Privacy Policy

1. What we collect from players

Players do not create an account or a password. When you book online we collect:

• when you choose a slot: your full name and phone number;
• when you confirm: your email address and the bKash transaction ID of the deposit you sent to the venue, plus a team name and a note if you add them;
• booking details: venue, pitch or court, date, time slot, price, deposit, booking reference, status, and when it was made, checked in or cancelled, with any cancellation reason you give.

Venue staff can also add bookings for you at the counter, record payments, add internal notes, mark a no-show, and stop your number from booking online. We keep a count of your bookings and no-shows.

Your contact record is keyed to your phone number and is shared across Maath: if you book at two venues, both use the same name, phone and email. A venue sees it only once you have booked there. If a venue stops your number from booking online, that currently applies at every venue on Maath.

We never see or store your bKash PIN or account balance. We only store the transaction ID you type in.

2. What we collect from owners and staff

• account details: name, email or built-in login name, a one-way hash of your password (never the password itself), whether your email is confirmed, and your last sign-in time;
• sign-in sessions: the IP address and browser type of each session;
• venue details you enter: venue name, logo, contact phone and email, bKash number, rules, prices and custom domain;
• subscription payments: amount, period, method, and the bKash TrxID or bank transfer reference you give us;
• an activity log of changes made to bookings, prices, staff and settings, and who made them.

3. Cookies and browser storage

We use only the cookies the service needs to work. There are no advertising cookies, and we do not currently use any analytics or tracking tools.

• “lang”: remembers your language choice, for 1 year.
• “turfly_path_venue”: remembers which venue’s booking page you are on, for 1 day.
• “turfly_session”: keeps staff signed in. It cannot be read by scripts on the page. It lasts 8 hours and is extended while you stay active.
• “turfly_venue”: remembers which venue a staff member is managing, until the browser closes.
• Browser storage “maath_customer”: keeps your name, phone and email on your own device so your next booking is pre-filled. It is only sent to us when you submit a booking. Clear your browser data to remove it.

4. How we use it

• to make, confirm, change and cancel bookings, and to let the venue check your deposit;
• to send booking emails (confirmation, changes and cancellation) and account emails (confirming your address, password resets, staff invitations);
• to verify owners’ subscription payments;
• to keep the service secure: limiting repeated sign-in attempts, and keeping each venue’s data separate from every other venue’s;
• to answer support requests.

We do not sell personal data, show advertising, or send marketing to players.

5. Who can see your data

• The venue you booked with: its owner and staff see your bookings and contact details at that venue. Bookies handle bookings and check-in; only owners and managers see money and reports.
• Maath’s own team: only as needed to run and support the service and to verify subscription payments.
• Service providers that run parts of Maath for us: Vercel (hosting and logo storage), Neon (database), Resend (booking emails) and Loops (account emails). They may only use the data to provide their service to us. Data is stored in [Data hosting region].
• Authorities, if the law requires us to share it.

6. How long we keep it

We keep booking records while the venue’s account is open, so the venue has its booking and payment history. Sign-in sessions expire after 8 hours unless you stay active, and password-reset links after 1 hour.

When an owner closes their account, we delete or anonymise its venue and booking data within [Retention period after account closure], except where the law requires us to keep it longer.

7. Your choices and requests

You can ask to see, correct or delete your personal data. Players should contact the venue first, because the venue holds the booking. You can also write to us at info@turfly.xyz with your booking reference and phone number, and we will confirm it is you before acting.

Owners can edit most details in their settings and can ask us for a copy or deletion of their data at the same address. We reply within [Response time].

We may need to keep some records, such as payments a venue has already received, for accounting or legal reasons.

8. Security

Passwords are stored only as a one-way hash, sign-in cookies cannot be read by page scripts, and every venue’s data is kept separate. No system is perfectly secure; if we learn of a breach that affects you, we will tell you as the law requires.

9. Children

Maath is not meant for children under [Minimum age]. A younger player should ask a parent or guardian to make the booking.

10. Changes and contact

We will update this policy when what we collect changes. The date at the top shows the latest version.

Questions: [Legal entity name], [Registered address]. Email: info@turfly.xyz. Phone: 01612312666.