Privacy policy

Hobster is run by [legal name to be added], which decides how your personal data is used. Contact details, including our Grievance Officer, are at the end of this page.

• Your mobile number or email, and your password if you set one — to sign you in and to keep your bookings in one place. Passwords are stored only as a one-way scrambled version (a hash); nobody at Hobster can read them.
• Your name and a contact number — so the venue knows who is coming and can reach you if something changes on the day.
• Your bookings — venue, court, time, amount, and any refund — to run the booking, handle cancellations, and keep the records that tax and accounting law require.
• Payments. You pay through Razorpay. We receive a payment reference and whether it succeeded; we never see or store your card, UPI or bank details.

• Your name, business name, phone, email and address — to set up your account and to contact you about bookings. Consumer law makes a marketplace name the business behind a listing, so your business name, venue address and a contact number are shown publiclyon your venue’s page. Your email, PAN and bank details never are.
• PAN, and GSTIN if you have one — to confirm who we are paying, and for the tax deductions and returns the law requires of us.
• Bank account, IFSC and account holder name — to pay you. Changes to these are logged and checked with you by phone before any money moves.
• Venue details and photos — shown publicly on your listing once it is live.

• No advertising trackers or third-party analytics. The only cookies we set keep you signed in.
• Searches are counted anonymously. We record what sport, area and time people look for, so we know which venues to bring on — never who searched.
• Your location stays on your device. “Sort by distance” uses your browser’s location to order the list; it is never sent to us.

Only the people and services needed to run a booking or pay a venue:

• The venue you book — your name, contact number and booking details.
• Razorpay — to take payments and send refunds.
• Google Firebase — to send and check the one-time sign-in code to your phone.
• Supabase (our database, hosted in Mumbai), Vercel (which runs the website) and Cloudinary (which stores venue photos and partners’ documents) — they store data for us and may not use it for anything else.
• Government and law enforcement, when a law requires it — for example tax authorities, for the deductions we make on venue payouts.

Most of your data is stored in India. Some of these providers may process it in other countries; when they do, it is under contracts that protect it, and never in a country the Government of India has restricted.

• Your account, while you use it. Ask us to close it and we delete what we no longer need.
• Bookings, payments and payout records: 8 years, because accounting and tax law require it. They stay locked away and are used for nothing else.
• Venue partners’ PAN and bank details: for as long as we work together, then 8 years for tax records.
• The anonymous counts of what people searched for: up to 2 years, to decide which venues to bring on. They contain nothing that identifies anybody.

• Everything travels encrypted (HTTPS).
• The database is locked down so that only our own server can read or change it.
• Partners’ documents are stored privately and opened only by our staff, through links that expire in minutes.
• Every change to a partner’s bank details is recorded.

If a breach ever affects your data, we will tell you and the Data Protection Board of India as the law requires: what happened, what it means for you, and what we are doing about it.

You can ask us to:

• tell you what personal data we hold about you and how we use it;
• correct or complete anything that is wrong or out of date;
• delete your data, except what a law makes us keep;
• stop using data you gave consent for — as easy as it was to give;
• name someone to act for you if you die or can’t act yourself.

How to ask. Write to our Grievance Officer at the address below, from the email address or with the phone number on your account. We acknowledge within 24 hours and reply within 15 days. If you are unhappy with our answer, you can complain to the Data Protection Board of India.

Withdrawing consent is as easy as giving it: ask us to close your account, and we delete everything except the booking and payment records that tax law makes us keep. Sign-in codes and booking confirmations are part of running a booking, so they stop when the account does.

Ask us and we will give you this notice in Hindi, or any other language in the Eighth Schedule to the Constitution.

You must be 18 or over to create an account or book, and you confirm that when you sign up. A parent or guardian can book for someone younger on their own account, and we treat that booking as theirs.

We don’t knowingly collect a child’s personal data, and we never track children or show anybody ads. If you believe a child has created an account, tell our Grievance Officer and we will delete it.

If we change what we collect or why, we update this page and its date, and tell you before the change affects you. We remind everyone of our policies at least once a year.

Company

[legal name to be added]

Registered address

[registered address to be added]

Support

[support email to be added], [support phone to be added]

Grievance Officer

[name to be added]
[email to be added]