Privacy Policy

1. Who we are

Sqoura (“we”, “us”) operates the tournament management platform at sqoura.com and app.sqoura.com. We operate from Sri Lanka and we are the data controller for the information described in this policy, except where Section 5 says otherwise.

2. Information we collect

Information you give us directly

• Account details — name, email address, password (stored only as a cryptographic hash, never in readable form), organisation name, role, and telephone number where you provide one.
• Competitor and entry details — the information a tournament entry form asks for. This typically includes full name, date of birth, gender, nationality, club, discipline, belt or grade, weight and weight category, coach details, and emergency contact details. The organiser running the event decides which of these fields to ask for.
• Documents you upload — such as licence cards, medical certificates, photographs for accreditation, and payment slips, where an event requires them.
• Correspondence — messages you send us through the contact form, support requests, and emails, along with our replies.

Information we collect automatically

• Technical data — IP address, browser type and version, device type, operating system, language, and time zone.
• Usage data — pages visited, features used, timestamps, and referring page.
• Security logs — sign-in attempts, session identifiers, and the record of actions taken inside an organisation’s account, which we keep so account owners can audit who changed what.

We do not buy personal data from third parties, and we do not sell yours to anyone. Ever.

3. Why we use it

We do not use your data to make automated decisions that produce a legal or similarly significant effect on you.

4. Payment information

Tournament entry fees are processed by PayHere, a licensed payment service provider in Sri Lanka. Platform subscription payments are processed by Paddle. Each of them is an independent controller of the payment data it collects, and each publishes its own privacy policy.

What we receive back and store is limited to: the transaction reference, the amount and currency, the date and time, the outcome, the card brand, the last four digits of the card, and the name on the payment. We keep this so we can reconcile entries, issue receipts, and process refunds.

5. Organisers and their athletes

Sqoura is used by clubs and federations to collect entries from their own athletes. Where you submit an entry to a tournament, the organisation running that tournament decides what to ask you for and what to do with your answers — it is the data controller for that entry, and Sqoura acts as its data processor, handling the data on its documented instructions.

In practice this means requests to correct or delete a competitor’s entry data are usually best directed at the organisation you entered with. If you send such a request to us, we will pass it to the relevant organisation and tell you that we have done so.

For our own website visitors, account holders, and billing records, Sqoura is the controller and you can exercise your rights with us directly.

6. Who we share it with

We share personal information only in these situations:

• The organisation running an event you entered — so it can verify eligibility, build the draw, and run the competition.
• Payment providers — PayHere and Paddle, to take payments and process refunds.
• Infrastructure and service providers that operate under contract on our behalf: cloud hosting and database services, object storage for uploaded files, transactional email delivery, error monitoring, and product analytics. They may only process data on our instructions and may not use it for their own purposes.
• Publicly, where the competition format requires it — start lists, draws, brackets, and results published by an organiser normally include a competitor’s name, club, and category. This is how competitive sport works, and organisers decide what to publish.
• Professional advisers, auditors, and authorities where we are required to disclose by law, court order, or a valid regulatory request.
• A buyer or successor, if the business is sold or merged. We would tell you before your data became subject to a different privacy policy.

We do not sell personal information, and we do not share it with advertisers.

7. Cookies and analytics

We use a small number of cookies and similar technologies:

• Strictly necessary — keeping you signed in, remembering which organisation you are working in, and protecting forms against cross-site request forgery. The platform does not function without these.
• Preference — remembering choices such as list filters and display settings.
• Analytics — aggregated, privacy-respecting measurement of which features are used, so we know what to improve. We do not use advertising or cross-site tracking cookies.

You can block or delete cookies through your browser settings. Blocking the strictly necessary ones will stop you being able to sign in.

8. How we protect it

• All traffic to and from our sites is encrypted in transit using TLS.
• Data at rest, including database backups, is encrypted.
• Passwords are stored only as salted cryptographic hashes and are never recoverable.
• Two-factor authentication is available on all accounts, and required for sensitive administrative actions.
• Access to production systems is restricted to named staff who need it, and is logged.
• Every significant action inside an organisation’s account is written to a tamper-evident audit log.

No system is perfectly secure, but if a breach ever affects your personal data and is likely to put your rights at risk, we will notify you and the relevant authority without undue delay.

9. How long we keep it

• Account data — for as long as the account is open, then 12 months after closure.
• Entry and competition records — for as long as the organising body needs them for its own records; historic results are commonly retained indefinitely by the sport.
• Payment and invoice records — retained for the period required by tax and accounting law in Sri Lanka.
• Uploaded documents — deleted 12 months after the event they relate to, unless the organiser needs them longer for licensing purposes.
• Security and audit logs — retained for up to 24 months.
• Support correspondence — retained for 24 months after the request is closed.

10. Your rights

You can ask us to:

• Access the personal data we hold about you, and get a copy of it.
• Correct anything that is inaccurate or incomplete.
• Delete your data, where we have no continuing legal or contractual reason to keep it.
• Restrict or object to how we use it, including profiling based on legitimate interests.
• Port your data to another provider in a structured, machine-readable format.
• Withdraw consent at any time, where we relied on consent. This does not affect anything done beforehand.
• Unsubscribe from marketing email, using the link in any such message.

Email [email protected] and we will respond within 30 days. We may need to verify your identity first — that protects you, not us. Exercising these rights is free.

11. Children and minors

Martial arts competitions have junior categories, so we knowingly process data about minors — but only when it is submitted by a parent, guardian, coach, or club official who is entitled to do so. We do not allow anyone under 16 to create their own Sqoura account.

Junior competitor data is treated with the same protections as everything else in this policy, and organisers are responsible for obtaining the parental consent their national federation or local law requires. A parent or guardian can contact us at any time to see, correct, or ask for the removal of a child’s data.

12. International transfers

Sqoura serves organisations in several countries, and some of our infrastructure and service providers operate outside Sri Lanka. Where personal data is transferred abroad, we require the recipient to protect it to a standard equivalent to this policy, using contractual safeguards such as standard contractual clauses.

13. Changes to this policy

We update this policy when our practices change. The revision date appears at the top of the page. If a change materially affects how we use your data, we will tell account holders by email before it takes effect.

14. Contact us

For any privacy question, or to exercise a right under Section 10:

If you are not satisfied with our response, you may complain to the data protection authority in your country of residence.