Privacy Policy

In this Policy, unless the context otherwise requires, the following terms shall have the meanings set out below:

• "Child" or "Minor": an individual who has not completed eighteen (18) years of age, in accordance with applicable Indian law.
• "Data Fiduciary": AreteSports Private Limited (operating the CricRise brand), being the entity which alone or in conjunction with others determines the purpose and means of processing personal data.
• "Data Principal": the individual to whom the personal data relates, including, where the individual is a Child, the parent or lawful guardian of such Child.
• "Data Processor": any person who processes personal data on behalf of AreteSports Private Limited.
• "Personal Data": any data about an individual who is identifiable by or in relation to such data.
• "Biometric and Performance Data": video recordings, images, pose landmarks, technique scores, comparison stills, and other body-movement metrics captured or generated through use of the Platform.
• "Parent" or "Lawful Guardian": the natural parent or legally appointed guardian of a Minor, who provides verifiable consent on behalf of the Minor.
• "Processing": any operation performed on personal data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, transmission, or erasure.
• "Platform": the CricRise website at www.cricrise.in and all related services.

CricRise collects and processes certain categories of information in connection with your use of the Platform. Such information may be provided directly by you or your parent/lawful guardian, generated through your interaction with the Platform, or collected automatically through technical means. The scope of data collection is limited to what is necessary for the operation, security, and improvement of the Platform.

Information you provide directly: When you create an account or use our forms, we collect registration information including name, email address, username, telephone number (where provided), and authentication details (including Google sign-in profile data when you choose Google). You may also provide profile details such as handedness, age group, academy affiliation, school or club, playing role, and coaching notes.

Biometric and Performance Data: In connection with the AI-powered batting analysis features of the Platform, we collect and process uploaded video recordings, images, pose data, technique scores, comparison stills, shot-type selections, and derived performance metrics. Such data is collected solely for the purpose of providing coaching feedback, session history, and (where authorised) coach/academy monitoring.

Coach and player profiles: Coach accounts may store player display names, age group, handedness, notes, photographs (where uploaded), guardian-related acknowledgements, and share links created by coaches.

Information collected automatically: When you visit the Platform, we automatically collect certain technical and device-related information, including your Internet Protocol (IP) address, device type, operating system, browser type and version, access times, referring website, pages visited, and usage logs. This information is used for security monitoring, fraud prevention, system performance, diagnostics, and (where you accept analytics cookies) analytics.

Information from third parties: Where applicable, we may receive information about you from academies, coaches, or partner organisations with whom you are affiliated, where such sharing has been authorised by you or your parent/lawful guardian.

Cookies and tracking technologies: As more particularly described in Section 12 below, we use cookies, log files, and similar tracking technologies to collect information regarding your interaction with the Platform.

CricRise does not knowingly collect categories of sensitive personal data beyond what is necessary to operate the services. We do not collect government-issued identification, banking information, or payment card details at the present stage of operation.

CricRise expressly acknowledges that a substantial portion of its intended Users are Minors. In accordance with Section 9 of the DPDPA, the personal data of a Child shall be processed only after obtaining verifiable consent from the parent or lawful guardian of such Child.

Verifiable parental consent shall be obtained through such means as CricRise may reasonably implement, which may include one-time password (OTP) verification on a registered mobile number or email address, declaration by the parent/guardian (including coach acknowledgements of guardian consent where a coach manages a junior profile), verification through DigiLocker, the government-backed digital document wallet, to establish the identity of the parent and the parent-child relationship in accordance with Rule 10 of the DPDP Rules, and such other measures as may be prescribed under applicable law.

CricRise shall not undertake any tracking, behavioural monitoring of Children, or targeted advertising directed at Children. Further, CricRise shall not process the personal data of a Child in a manner that is likely to cause any detrimental effect on the well-being of the Child. For younger age groups we apply stricter share redaction on parent/guardian share links (for example initials and reduced visual detail).

Parents and lawful guardians shall have the right, at any time, to access, review, correct, or request deletion of the personal data of the Child under their care, and to withdraw consent previously granted. Such withdrawal shall not affect the lawfulness of processing carried out prior to such withdrawal. Requests relating to a profile managed by a coach should be made to that coach and/or to the Grievance Officer designated under Section 14.

Any User who is a Minor is required to use the Platform only under the supervision and with the consent of their parent or lawful guardian. CricRise reserves the right to suspend or terminate any account where it has reasonable grounds to believe that the requirements of this Section have not been complied with.

Requests, complaints, or concerns relating to the processing of a Child's personal data may be addressed to the Grievance Officer designated under Section 14 of this Policy.

CricRise processes the information collected for purposes that are specific, lawful, and necessary to operate, maintain, secure, and improve the Platform. The principal purposes are set out below:

• account creation, authentication, and management of your User profile;
• delivery of AI-generated batting analysis, technique scores, You vs Pro stills, ranked coaching copy, and session history;
• facilitation of academy- and coach-level dashboards and parent share links, where you have authorised such sharing;
• communication with you, including service-related notifications, security alerts, account updates, and responses to your enquiries;
• sending newsletters, product updates, and marketing communications, only where you have opted in to receive such communications;
• maintenance of the security, integrity, and functionality of the Platform, including detection, prevention, and investigation of fraud, abuse, and unauthorised access;
• development, training, and improvement of our artificial intelligence models, using anonymised or aggregated data wherever feasible;
• compliance with applicable legal, regulatory, or judicial obligations;
• establishment, exercise, or defence of legal claims, where necessary.

CricRise shall not process your personal data for any purpose that is incompatible with the purposes set out above, without first obtaining your fresh consent.

CricRise processes personal data on one or more of the following legal grounds, depending on the nature of the data and the purpose of processing:

• Consent: Processing is primarily carried out on the basis of the free, specific, informed, unconditional, and unambiguous consent of the Data Principal, in accordance with Section 6 of the DPDPA. In the case of a Minor, such consent shall be obtained from the parent or lawful guardian.
• Performance of services: Where processing is necessary for the performance of services requested by you, including account management, delivery of batting analysis, and platform functionality.
• Legitimate uses: Where processing is necessary for purposes specified under Section 7 of the DPDPA, including responding to medical emergencies, compliance with judgments or court orders, and other lawful purposes.
• Legal obligations: Where processing is necessary to comply with applicable laws, regulations, court orders, or lawful requests from governmental or regulatory authorities.

Consent Manager: Upon operationalisation of the Consent Manager framework under Rule 4 of the DPDP Rules (expected November 2026), CricRise shall assess whether integration with a registered Consent Manager is required for its operations, and shall implement such integration where mandated or appropriate, to enable Data Principals to grant, manage, review, and withdraw consent through an independent intermediary.

Where processing is based on consent, you (or your parent/lawful guardian, in the case of a Minor) shall have the right to withdraw such consent at any time, by writing to the Grievance Officer at the contact address specified in Section 14. Withdrawal of consent shall not affect the lawfulness of processing carried out prior to such withdrawal.

CricRise does not sell, rent, or trade your personal data to any third party for commercial gain. Personal data may, however, be disclosed or made accessible in the limited circumstances described in this Section.

Service providers:CricRise may engage third-party service providers to perform functions on its behalf, including website hosting and optional analytics (Vercel), analysis API and media processing (Render), database hosting (Neon or similar), optional OAuth sign-in (Google), email and communication tools, security monitoring, and system maintenance. Such providers shall be bound by contractual obligations requiring them to process personal data only in accordance with CricRise's instructions and to implement appropriate confidentiality and security measures. They are not authorised to use your data for their own unrelated marketing.

Coaches and academies: Where you have expressly authorised such sharing, CricRise may make your performance data, video analytics, and session history available to coaches, academies, or partner organisations with whom you are affiliated. Coaches may also create read-only share links for parents/guardians. Those links expose only the analysis content allowed by our share redaction rules (stricter for younger age groups).

Legal and regulatory disclosures: CricRise may disclose personal data where such disclosure is necessary to comply with applicable laws, regulations, court orders, subpoenas, or lawful requests from governmental or regulatory authorities, or to protect the security and integrity of the service.

Professional advisors: CricRise may share personal data with its legal, financial, and compliance advisors where necessary to obtain professional advice, enforce its legal rights, or ensure compliance with applicable obligations, subject to appropriate confidentiality safeguards.

Corporate transactions:In the event of a merger, acquisition, restructuring, financing, or sale of all or part of CricRise's business or assets, personal data may be transferred to the relevant counterparties, subject to appropriate confidentiality and data protection safeguards.

Aggregated and anonymised data: CricRise may share information that has been aggregated or anonymised in such a manner that it no longer identifies any individual, for purposes including analytics, research, and improvement of the Platform.

CricRise retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or for such longer periods as may be required to comply with applicable legal obligations or to enforce legal rights.

The indicative retention periods for different categories of personal data are as follows:

• account registration data shall be retained for the duration of the account and for a period of one (1) year thereafter;
• video recordings, pose/analysis results, and comparison stills shall be retained for a period of twelve (12) months from the date of upload, unless extended by you, a coach/admin, or the parent or lawful guardian;
• performance and session history shall be retained for the duration of the account and for a period of two (2) years thereafter;
• marketing communications data shall be retained until withdrawal of consent;
• technical and security logs shall be retained for a period of up to twenty-four (24) months;
• anonymised research and analytics data, which does not identify any individual, may be retained without time limitation;
• records required to be maintained under applicable tax and corporate laws shall be retained for such periods as are prescribed under the relevant statutes (typically eight (8) years);
• in accordance with the DPDP Rules, CricRise shall retain personal data, associated traffic data, and security logs for a minimum period of one (1) year from the date of collection or generation, for purposes including responding to lawful requests from authorities, supporting investigations, and incident detection and remediation, after which such data shall be erased unless a longer retention period is required under applicable law; and
• prior to the expiry of the applicable retention period and the consequent erasure of any personal data, CricRise shall intimate the concerned Data Principal at least forty-eight (48) hours in advance of such erasure, in accordance with the DPDP Rules, to provide the Data Principal an opportunity to request preservation of such data.

Upon expiry of the applicable retention period, personal data shall be securely deleted, anonymised, or isolated, subject to technical feasibility and legal requirements. Backup and archival copies may be retained for limited additional periods in accordance with internal data retention and security policies. You can request deletion of your account data through in-product admin flows where available, or by contacting the Grievance Officer.

CricRise implements and maintains reasonable technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss, or misuse, in accordance with the requirements prescribed under Section 8(5) of the DPDPA and Rule 8 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, to the extent that such Rules continue to apply and have not been superseded by the DPDPA and the Digital Personal Data Protection Rules, 2025.

Such measures include, where appropriate, encryption of data in transit (via Transport Layer Security) and at rest, role-based access controls, multi-factor authentication for administrative accounts, secure cloud infrastructure, periodic vulnerability assessments and penetration testing, internal data handling policies, and confidentiality obligations binding on employees and service providers.

CricRise restricts access to personal data to authorised personnel and service providers who require such access for legitimate operational purposes and who are subject to confidentiality obligations.

While CricRise takes reasonable steps to safeguard personal data, no method of transmission over the internet or electronic storage can be guaranteed to be completely secure. You acknowledge that the use of the Platform involves inherent security risks.

Data breach notification: In the event of a personal data breach, AreteSports Private Limited shall, on becoming aware of such breach, intimate the Data Protection Board of India without delay, and shall furnish to the Board a detailed report within seventy-two (72) hours of becoming aware of the breach, or within such longer period as the Board may allow on a request made in writing. AreteSports Private Limited shall, without delay on becoming aware of the breach, also intimate each affected Data Principal, through their user account or other mode of communication, in plain and clear language, setting out a description of the breach including its nature, extent, timing and location; the likely consequences relevant to that Data Principal; the measures implemented or proposed to mitigate risk; the safety measures the Data Principal may take to protect their interests; and the contact details of a person able to respond to queries. Failure to comply with the obligations relating to a personal data breach may attract penalties under the DPDPA.

CricRise acknowledges that as the Platform scales in terms of user base and volume of personal data processed, it may be designated as a Significant Data Fiduciary by the Central Government under Section 10 of the DPDPA. Upon such designation, CricRise shall comply with the additional obligations applicable to Significant Data Fiduciaries, including the appointment of a Data Protection Officer, conduct of annual Data Protection Impact Assessments, periodic independent audits, and algorithmic fairness assessments, as required under the DPDP Act and the DPDP Rules.

The Platform employs artificial intelligence and machine learning technologies to generate batting technique scores, comparison stills, and coaching feedback. You acknowledge that such outputs are advisory in nature and are intended to supplement, and not to substitute, the professional judgement of qualified coaches, sports physicians, or medical practitioners.

CricRise shall not undertake automated decision-making that produces legal or similarly significant effects on a Data Principal without implementing appropriate safeguards, including the right to obtain human review of such decisions.

Where User data is used to train or refine AI models, CricRise shall use anonymised or aggregated data wherever technically feasible. Users (or their parents/lawful guardians, in the case of Minors) shall have the right to opt out of having their data used for AI model training, by writing to the Grievance Officer.

Medical disclaimer: The technique scores and biomechanical insights generated by the Platform are not medical diagnoses and shall not be relied upon as a substitute for medical advice, diagnosis, or treatment. Users are advised to consult a qualified medical practitioner for any medical concerns.

CricRise primarily processes personal data within India. However, certain service providers engaged by CricRise (including cloud hosting and analytics providers) may operate from, or transfer data to, jurisdictions outside India.

Under Section 16 of the DPDPA, the transfer of personal data outside India is generally permitted to all countries and territories, except those which the Central Government may notify as restricted from time to time. CricRise shall not transfer personal data to any country or territory so notified as restricted. Users are advised to monitor the Central Government's notifications in this regard, which will be published by the Ministry of Electronics and Information Technology.

CricRise shall implement appropriate safeguards in respect of such cross-border transfers, including contractual protections with the relevant service providers, to ensure that the personal data continues to receive an adequate standard of protection.

Subject to applicable law, you (and, in the case of a Minor, the parent or lawful guardian) shall have the following rights in relation to your personal data:

• Right to access information: You have the right to obtain a summary of personal data being processed, the processing activities undertaken, and the identities of the Data Fiduciaries and Data Processors with whom your data has been shared, in accordance with Section 11 of the DPDPA.
• Right to correction and erasure: You have the right to request correction of inaccurate or misleading personal data, completion of incomplete data, updating of personal data, and erasure of personal data that is no longer necessary for the purpose for which it was processed, in accordance with Section 12 of the DPDPA.
• Right to grievance redressal: You have the right to a readily available means of grievance redressal, as set out in Section 14 of this Policy and in accordance with Section 13 of the DPDPA.
• Right of nomination: You have the right to nominate any other individual who shall, in the event of your death or incapacity, exercise your rights under the DPDPA, in accordance with Section 14 of the said Act.
• Right to withdraw consent: Where processing is based on consent, you have the right to withdraw such consent at any time from Settings on this website, or by writing to the Grievance Officer. The full Consent Notice is at www.cricrise.in/consent.
• Right to file a complaint: You have the right to lodge a complaint with the Data Protection Board of India in the event of any contravention of the provisions of the DPDPA.

Requests to exercise the above rights may be submitted in writing to the Grievance Officer designated under Section 14. CricRise shall acknowledge such requests within forty-eight (48) hours of receipt and shall endeavour to resolve them within ninety (90) days, in accordance with Rule 13 of the DPDP Rules, 2025, or such other period as may be prescribed under applicable law.

CricRise reserves the right to verify your identity before responding to any request, and may decline or limit a request where permitted under applicable law, including where the request is manifestly unfounded, excessive, or repetitive, or would adversely affect the rights of other Users.

You may also accept or reject analytics via the cookie banner, update or delete account information where the product allows, and sign out and clear browser storage to remove local preferences.

CricRise uses cookies and similar tracking technologies in connection with the operation of the Platform. Cookies are small data files that are stored on your device when you access the Platform.

The categories of cookies used on the Platform include:

• Strictly necessary cookies, which enable core functionality, authentication, and session management, and for which consent is not required;
• Functional cookies, which remember user preferences (such as theme and language stored in your browser) and improve the user experience;
• Analytics cookies, which measure usage patterns (currently Vercel Analytics and Speed Insights) and improve Platform performance, and which are deployed only after you choose Accept analytics on the cookie banner. You can reject analytics and still use CricRise.

CricRise does not currently use marketing cookies, and does not use tracking technologies for cross-platform behavioural advertising directed at Minors.

Your analytics choice is stored in your browser (cricrise-cookie-consent). Clearing site data will show the banner again. Disabling certain cookies may affect the availability or functionality of the Platform.

The Platform may integrate with, rely upon, or contain links to third-party services, websites, or applications that are not owned or controlled by CricRise, including Google sign-in and the AthleteRise website.

Your use of such third-party services is subject to the respective terms and privacy policies of those third parties. CricRise does not control, endorse, or assume responsibility for the practices, security, availability, or performance of any third-party service.

Where personal data is shared with third-party service providers in the course of operating the Platform, such sharing shall be subject to appropriate contractual safeguards, including a Data Processing Agreement, where required.

In accordance with Section 8(9) of the DPDPA and the Digital Personal Data Protection Rules, 2025, CricRise has designated a Grievance Officer to address queries, concerns, and complaints relating to personal data.

The contact details of the Grievance Officer are as follows:

• Name — Vishesh Tayal;
• Designation — Grievance Officer, CricRise (AreteSports Private Limited);
• Email — vishesh.athleterise@gmail.com;
• Postal Address — 184, Sec 15 HUDA, Yamunanagar 135001;
• Working Hours — Monday to Friday, 10:00 AM to 6:00 PM IST (excluding public holidays).

Complaints addressed to the Grievance Officer shall be acknowledged within forty-eight (48) hours of receipt and shall be resolved within ninety (90) days, in accordance with Rule 13 of the DPDP Rules, 2025, or such other period as may be prescribed under applicable law.

If you are dissatisfied with the resolution of your complaint, you may approach the Data Protection Board of India in accordance with the provisions of the DPDPA.

CricRise reserves the right to modify or update this Policy from time to time to reflect changes in the Platform, applicable laws, regulatory requirements, or data processing practices.

Where changes are material, CricRise shall take reasonable steps to notify Users through appropriate means, including notifications on the Platform, in-app banners, or communication via the email address associated with your account. The "Last updated" date set out at the beginning of this Policy shall reflect the date of the most recent revision.

Your continued access to or use of the Platform following the publication of an updated Policy shall constitute your acknowledgement of such changes. If you do not agree with any updates to this Policy, you should discontinue use of the Platform.

This Policy shall be governed by and construed in accordance with the laws of the Republic of India, including the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025, the Information Technology Act, 2000, and the rules and regulations framed thereunder.

Subject to the statutory jurisdiction of the Data Protection Board of India, any dispute arising out of or in connection with this Policy shall first be referred to arbitration in accordance with the provisions of the Arbitration and Conciliation Act, 1996, as amended. The arbitration shall be conducted by a sole arbitrator mutually appointed by the parties, with the seat and venue at New Delhi, India, and proceedings conducted in the English language. The arbitral award shall be final and binding. Notwithstanding the foregoing, CricRise shall have the right to seek interim or injunctive relief before any court of competent jurisdiction. Subject to the above, the courts at New Delhi, India shall have exclusive jurisdiction over any matters arising out of or relating to this Policy.

Related: Consent Notice · Terms & Conditions.