Privacy Policy
Last updated: 19 October 2026
This Privacy Policy explains what personal data CricBidder collects, why, who we share it with, how long we keep it, and the rights you have. It applies to cricbidder.com, app.cricbidder.com, auction.cricbidder.com, the public live auction pages and the free game (together, the "Platform").
The Platform is operated by Shaheem M Shereef, trading as CricBidder, Shaas, Valavatty, Azhicode P.O., Thiruvananthapuram, Kerala 695564, India ("CricBidder", "we", "us"). We follow the Digital Personal Data Protection Act, 2023 and its Rules ("DPDP Act"), the Information Technology Act, 2000 and its rules, and other applicable Indian law.
1. Our role
- For our own users (organizers, managers, auctioneers, players with accounts, and guests playing the free game), CricBidder is the data fiduciary: we decide why and how the data is processed.
- For tournament data that organizers put on the Platform (for example, a player list an organizer imports or the answers players give on an organizer's registration form), the organizer is the data fiduciary and CricBidder is the data processor acting on the organizer's instructions. If you are a player and have a question about how a tournament uses your data, contact that tournament's organizer first. We will help them respond, and you can always contact us too.
2. The data we collect
Account data. Name, email address, mobile number (if you give it), your role (organizer, manager, auctioneer or player), and your password, which we store only in a securely hashed form.
Tournament and auction data. Tournament names, logos, venue and dates; team names, logos and colours; who manages each team; auction rules, bids, results and audit history.
Player data in a tournament. Name, playing role, batting and bowling style, overseas status, category and base price, photo, phone number, email, date of birth, city, jersey number, statistics and organizer notes, as provided by the organizer or by the player through a registration form. Organizers choose which of these to collect.
Payment data. When an organizer buys a package we record the package, amount, currency, status, time, and the Razorpay order and payment reference numbers. Payments are processed by Razorpay. We never receive or store your card number, CVV, UPI PIN or net banking credentials.
Free game data. When you play as a guest we create a random guest identifier stored in your browser, and we record the game you played, the team you chose, your bids and passes, your result and which buttons you clicked (for example, "Play again" or "Run this for your real tournament"). We do not ask guests for their name, email or phone.
Technical data. IP address, browser and device type, pages visited, approximate location derived from the IP address, and timestamps, collected in server logs to keep the Platform secure and working.
Messages to us. Anything you send to support or the Grievance Officer.
3. Why we use it
- To provide the Platform: create and secure your account, run auctions in real time, show live and public pages, send invitations and results, and export squads.
- To process payments: create Razorpay orders, confirm payments, unlock auctions, handle upgrades and refunds, and send receipts.
- To communicate with you: service emails such as invitations, login links, password resets, receipts and important changes. We send marketing emails only if you have agreed, and every marketing email has an unsubscribe link.
- To improve the product: understand how people use the free game and the auction tools, mostly using aggregated or de-identified data.
- To keep the Platform safe: prevent fraud, abuse and attacks, and keep audit records of auction actions.
- To meet legal obligations: tax, accounting, payment and law enforcement requirements.
We process personal data on the basis of your consent, which you give when you create an account, register for a tournament or submit a form, and for the legitimate uses the DPDP Act allows, such as when you voluntarily give us data for a specific purpose, or when we must comply with law. You can withdraw consent at any time (see section 8); this does not affect processing already done, and some features may stop working without the data they need.
We do not sell personal data, and we do not use it for third-party advertising.
4. Public information
When an organizer makes an auction or tournament public, anyone with the link can see the teams, the player names, photos, roles, base prices, sold prices and final squads, and these pages may appear in search results. Contact details, dates of birth and organizer notes are never shown on public pages. If you are a player and do not want to appear publicly, ask the organizer, or write to us.
5. Who we share it with
We share personal data only as needed to run the Platform:
- Within an auction: the organizer, auctioneer and team managers of a tournament see the tournament's teams, players and bids. Organizers see the data their players submit.
- Service providers who process data for us under contract and only on our instructions: Razorpay (payments), Contabo (our servers and databases, in India), Amazon Web Services (image storage and delivery, and backups), Brevo (email delivery), Google (only if you choose Sign in with Google), and other providers we may add for support or monitoring under the same safeguards.
- Authorities, when required by law, a court order or a valid government request, or to protect the rights, safety or property of our users or the public.
- A successor, if our business is merged, acquired or restructured, under the same protections as this policy.
6. Where it is stored
Our servers are hosted in India (Mumbai). Some service providers may process data outside India; any such transfer follows the DPDP Act and any restrictions the Government of India notifies.
7. How long we keep it
- Account data: while your account is open. When you delete your account we delete or anonymise your personal data within 30 days, except what we must keep by law.
- Tournament and auction data: while the organizer's account is open, or until the organizer deletes it. Final results that were made public may remain as anonymised statistics.
- Payment records: 8 years, as Indian tax and accounting laws require.
- Free game data: unfinished games are cleared within a few days. Finished game records are kept for up to 12 months and then deleted or anonymised.
- Server and security logs: up to 180 days, or longer if needed to investigate an incident.
8. Your rights
Under the DPDP Act you have the right to:
- access a summary of the personal data we process about you and how;
- correct, complete or update inaccurate data;
- erase data that is no longer needed, or that you withdraw consent for, unless we must keep it by law;
- withdraw consent as easily as you gave it;
- nominate a person to exercise your rights if you die or become incapable;
- grievance redressal: complain to our Grievance Officer, and, if you are not satisfied, to the Data Protection Board of India.
You can update most account details yourself in your account settings. For anything else, email support@cricbidder.com from your registered email address. We may ask you to confirm your identity. We respond within 15 days.
9. Children
You must be 18 or older to create an account or buy a package. Many tournaments include players under 18; an organizer or player may add a minor's data only with the verifiable consent of the minor's parent or lawful guardian. We do not knowingly track children, monitor their behaviour or show them targeted advertising. The free game does not ask for personal details. If you believe a child's data is on the Platform without parental consent, write to support@cricbidder.com and we will act promptly.
10. Cookies and browser storage
We use cookies and your browser's local storage only for things the Platform needs: keeping you signed in, remembering your guest game identifier and your settings, and protecting against misuse. We do not use advertising cookies. If we add analytics or other optional cookies in future, we will update this policy and ask for your consent where required. You can clear cookies and storage in your browser at any time; you may then need to sign in again and your guest game history on that device will be lost.
11. Security
We protect data with encrypted connections (HTTPS), hashed passwords, role-based access, access logs and audit records, regular backups and the security measures of our hosting provider. No system is completely secure. If a personal data breach occurs we will inform the Data Protection Board of India and affected users as the DPDP Act requires, and tell you what we are doing about it.
12. Third-party links
The Platform may link to other websites, such as Razorpay's checkout or a tournament's social media page. Their own privacy policies apply to them, not this one.
13. Changes to this policy
We may update this policy. We will post the new version here with a new "Last updated" date and, for material changes, email account holders before the change takes effect.
14. Contact and Grievance Officer
For privacy questions or to exercise your rights, email support@cricbidder.com.
Grievance Officer:
- Name: Shaheem M Shereef
- Email: support@cricbidder.com
- Address: Shaheem M Shereef, trading as CricBidder, Shaas, Valavatty, Azhicode P.O., Thiruvananthapuram, Kerala 695564, India
- Phone: the support number on our Contact page
We acknowledge every complaint within 24 hours and aim to resolve it within 15 days.