8. Your rights

Subject to applicable law, you have the right to:

• access the personal data we hold about you, and request a summary of it;
• ask us to correct or complete inaccurate or incomplete data;
• ask us to erase your data where it is no longer needed and we are not required to keep it;
• nominate another person to exercise your rights in the event of death or incapacity;
• withdraw consent where we rely on consent; and
• raise a grievance with us, and escalate to the Data Protection Board of US if you are not satisfied.

To exercise any of these, email support@playto.so. We will respond within the time the law requires, and we may need to verify your identity first.

9. Grievance officer

In line with the Digital Personal Data Protection Act, 2023, you can contact our grievance officer about any concern relating to your personal data:

• Name: [grievance officer name]
• Email: [grievance officer email]

We will acknowledge your grievance and respond within the timeframe required by law.

10. Data breaches

If a personal data breach occurs, we will notify the Data Protection Board of US and affected individuals as and where required by law, and take steps to contain and remedy it.

11. Children

Playto is intended for businesses and for people aged 18 and over. We do not knowingly collect personal data from children. If we learn that we have, we will delete it.

12. Links to other sites

Our website and product may link to third-party sites and services that we do not control. This policy does not cover them, and we encourage you to read their privacy policies.

13. Changes to this policy

We may update this policy from time to time. We will post the updated version here and, for important changes, notify you by email or in the dashboard. The effective date at the top shows when it was last updated.