Privacy Policy — Algaball

Last updated: May 8, 2026 · Version 1.2

1. General Provisions

1.1. This Privacy Policy (the "Policy") defines how the Algaball platform (algaball.com) collects, processes, stores, and protects personal data of its users.

1.2. The data controller is IE Baltabaev Zhamin (the "Controller", "we"), registered in the Kyrgyz Republic.

1.3. Personal data processing is carried out in accordance with the Law of the Kyrgyz Republic "On Personal Data" No. 58 dated April 14, 2008.

1.4. By registering on the Platform, the User consents to the processing of personal data under the terms of this Policy.

2. Data We Collect

2.1. Registration Data

Category	Data	Required
Identity	Name, email address	Required
Contact	Phone number	Required
Demographics	Date of birth, gender	Required
Avatar	Profile photo	Optional

2.2. Profile and Activity Data

Category	Data
Skills	Skill tier, level, play style, confident skills, self-assessed level
Ratings	Manner rating (anonymous), skill rating history
Statistics	Games played, MVP count, play streak
Preferences	Preferred areas, interface language
Discipline	Discipline points, ban status

2.3. Payment Data

Category	Data
Transactions	Payment ID, amount, currency, status, date
Refunds	Refund status, reason, refund amount
Banking	MBank phone number (for refunds, optional)

      Bank card data is processed exclusively by the Finik payment system (QuickPay System LLC). The Platform does not receive or store card numbers, CVV codes, or other payment credentials.
    

2.4. Game Participation Data

Game history (date, venue, result);
Assigned jersey number;
Team assignment within a Game;
MVP votes;
Manner ratings given and received (anonymous).

2.5. Technical Data

IP address, browser type, operating system;
localStorage data (game cache, language settings, auth session);
Platform usage information (pages viewed, actions taken).

3. Purposes of Processing

Service delivery — registration, authentication, Platform operation;
Payment processing — processing payments and refunds;
Rating system — skill and manner assessments, game matching;
Security — fraud prevention, abuse protection, moderation;
Communication — notifications about games, payments, Platform changes;
Service improvement — usage analysis for Platform development;
Legal compliance — fulfilling requirements of KR legislation.

4. Legal Basis

Processing is based on (Article 8, Personal Data Law):

Consent — explicit consent given during registration;
Contract performance — processing necessary to fulfill the Terms of Service;
Legitimate interests — Platform security and fraud prevention;
Legal obligations — compliance with tax and other KR legislation.

5. Data Storage

5.1. Personal data is stored on Supabase cloud servers (AWS, United States). Data is protected by encryption in transit (TLS 1.2+) and at rest (AES-256).

Data	Retention Period
Profile data	Deleted or anonymized after account deletion
Payment data	5 years from transaction date (tax law requirement)
Game activity data	Retained in anonymized form where needed for service integrity
Technical logs	90 days

After account deletion, Algaball may retain game, booking, payment, refund, venue, moderation, security, dispute, and accounting records where required for legal compliance, accounting, fraud prevention, service integrity, or resolving obligations with users and venue partners. These records no longer show the deleted user's personal profile identity.

Cross-Border Data Transfer: Your personal data is stored on servers located in the United States (Supabase/AWS). This constitutes a cross-border transfer of personal data under the Law of the Kyrgyz Republic "On Personal Data" No. 58. By registering on the Platform, you explicitly consent to the transfer and processing of your data outside the Kyrgyz Republic. The United States does not have a data protection adequacy agreement with the Kyrgyz Republic. We implement technical safeguards (TLS 1.2+, AES-256 encryption, Row Level Security) to protect your data during and after transfer.

6. Data Sharing

Recipient	Purpose	Data
Finik (QuickPay System LLC)	Payment processing	User ID, payment amount
Supabase Inc.	Cloud storage and database	All data listed in Section 2
Resend Inc.	Email notifications	Email address, name
Sentry (Functional Software Inc.)	Error monitoring and stability	Technical error information, user identifier (no personal data)

We do not sell, rent, or share personal data with third parties for marketing purposes.

We may disclose data to authorized government bodies of the Kyrgyz Republic as required by law.

7. User Rights

Under the Personal Data Law, Users have the right to:

Access — obtain information about their personal data being processed;
Correction — request correction of inaccurate data;
Deletion — request deletion of personal data (subject to legal and contractual limitations);
Withdrawal of consent — withdraw consent to data processing (does not affect prior lawful processing);
Objection — object to marketing-related processing.

Users can delete their account in Profile settings under Privacy > Delete account. If you cannot access your account, use the public deletion instructions at /account-deletion or contact [email protected]. Response time: 15 business days.

8. Cookies and localStorage

8.1. The Platform uses browser localStorage for: auth session storage, game/venue data caching, language preference, and role/admin status.

8.2. The Platform may use technical cookies required by the authentication service (Supabase Auth).

8.3. No advertising or analytics cookies are used.

9. Security

We implement organizational and technical measures to protect personal data: HTTPS/TLS encryption, Row Level Security, role-based access control, regular security audits, and payment request signature verification (RSA-SHA256, enabled in production).

10. Consent

During registration, the User confirms:

Being at least 16 years of age;
Consent to personal data processing;
Having read the Terms of Service;
Consent to notifications (optional);
Consent to marketing communications (optional).

11. Changes

We may update this Policy at any time. The current version is always available on the Platform. Material changes will be communicated through the Platform.

12. Contact Information

IE Baltabaev Zhamin

Kyrgyz Republic, Bishkek

Email: [email protected]

Platform: algaball.com