Privacy Policy
Last updated: 26 August 2026
This Privacy Policy ("Policy") sets out how AreteSports Private Limited, a company incorporated under the Companies Act, 2013 and operating the "AthleteRise" brand ("AthleteRise", "we", "us", or "our"), collects, uses, processes, stores, discloses, and protects personal data in connection with your access to and use of the AthleteRise platform, including its website www.athleterise.in, mobile applications (when launched), and all related services (collectively, the "Platform").
This Policy applies to all individuals who access or use the Platform, including aspiring athletes across various sports, parents and lawful guardians of minor athletes, coaches, academies, and visitors to our website ("Users", "you", or "your"). It is intended to provide a clear and transparent explanation of the nature of the data we handle and the manner in which such data is processed.
The Platform is designed to support cricket athletes through artificial intelligence-driven video analytics, biomechanical assessment, injury-risk evaluation, and personalised performance feedback. Given that a significant portion of our intended users are minors, this Policy is structured in compliance with the Digital Personal Data Protection Act, 2023 ("DPDPA"), the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and other applicable laws of India.
This Policy has further been structured in compliance with the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), notified by the Ministry of Electronics and Information Technology on 13 November 2025, which operationalise the provisions of the DPDPA. AthleteRise shall implement its obligations under this Policy in accordance with the phased commencement schedule notified by the Central Government, with full operational compliance required by 13 May 2027.
AreteSports Private Limited also operates a separate brand, "CricRise" (www.cricrise.in), which may be accessible through the AthleteRise Platform. While both brands are operated by the same company, CricRise is governed by its own separate Privacy Policy available at www.cricrise.in. When you access CricRise, whether directly or through a link on the AthleteRise Platform, your use of CricRise and the processing of your personal data on it are governed by the CricRise Privacy Policy and not by this Policy. Where personal data is shared or moved between the AthleteRise and CricRise brands operated by AreteSports Private Limited, such movement shall be carried out only in accordance with applicable law and the purposes notified to you at the time of collection.
By accessing or using the Platform, you acknowledge that you have read, understood, and agreed to the terms of this Policy. If you are a parent or lawful guardian, your acknowledgement extends to consent given on behalf of the minor under your care. If you do not agree with the terms of this Policy, you should not access or use the Platform.
1. DEFINITIONS
In this Policy, unless the context otherwise requires, the following terms shall have the meanings set out below:
“Child” or “Minor”: an individual who has not completed eighteen (18) years of age, in accordance with applicable Indian law.
“Data Fiduciary”: AreteSports Private Limited (operating the AthleteRise brand), being the entity which alone or in conjunction with others determines the purpose and means of processing personal data.
“Data Principal”: the individual to whom the personal data relates, including, where the individual is a Child, the parent or lawful guardian of such Child.
“Data Processor”: any person who processes personal data on behalf of AreteSports Private Limited.
“Personal Data”: any data about an individual who is identifiable by or in relation to such data.
“Biometric and Performance Data”: video recordings, images, posture-related data, kinematic measurements, and other body-movement metrics captured or generated through use of the Platform.
“Parent” or “Lawful Guardian”: the natural parent or legally appointed guardian of a Minor, who provides verifiable consent on behalf of the Minor.
“Processing”: any operation performed on personal data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, transmission, or erasure.
“Platform”: the AthleteRise website, mobile applications, and all related services.
2. INFORMATION WE COLLECT
AthleteRise collects and processes certain categories of information in connection with your use of the Platform. Such information may be provided directly by you or your parent/lawful guardian, generated through your interaction with the Platform, or collected automatically through technical means. The scope of data collection is limited to what is necessary for the operation, security, and improvement of the Platform.
Information you provide directly: When you register for early access, create an account, or interact with our forms, we collect basic registration information including first name, last name, email address, telephone number (where provided), date of birth, and details of your parent or lawful guardian (where the User is a Minor). You may also provide profile details such as your primary sport, role, or position (e.g., batter, pitcher, point guard, golfer), academy affiliation, and training preferences.
Biometric and Performance Data: In connection with the AI-powered video analytics features of the Platform, we collect and process video recordings, images, posture data, biomechanical measurements (including swing mechanics, throwing kinematics, shooting form, sport-specific stances, and gait, in each case as and when the relevant sport-specific features are introduced), workload indicators, and derived performance metrics. Such data is collected solely for the purpose of providing coaching feedback, injury-risk analysis, and performance development.
Health and injury-related information: Where you voluntarily provide details regarding past injuries, medical conditions, or physical limitations, such information will be collected and processed strictly for the purpose of generating injury-risk assessments and personalised training feedback.
Information collected automatically: When you visit the Platform, we automatically collect certain technical and device-related information, including your Internet Protocol (IP) address, device type, operating system, browser type and version, access times, referring website, pages visited, and usage logs. This information is used for security monitoring, fraud prevention, system performance, diagnostics, and analytics.
Information from third parties: Where applicable, we may receive information about you from academies, coaches, or partner organisations with whom you are affiliated, where such sharing has been authorised by you or your parent/lawful guardian.
Cookies and tracking technologies: As more particularly described in Section 12 below, we use cookies, log files, and similar tracking technologies to collect information regarding your interaction with the Platform.
AthleteRise does not knowingly collect categories of sensitive personal data beyond what is necessary to operate the services. We do not collect government-issued identification, banking information, or payment card details at the present stage of operation.
3. PROCESSING OF CHILDREN'S DATA
AthleteRise expressly acknowledges that a substantial portion of its intended Users are Minors. In accordance with Section 9 of the DPDPA, the personal data of a Child shall be processed only after obtaining verifiable consent from the parent or lawful guardian of such Child.
Verifiable parental consent shall be obtained through such means as AthleteRise may reasonably implement, which may include one-time password (OTP) verification on a registered mobile number or email address, declaration by the parent/guardian, verification through DigiLocker, the government-backed digital document wallet, to establish the identity of the parent and the parent-child relationship in accordance with Rule 10 of the DPDP Rules, and such other measures as may be prescribed under applicable law.
AthleteRise shall not undertake any tracking, behavioural monitoring of Children, or targeted advertising directed at Children. Further, AthleteRise shall not process the personal data of a Child in a manner that is likely to cause any detrimental effect on the well-being of the Child.
Parents and lawful guardians shall have the right, at any time, to access, review, correct, or request deletion of the personal data of the Child under their care, and to withdraw consent previously granted. Such withdrawal shall not affect the lawfulness of processing carried out prior to such withdrawal.
Any User who is a Minor is required to use the Platform only under the supervision and with the consent of their parent or lawful guardian. AthleteRise reserves the right to suspend or terminate any account where it has reasonable grounds to believe that the requirements of this Section have not been complied with.
Requests, complaints, or concerns relating to the processing of a Child's personal data may be addressed to the Grievance Officer designated under Section 14 of this Policy.
4. PURPOSES FOR WHICH INFORMATION IS USED
AthleteRise processes the information collected for purposes that are specific, lawful, and necessary to operate, maintain, secure, and improve the Platform. The principal purposes are set out below:
account creation, authentication, and management of your User profile;
delivery of AI-generated coaching feedback, video analytics, and skill-development insights;
generation of injury-risk assessments and workload monitoring outputs;
facilitation of academy- and coach-level dashboards, where you have authorised such sharing;
communication with you, including service-related notifications, security alerts, account updates, and responses to your enquiries;
sending newsletters, product updates, and marketing communications, only where you have opted in to receive such communications;
maintenance of the security, integrity, and functionality of the Platform, including detection, prevention, and investigation of fraud, abuse, and unauthorised access;
development, training, and improvement of our artificial intelligence models, using anonymised or aggregated data wherever feasible;
compliance with applicable legal, regulatory, or judicial obligations;
establishment, exercise, or defence of legal claims, where necessary.
AthleteRise shall not process your personal data for any purpose that is incompatible with the purposes set out above, without first obtaining your fresh consent.
5. LEGAL BASIS FOR PROCESSING
AthleteRise processes personal data on one or more of the following legal grounds, depending on the nature of the data and the purpose of processing:
Consent: Processing is primarily carried out on the basis of the free, specific, informed, unconditional, and unambiguous consent of the Data Principal, in accordance with Section 6 of the DPDPA. In the case of a Minor, such consent shall be obtained from the parent or lawful guardian.
Performance of services: Where processing is necessary for the performance of services requested by you, including account management, delivery of coaching feedback, and platform functionality.
Legitimate uses: Where processing is necessary for purposes specified under Section 7 of the DPDPA, including responding to medical emergencies, compliance with judgments or court orders, and other lawful purposes.
Legal obligations: Where processing is necessary to comply with applicable laws, regulations, court orders, or lawful requests from governmental or regulatory authorities.
Consent Manager: Upon operationalisation of the Consent Manager framework under Rule 4 of the DPDP Rules (expected November 2026), AthleteRise shall assess whether integration with a registered Consent Manager is required for its operations, and shall implement such integration where mandated or appropriate, to enable Data Principals to grant, manage, review, and withdraw consent through an independent intermediary
Where processing is based on consent, you (or your parent/lawful guardian, in the case of a Minor) shall have the right to withdraw such consent at any time, by writing to the Grievance Officer at the contact address specified in Section 14. Withdrawal of consent shall not affect the lawfulness of processing carried out prior to such withdrawal.
6. SHARING AND DISCLOSURE OF INFORMATION
AthleteRise does not sell, rent, or trade your personal data to any third party for commercial gain. Personal data may, however, be disclosed or made accessible in the limited circumstances described in this Section.
Service providers: AthleteRise may engage third-party service providers to perform functions on its behalf, including cloud hosting and infrastructure (such as Amazon Web Services or Microsoft Azure), data storage, analytics, email and communication tools, security monitoring, and system maintenance. Such providers shall be bound by contractual obligations requiring them to process personal data only in accordance with AthleteRise's instructions and to implement appropriate confidentiality and security measures.
Coaches and academies: Where you have expressly authorised such sharing, AthleteRise may make your performance data, video analytics, and progress reports available to coaches, academies, or partner organisations with whom you are affiliated. Such sharing shall be limited to the minimum data necessary and shall be subject to a Data Processing Agreement between AthleteRise and the relevant academy or coach.
Legal and regulatory disclosures: AthleteRise may disclose personal data where such disclosure is necessary to comply with applicable laws, regulations, court orders, subpoenas, or lawful requests from governmental or regulatory authorities.
Professional advisors: AthleteRise may share personal data with its legal, financial, and compliance advisors where necessary to obtain professional advice, enforce its legal rights, or ensure compliance with applicable obligations, subject to appropriate confidentiality safeguards.
Corporate transactions: In the event of a merger, acquisition, restructuring, financing, or sale of all or part of AthleteRise's business or assets, personal data may be transferred to the relevant counterparties, subject to appropriate confidentiality and data protection safeguards.
Aggregated and anonymised data: AthleteRise may share information that has been aggregated or anonymised in such a manner that it no longer identifies any individual, for purposes including analytics, research, and improvement of the Platform.
7. DATA RETENTION
AthleteRise retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or for such longer periods as may be required to comply with applicable legal obligations or to enforce legal rights.
The indicative retention periods for different categories of personal data are as follows:
account registration data shall be retained for the duration of the account and for a period of one (1) year thereafter;
video recordings and biomechanical data shall be retained for a period of twelve (12) months from the date of upload, unless extended by the parent or lawful guardian;
performance and progress reports shall be retained for the duration of the account and for a period of two (2) years thereafter;
marketing communications data shall be retained until withdrawal of consent;
technical and security logs shall be retained for a period of up to twenty-four (24) months;
anonymised research and analytics data, which does not identify any individual, may be retained without time limitation;
records required to be maintained under applicable tax and corporate laws shall be retained for such periods as are prescribed under the relevant statutes (typically eight (8) years);
in accordance with the DPDP Rules, AthleteRise shall retain personal data, associated traffic data, and security logs for a minimum period of one (1) year from the date of collection or generation, for purposes including responding to lawful requests from authorities, supporting investigations, and incident detection and remediation, after which such data shall be erased unless a longer retention period is required under applicable law; and
prior to the expiry of the applicable retention period and the consequent erasure of any personal data, AthleteRise shall intimate the concerned Data Principal at least forty-eight (48) hours in advance of such erasure, in accordance with the DPDP Rules, to provide the Data Principal an opportunity to request preservation of such data.
Upon expiry of the applicable retention period, personal data shall be securely deleted, anonymised, or isolated, subject to technical feasibility and legal requirements. Backup and archival copies may be retained for limited additional periods in accordance with internal data retention and security policies.
8. DATA SECURITY
AthleteRise implements and maintains reasonable technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss, or misuse, in accordance with the requirements prescribed under Section 8(5) of the DPDPA and Rule 8 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, to the extent that such Rules continue to apply and have not been superseded by the DPDPA and the Digital Personal Data Protection Rules, 2025.
Such measures include, where appropriate, encryption of data in transit (via Transport Layer Security) and at rest, role-based access controls, multi-factor authentication for administrative accounts, secure cloud infrastructure, periodic vulnerability assessments and penetration testing, internal data handling policies, and confidentiality obligations binding on employees and service providers.
AthleteRise restricts access to personal data to authorised personnel and service providers who require such access for legitimate operational purposes and who are subject to confidentiality obligations.
While AthleteRise takes reasonable steps to safeguard personal data, no method of transmission over the internet or electronic storage can be guaranteed to be completely secure. You acknowledge that the use of the Platform involves inherent security risks.
Data breach notification: In the event of a personal data breach, AreteSports Private Limited shall, on becoming aware of such breach, intimate the Data Protection Board of India without delay, and shall furnish to the Board a detailed report within seventy-two (72) hours of becoming aware of the breach, or within such longer period as the Board may allow on a request made in writing. AreteSports Private Limited shall, without delay on becoming aware of the breach, also intimate each affected Data Principal, through their user account or other mode of communication, in plain and clear language, setting out a description of the breach including its nature, extent, timing and location; the likely consequences relevant to that Data Principal; the measures implemented or proposed to mitigate risk; the safety measures the Data Principal may take to protect their interests; and the contact details of a person able to respond to queries. Failure to comply with the obligations relating to a personal data breach may attract penalties under the DPDPA.
AthleteRise acknowledges that as the Platform scales in terms of user base and volume of personal data processed, it may be designated as a Significant Data Fiduciary by the Central Government under Section 10 of the DPDPA. Upon such designation, AthleteRise shall comply with the additional obligations applicable to Significant Data Fiduciaries, including the appointment of a Data Protection Officer, conduct of annual Data Protection Impact Assessments, periodic independent audits, and algorithmic fairness assessments, as required under the DPDP Act and the DPDP Rules.
9. AUTOMATED DECISION-MAKING AND ARTIFICIAL INTELLIGENCE
The Platform employs artificial intelligence and machine learning technologies to generate coaching feedback, biomechanical assessments, and injury-risk scores. You acknowledge that such outputs are advisory in nature and are intended to supplement, and not to substitute, the professional judgement of qualified coaches, sports physicians, or medical practitioners.
AthleteRise shall not undertake automated decision-making that produces legal or similarly significant effects on a Data Principal without implementing appropriate safeguards, including the right to obtain human review of such decisions.
Where User data is used to train or refine AI models, AthleteRise shall use anonymised or aggregated data wherever technically feasible. Users (or their parents/lawful guardians, in the case of Minors) shall have the right to opt out of having their data used for AI model training, by writing to the Grievance Officer.
Medical disclaimer: The injury-risk assessments and biomechanical insights generated by the Platform are not medical diagnoses and shall not be relied upon as a substitute for medical advice, diagnosis, or treatment. Users are advised to consult a qualified medical practitioner for any medical concerns.
10. INTERNATIONAL DATA TRANSFERS
AthleteRise primarily processes personal data within India. However, certain service providers engaged by AthleteRise (including cloud hosting and analytics providers) may operate from, or transfer data to, jurisdictions outside India.
Under Section 16 of the DPDPA, the transfer of personal data outside India is generally permitted to all countries and territories, except those which the Central Government may notify as restricted from time to time. AthleteRise shall not transfer personal data to any country or territory so notified as restricted. Users are advised to monitor the Central Government's notifications in this regard, which will be published by the Ministry of Electronics and Information Technology.
AthleteRise shall implement appropriate safeguards in respect of such cross-border transfers, including contractual protections with the relevant service providers, to ensure that the personal data continues to receive an adequate standard of protection.
11. RIGHTS OF DATA PRINCIPALS
Subject to applicable law, you (and, in the case of a Minor, the parent or lawful guardian) shall have the following rights in relation to your personal data:
Right to access information: You have the right to obtain a summary of personal data being processed, the processing activities undertaken, and the identities of the Data Fiduciaries and Data Processors with whom your data has been shared, in accordance with Section 11 of the DPDPA.
Right to correction and erasure: You have the right to request correction of inaccurate or misleading personal data, completion of incomplete data, updating of personal data, and erasure of personal data that is no longer necessary for the purpose for which it was processed, in accordance with Section 12 of the DPDPA.
Right to grievance redressal: You have the right to a readily available means of grievance redressal, as set out in Section 14 of this Policy and in accordance with Section 13 of the DPDPA.
Right of nomination: You have the right to nominate any other individual who shall, in the event of your death or incapacity, exercise your rights under the DPDPA, in accordance with Section 14 of the said Act.
Right to withdraw consent: Where processing is based on consent, you have the right to withdraw such consent at any time.
Right to file a complaint: You have the right to lodge a complaint with the Data Protection Board of India in the event of any contravention of the provisions of the DPDPA.
Requests to exercise the above rights may be submitted in writing to the Grievance Officer designated under Section 14. AthleteRise shall acknowledge such requests within forty-eight (48) hours of receipt and shall endeavour to resolve them within ninety (90) days, in accordance with Rule 13 of the DPDP Rules, 2025, or such other period as may be prescribed under applicable law.
AthleteRise reserves the right to verify your identity before responding to any request, and may decline or limit a request where permitted under applicable law, including where the request is manifestly unfounded, excessive, or repetitive, or would adversely affect the rights of other Users.
12. COOKIES AND TRACKING TECHNOLOGIES
AthleteRise uses cookies and similar tracking technologies in connection with the operation of the Platform. Cookies are small data files that are stored on your device when you access the Platform.
The categories of cookies used on the Platform include the following: strictly necessary cookies, which enable core functionality, authentication, and session management, and for which consent is not required; functional cookies, which remember user preferences and improve the user experience, and which are deployed only with consent; analytics cookies, which measure usage patterns and improve Platform performance, and which are deployed only with consent; and marketing cookies, which are used to personalise communications (and which shall not be directed at Minors), and which are deployed only with consent.
You may control or disable non-essential cookies through the cookie consent banner displayed on the Platform or through your browser or device settings. Disabling certain cookies may, however, affect the availability or functionality of the Platform.
AthleteRise does not use tracking technologies for cross-platform behavioural advertising directed at Minors.
13. THIRD-PARTY SERVICES AND LINKS
The Platform may integrate with, rely upon, or contain links to third-party services, websites, or applications that are not owned or controlled by AthleteRise.
Your use of such third-party services is subject to the respective terms and privacy policies of those third parties. AthleteRise does not control, endorse, or assume responsibility for the practices, security, availability, or performance of any third-party service.
Where personal data is shared with third-party service providers in the course of operating the Platform, such sharing shall be subject to appropriate contractual safeguards, including a Data Processing Agreement, where required.
14. GRIEVANCE OFFICER AND CONTACT INFORMATION
In accordance with Section 8(9) of the DPDPA and the Digital Personal Data Protection Rules, 2025, AthleteRise has designated a Grievance Officer to address queries, concerns, and complaints relating to personal data.
The contact details of the Grievance Officer are as follows:
Name - Vishesh Tayal;
Designation - Grievance Officer, AthleteRise;
Email - vishesh.athleterise@gmail.com;
Postal Address - 184, Sec 15 HUDA, Yamunanagar 135001;
Working Hours - Monday to Friday, 10:00 AM to 6:00 PM IST (excluding public holidays).
Complaints addressed to the Grievance Officer shall be acknowledged within forty-eight (48) hours of receipt and shall be resolved within ninety (90) days, in accordance with Rule 13 of the DPDP Rules, 2025, or such other period as may be prescribed under applicable law.
If you are dissatisfied with the resolution of your complaint, you may approach the Data Protection Board of India in accordance with the provisions of the DPDPA.
15. CHANGES TO THIS POLICY
AthleteRise reserves the right to modify or update this Policy from time to time to reflect changes in the Platform, applicable laws, regulatory requirements, or data processing practices.
Where changes are material, AthleteRise shall take reasonable steps to notify Users through appropriate means, including notifications on the Platform, in-app banners, or communication via the email address associated with your account. The "Last Updated" date set out at the beginning of this Policy shall reflect the date of the most recent revision.
Your continued access to or use of the Platform following the publication of an updated Policy shall constitute your acknowledgement of such changes. If you do not agree with any updates to this Policy, you should discontinue use of the Platform.
16. GOVERNING LAW AND JURISDICTION
This Policy shall be governed by and construed in accordance with the laws of the Republic of India, including the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025, the Information Technology Act, 2000, and the rules and regulations framed thereunder.
Subject to the statutory jurisdiction of the Data Protection Board of India, any dispute arising out of or in connection with this Policy shall first be referred to arbitration in accordance with the provisions of the Arbitration and Conciliation Act, 1996, as amended. The arbitration shall be conducted by a sole arbitrator mutually appointed by the parties, with the seat and venue at New Delhi, India, and proceedings conducted in the English language. The arbitral award shall be final and binding. Notwithstanding the foregoing, AthleteRise shall have the right to seek interim or injunctive relief before any court of competent jurisdiction. Subject to the above, the courts at New Delhi, India shall have exclusive jurisdiction over any matters arising out of or relating to this Policy.