SportVault is a sole proprietorship registered with the Ministry of Micro, Small and Medium Enterprises (MSME), Government of India (Udyam Registration No. UDYAM-TN-02-0505733), located in Chennai, Tamil Nadu, India. Contact: hello@vytka.com.
1. What we collect
SportVault collects the following categories of information to operate the platform:
- Account information: name, email address, phone number, and role (academy owner, coach, parent, or student).
- Student information: name, date of birth, and emergency contact details — provided by parents or academy staff during enrollment.
- Academy information: academy name, address, sport types, class schedules, and pricing.
- Payment metadata: transaction IDs, amounts, dates, and payment status from Stripe (US) or Razorpay (India). SportVault does not store raw credit card numbers, CVVs, or bank account details. All payment processing is handled directly by Stripe or Razorpay under their respective PCI-DSS certifications.
- Usage data: pages visited, features used, and session information — collected to improve the product.
- Communication records: email, SMS, and WhatsApp notifications sent through the platform (for delivery tracking and troubleshooting).
- Phone number (for messaging): when you opt into SMS or WhatsApp notifications, your phone number is shared with Twilio (SMS) and/or Meta WhatsApp Business Platform (WhatsApp) solely to deliver transactional messages you requested.
2. How we use your data
- To operate the platform: enrollment processing, attendance tracking, progress reports, payment collection, and communications.
- To send transactional notifications: class reminders, payment confirmations, waitlist updates, and waiver requests.
- To send marketing communications on behalf of your academy (email campaigns configured by the academy owner — not from SportVault directly).
- To power AI features: Reena (AI receptionist) uses FAQ content and academy-specific information to answer phone inquiries. AI marketing uses enrollment data to target campaigns.
- To improve the product: aggregated, anonymized usage analytics.
3. Data sharing
We share data only with the services required to operate the platform:
- Stripe / Razorpay: payment processing.
- Resend: email delivery.
- Twilio: SMS and WhatsApp message delivery.
- Meta (WhatsApp Business Platform): WhatsApp message delivery. When you opt into WhatsApp notifications, your phone number and message content are processed by Meta's WhatsApp Business Platform. Meta's data practices are governed by their Business Data Processing Terms.
- Anthropic: AI content generation. Academy-specific data (class names, enrollment context) may be sent to Anthropic's API to generate marketing copy, follow-up messages, and AI receptionist responses. Anthropic does not use API inputs to train models.
- Supabase: database hosting and authentication.
- Vercel: application hosting.
- Vercel Analytics / Speed Insights: page view analytics and performance monitoring (anonymized, no cookies, privacy-friendly).
- PostHog: product analytics (anonymized usage events).
We do not sell personal data to third parties. We do not share personal data for advertising purposes.
4. Data retention
When an academy cancels its SportVault subscription, all data associated with that academy is retained in read-only mode for 12 months from the date of cancellation. During this period, enrolled families and staff can no longer modify records, but historical data (enrollments, attendance, progress, payments) remains accessible for reference. Academy owners may request a full data export at any time during this window. After the 12-month retention period, all data is permanently deleted.
If you want your data permanently deleted before the retention period ends, you can request early deletion by emailing hello@vytka.com. We will process deletion requests within 30 days.
5. Data export
Academy owners can request a full export of their academy's data at any time by emailing hello@vytka.com. Exports are provided in standard formats (CSV/JSON) within 30 days of the request.
6. Security
All data is encrypted in transit (TLS) and at rest. Authentication is handled by Supabase Auth with row-level security enforced at the database level — every query is scoped to the authenticated user's role and academy. Admin operations use service-role credentials that are never exposed to the client.
7. Children's data
SportVault collects student names, dates of birth, and skill assessment data as provided by parents and academy staff. Students under 13 do not create their own accounts — their data is managed by their parent's account. The player portal for students is only available to students whose parent has enrolled them.
8. India — Digital Personal Data Protection Act, 2023
If you are located in India, the following applies under the Digital Personal Data Protection Act, 2023 (DPDP Act):
- Lawful purpose and consent: We process your personal data for the specific purposes described in Section 2 above. By creating an account, enrolling a student, or opting into notifications, you provide consent for that processing. You may withdraw consent at any time by updating your notification preferences, or by contacting us to delete your account.
- Data principal rights: You have the right to access a summary of your personal data and the processing activities related to it, the right to correction and erasure, and the right to nominate another person to exercise these rights on your behalf. To exercise these rights, email hello@vytka.com.
- Children's data: Student data for children under 18 is provided by their parent or legal guardian. We do not process children's data in any manner that could cause harm. We do not engage in tracking or behavioural monitoring of children.
- Grievance redressal: If you have a grievance regarding the processing of your personal data, contact us at hello@vytka.com. We will acknowledge and resolve grievances within 30 days.
9. United States — Children's data protections
SportVault is designed for use by sports academies and their staff. Student accounts are managed by parents — children under 13 do not create their own accounts or provide personal information directly to SportVault.
In compliance with the Children's Online Privacy Protection Act (COPPA) and applicable US state privacy laws (including CCPA/CPRA):
- We collect student data (name, date of birth, skill assessments) only as provided by a parent or academy staff member acting with parental authorization.
- We do not knowingly collect personal information directly from children under 13.
- Parents may review, correct, or request deletion of their child's data at any time by contacting us at hello@vytka.com.
- We do not sell personal data of any user, including minors.
10. Contact
For privacy-related questions or requests, contact us at hello@vytka.com.