Account Policy

CORPSE

The Operating System for Esports

Account Creation & Deletion

Privacy Policy

What We Collect • Why • How It's Protected • Your Rights

DPDP Act 2023 Compliant | Version 1.0 | Final

This Privacy Policy governs data collected and processed exclusively during account creation, sign-up authentication, and account deletion on the Corpse platform. All other platform data practices are governed by the Corpse Full Privacy Policy.

PART I — INTRODUCTION & SCOPE

1. Who This Policy Applies To

[CORPSE ESPORTS PRIVATE LIMITED] ("Company", "we", "us", "our") publishes this Account Creation & Deletion Privacy Policy for the Corpse platform ("Platform"). This Policy applies to:

• Any individual creating a new account on the Platform via the mobile application.
• Any individual who begins but does not complete the sign-up process — to the extent any data was submitted before abandonment.
• Any individual accessing the Platform as a Guest User prior to creating an account.
• Any Registered User who initiates or completes the account deletion process.

This Policy is strictly scoped to the account creation and deletion stages. For all other platform data practices — including tournament participation, payments, communications, and analytics — refer to the Corpse Full Privacy Policy.

2. What This Policy Covers & Excludes

2.1 What This Policy Covers

• Data collected from Guest Users before any account is created
• Personal data submitted in the sign-up registration form
• Data processed via authentication methods at sign-up (passwordless email, Google, Apple)
• Location data collected at the point of registration
• Data auto-generated by the Platform when your account is created
• The authentication event log entry created at sign-up
• Communications directly triggered by the sign-up and deletion acts (Magic Link email and deletion verification link)
• Data processed during the account deletion request and verification flow
• Fate of all data categories after account deletion

2.2 What This Policy Explicitly Does NOT Cover

3. Legal Basis for Processing

We process your account creation and deletion data under the following legal bases as recognised under the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000:

PART II — DATA COLLECTED AT ACCOUNT CREATION

4. Guest User — Data Collected Before Sign-Up

Before creating an account, you may access the Corpse Platform as a Guest User. During a Guest session:

• No personal data of any kind is collected or stored.
• No registration information, name, email, or location data is recorded.
• The session is entirely temporary and stateless — nothing persists once the session ends.
• If you proceed to create an account after a Guest session, your Guest session is discarded completely. Nothing from your Guest session is associated with or carried over to your new account in any form.

Important: Guest access does not constitute account creation and generates no stored data, profile, or platform history of any kind.

5. Registration Form Data

When you complete the sign-up form to create a Corpse account, you are required to provide the following personal data. All fields are mandatory — the Platform will not permit account creation if any field is blank or contains invalid data.

Note: Phone numbers are not collected at any point during account creation. The Platform does not require a phone number for sign-up under any authentication method.

6. Authentication Method Data

The Platform supports three authentication methods. No passwords are stored under any method. Each method processes data as follows:

6.1 Passwordless Email Authentication (Magic Link)

Note: The Magic Link is delivered only to your registered email address. You are solely responsible for the security of your email account.

6.2 Google Sign-In

When you sign up via Google, the Platform receives only the following from Google's OAuth 2.0 service:

• Your Google account's email address — used as your Platform account identifier.
• Your Google account's display name — used as the basis for generating your Platform username.

The Platform does not receive your Google password, recovery details, contacts, Google Drive data, or any other Google account information. Authentication is handled entirely by Google's infrastructure. Corpse only receives the output — email and name.

Note: If you use Google Sign-In, your Corpse account email is your Google account email. Changes to your Google account email do not automatically update your Corpse account. You must initiate an email change separately within Corpse settings.

6.3 Apple Sign-In

When you sign up via Apple (Apple devices only), the Platform receives only the following from Apple:

• Your Apple ID email address — or an Apple-generated relay email address if you use the 'Hide My Email' feature. Either becomes your Platform account identifier.
• Your name as provided by Apple — used as the basis for generating your Platform username. Apple only shares the name on first sign-in; subsequent sign-ins do not re-share it.

The Platform does not receive your Apple ID password, iCloud data, payment information, or any other Apple account data.

Important: If you use Apple's 'Hide My Email' feature, your Platform account is permanently tied to the relay email Apple provides — not your real Apple ID email. If you lose access to that relay address, account recovery becomes extremely difficult. Note your relay email address after sign-up.

6.4 One Email Per Account — Privacy Implications

• Your email address is stored as a unique identifier in our database the moment your account is created.
• The same email cannot be used to create another account via any authentication method.
• This uniqueness constraint is permanent — including after account deletion. A deleted account's email is retired and cannot be re-registered.
• This means your email address remains in our system indefinitely as a retired identifier, even if all other account data is removed.

7. Location Data Collected at Registration

Precise latitude and longitude are collected only after you explicitly grant location permission to the Corpse app on your device. This permission prompt appears separately from the registration form. You may revoke this permission at any time via your device settings (Settings > Corpse > Location). Revoking stops future collection but does not delete previously collected lat/long data.

Note: To request deletion of your lat/long data specifically, contact legal@corpsearena.com with the subject line 'Location Data Deletion Request'.

8. Auto-Generated Data at Sign-Up

When your account is successfully created, the Platform automatically generates and stores the following:

9. Authentication Event Log at Sign-Up

At the moment your account is created, the Platform records a single authentication event log entry containing:

• Authentication method used (email Magic Link, Google, or Apple)
• Timestamp of account creation (date and time in IST)

This is the only technical data recorded at sign-up. No IP address, device model, operating system, or any other device-identifying information is collected or stored at account creation.

Note: This authentication event log is retained indefinitely as part of the security audit trail and for fraud prevention purposes.

PART III — COMMUNICATIONS TRIGGERED BY ACCOUNT CREATION & DELETION

10. Magic Link Email — Sign-Up

When you choose passwordless email authentication during sign-up, the Platform sends a single transactional email to your registered email address. This is the only communication triggered directly by the account creation act itself.

11. Account Deletion Verification Link Email

When you initiate an account deletion request, the Platform sends a single transactional email to your registered email address as part of the identity verification step (Step 3 of the deletion process as described in the Corpse Terms & Conditions, Section 21).

Note: The 3-login-attempt limit does not apply to deletion verification links. These are separate, isolated one-time security tokens issued exclusively for the deletion flow.

12. Scope Boundary — What Is Not Covered Here

The following communications are explicitly outside the scope of this Policy. They are triggered by post-registration platform activity and are governed by the Corpse Full Privacy Policy:

PART IV — WHY WE COLLECT EACH FIELD

13. Purpose Mapping Table

The following table maps every data field collected at account creation to its specific documented purpose, secondary use, and legal basis. We collect only what is strictly necessary for the stated purposes.

PART V — STORAGE, PROTECTION & RETENTION

14. Security of Registration & Deletion Data

All registration and deletion data is stored on secure, cloud-based servers. The following security measures apply specifically to account creation and deletion data:

15. Third-Party Access at Sign-Up & Deletion Stage

At the account creation and deletion stages specifically, your data is shared with the following third parties only:

• Google (if you use Google Sign-In): Google's OAuth 2.0 infrastructure processes your Google credentials to authenticate you. Corpse receives only your email and name from Google.
• Apple (if you use Apple Sign-In on Apple devices): Apple's Sign-In infrastructure processes your Apple ID credentials. Corpse receives only your email (or relay email) and name from Apple.

At the account creation and deletion stage, your data is NOT shared with:

• Razorpay or any payment processor — payment gateway data sharing only occurs at KYC verification stage, which is post-registration and governed by the Full Privacy Policy.
• Firebase Analytics — analytics data collection begins post-registration through app usage, not at sign-up.
• Any marketing platform, advertiser, or data broker — at any stage.

Important: Corpse does not sell, rent, or trade your registration or deletion data to any third party for any commercial purpose. This is an unconditional commitment.

16. Retention Periods by Data Field

The following table specifies how long each piece of registration data is retained. These periods are determined by legal requirements, platform integrity needs, and contractual obligations.

Note: Account deletion does not result in immediate erasure of all registration data. Where retention is legally mandated or necessary for platform integrity, data is retained as specified. The legal basis for any such retention will be communicated upon written request to legal@corpsearena.com.

PART VI — DATA COLLECTED & PROCESSED DURING ACCOUNT DELETION

17. Deletion Verification Data

When you initiate an account deletion request, the Platform processes the following data specifically in connection with the deletion flow:

• Your registered email address — to deliver the deletion verification Magic Link.
• A one-time deletion verification token — generated, sent, and invalidated upon click or after 6 hours.
• A deletion event log entry — recording the deletion request initiation timestamp, verification completion timestamp, and authentication method. No IP or device data is recorded.
• Your Captain and Guild leadership status — checked against active tournaments and Guilds to enforce pre-deletion transfer requirements.
• Your pending financial transaction status — checked to ensure no unresolved disbursements or payments exist before deletion proceeds.

18. Data Fate After Deletion — Full Table

Account deletion does not result in complete erasure of all associated data. The following table details the exact treatment of every data category upon account deletion, consistent with the Corpse Terms & Conditions, Section 22:

Note: Under the Digital Personal Data Protection Act, 2023, you have the right to request erasure of your personal data. Where retention is required by law or for platform integrity, the Company will retain specific data and communicate the precise legal basis upon written request to legal@corpsearena.com.

19. Financial Data at Deletion

The following financial data rules apply at the time of and following account deletion:

• All unused Corpse Credits are permanently forfeited with no refund. This is not personal data but is noted here for completeness.
• Active subscription plans are cancelled immediately. No pro-rata refund is issued.
• Entry fees paid for upcoming tournaments are permanently forfeited.
• Prize money pending disbursement to a KYC-verified bank account will be processed to the registered bank account within 7 working days, provided bank details are valid.
• If pending prize money cannot be disbursed due to invalid bank details, it is permanently forfeited after 30 calendar days from the deletion date.

20. Location Data Purge

Latitude and longitude location data is the only category of registration data subject to a defined post-deletion purge timeline. It will be permanently deleted from all Corpse servers within 30 calendar days of your account deletion being processed.

All other location data (state and pincode) is retained as part of anonymised match and ELO records for platform integrity purposes.

Note: If you wish to request earlier deletion of your lat/long data, contact legal@corpsearena.com with the subject line 'Location Data Deletion Request'. We will process the request and confirm deletion within 30 days.

PART VII — MINOR USERS — REGISTRATION PRIVACY

21. Classification at Sign-Up

Users below 18 years of age ("Minor Users") are identified at sign-up based solely on the date of birth submitted in the registration form.

• If your submitted date of birth indicates you are under 18, your account is automatically classified as a Minor User account at the moment of creation.
• Minor User access restrictions are applied immediately — you cannot act as a Captain, make financial transactions, or complete KYC verification.
• If a false date of birth is submitted to evade Minor User restrictions and this is subsequently identified, the account will be suspended pending review.

22. Data Minimisation for Minors

For users classified as Minor Users at sign-up, the following data minimisation standards apply:

• No financial information of any kind is collected at sign-up or at any subsequent stage. Bank account details, UPI IDs, and payment card data are never collected from Minor Users.
• Minor Users cannot complete KYC verification. Accordingly, their registration data is never shared with Razorpay or any payment gateway.
• Minor Users' registration data is not used for advertising profiling, behavioural targeting, or any commercial data processing beyond what is strictly necessary for basic Platform access.
• Minor Users may only participate in tournaments via squad invite from a KYC-verified Captain — they cannot independently register for any paid tournament.

23. DPDP Act Parental Consent Framework

The Digital Personal Data Protection Act, 2023 requires verifiable parental or guardian consent before processing personal data of a child (under 18 years). Our current approach:

• We rely on the date of birth self-declared at registration to identify Minor Users.
• For Minor Users, data processing at sign-up is restricted to what is strictly necessary for basic Platform access.
• We will implement verifiable parental consent mechanisms as and when directed by the Data Protection Board of India under Rules made pursuant to the DPDP Act, 2023.

Important: If you are a parent or guardian and believe your child has registered on the Platform without your consent, contact us immediately at legal@corpsearena.com. We will review and, where appropriate, delete the account promptly.

PART VIII — YOUR RIGHTS

24. Rights Under the DPDP Act 2023

As a Data Principal under the Digital Personal Data Protection Act, 2023, you have the following rights specifically in relation to your account creation and deletion data:

25. How to Exercise Your Rights

To exercise any of the rights in Section 24, submit a written request to our Grievance Officer:

PART IX — UPDATES & CONTACT

26. Changes to This Policy

We reserve the right to update this Privacy Policy at any time. When material changes are made:

• Registered Users will be notified via email and in-app notification at least 7 days before the change takes effect.
• The 'Last Updated' date on this Policy will be revised to reflect the update date.
• The updated Policy will be accessible within the Platform.

Your continued use of the Platform after the effective date of any change constitutes your acceptance of the revised Policy. If you do not agree with any change, you must delete your account before the change takes effect.

27. Grievance Officer & Contact

For any queries, concerns, or formal grievances related to this Policy or the processing of your registration and deletion data, contact:

This Account Creation & Deletion Privacy Policy was last updated in April 2026 and is effective from May 1, 2026.

Version 1.0 | Final | Corpse — [CORPSE ESPORTS PRIVATE LIMITED]

Confidential & Proprietary. All rights reserved.