Privacy Policy

CORPSE

The Operating System for Esports

Corpse Privacy Policy

Version 2.0 — Complete Platform Coverage

Account • KYC • Arena • Guild • Payments • ELO • Organiser • Analytics • Consent

Binding on: All Users | All Organisers | All Data Subjects | All Platform Interactions

This Corpse Privacy Policy v2.0 is the single, definitive, and complete document governing how [CORPSE ESPORTS PRIVATE LIMITED] collects, uses, stores, shares, and protects personal data across the entire Corpse platform — for all users, all organisers, and all data subjects.

PART XXI Grievance Officer & Contact

70. Grievance Officer Details

71. How to File a Privacy Complaint

PART I — INTRODUCTION & LEGAL FRAMEWORK

1. Who We Are & What This Policy Covers

[CORPSE ESPORTS PRIVATE LIMITED] ("Company", "we", "us", "our") operates the Corpse platform — a competitive esports infrastructure platform available as a mobile application on iOS and Android ("Platform"). This Corpse Privacy Policy ("Policy") is the single, definitive, and complete document governing how the Company collects, uses, stores, shares, and protects personal data across every feature, function, and interaction on the Platform — for all users and all organisers.

This Policy covers data processing across every aspect of the Platform including:

• Account creation, authentication, and session management.
• Player profile — username, avatar, in-game ID, ELO, and Ecosystem Pipeline tier.
• KYC verification and financial identity for players and organisers.
• Arena participation — registration, match play, result submission, and disputes.
• ELO Engine and Ecosystem Pipeline tier progression.
• Guild creation, membership, roles, and unit tiers.
• Organiser account data, performance metrics, reliability scoring, and dashboard usage.
• Financial transactions — entry fees, prize disbursements, organiser settlements, and TDS compliance.
• Notifications — in-app, email, SMS, and WhatsApp communications.
• Platform analytics — Firebase, Sentry error monitoring, and business intelligence.
• Account deletion and post-deletion data handling.
• App Store and Play Store data — outside the Company's direct control.

2. Who This Policy Applies To

This Policy applies to every individual who interacts with the Platform in any capacity:

• Guest Users — individuals who access the Platform without creating an account.
• Registered Users — individuals who create and maintain an account on the Platform.
• Minor Users — Registered Users below the age of 18 years.
• KYC-Verified Users — Registered Users who have completed KYC verification.
• Captains — Registered Users who lead squads and conduct financial transactions.
• Organisers — Registered Users or entities who create and manage arenas on the Platform.
• Guild Members — Registered Users who are members of guilds on the Platform.

3. Legal Basis for Processing Personal Data

The Company processes personal data on the following legal bases under the Digital Personal Data Protection Act, 2023:

4. Governing Legislation

PART II — DATA COLLECTED — ACCOUNT CREATION & AUTHENTICATION

5. Guest User Data

When a user accesses the Platform as a Guest User without creating an account, the following data is collected automatically:

Note: Guest User data is not linked to any individual identity. No name, email, phone number, or government identity document is collected from Guest Users.

6. Registration Data

7. Authentication Method Data

8. Auto-Generated Data at Sign-Up

• Unique user ID (UUID) — a system-generated identifier used internally to reference the user's account.
• Account status flag — active, suspended, or banned.
• ELO starting score — assigned at account creation as the baseline competitive rating.
• Ecosystem Pipeline starting tier — assigned at account creation as the entry-level competitive tier.
• Account creation timestamp — the exact date and time the account was created.

9. Session & Device Data

10. Phone Number Collection

A phone number is not a mandatory field at account registration on the Platform. Phone numbers are collected only in the following specific circumstances:

• SMS notifications — if a user opts into SMS notifications, their phone number is collected at the time of opt-in. This is entirely optional.
• WhatsApp notifications — if a user opts into WhatsApp communications, their WhatsApp-linked phone number is collected at the time of opt-in. This is entirely optional and requires explicit consent.
• Aadhaar OTP verification during KYC — the phone number linked to the user's Aadhaar account is used by UIDAI's systems to deliver the OTP. The Aadhaar-linked phone number itself is not stored by the Company — only the OTP verification result is recorded.

Phone numbers collected for SMS or WhatsApp notifications are used exclusively for delivering those communications and are not shared with any third party beyond the communication service provider. Users can remove their phone number at any time by disabling SMS or WhatsApp notifications in settings.

11. Cross-Device Data Linkage

The Platform allows users to be simultaneously logged in on multiple devices. The following explains how data from multiple devices is linked to a single user account:

• All devices that a user authenticates on are linked to the same user account via the unique user ID (UUID) assigned at registration.
• Session tokens are device-specific — each device carries its own JWT session token. However, all session tokens reference the same underlying user account.
• Actions taken on one device (e.g., joining an arena, updating a profile) are reflected immediately across all active sessions on other devices — as they are stored at the account level, not the device level.
• The Platform maintains a session log per device — showing the device type, login timestamp, and last active timestamp for each active session. This data is accessible to the Platform's security team for anomaly detection.
• Signing out of one device terminates only that device's session token. Other device sessions remain active.
• A user's complete activity history — match records, ELO progression, guild membership — is account-level data and is accessible from any authenticated device.

Note: The Platform does not currently provide users with a self-service view of all active sessions across their devices. If you believe your account has been accessed on an unrecognised device, contact support@corpsearena.com immediately for a security review.

PART III — DATA COLLECTED — PLAYER PROFILE

12. Profile Fields

13. In-Game ID Data

• One in-game ID per game title — a player cannot register multiple in-game IDs for the same game.
• The in-game ID is used to verify player identity before Arena matches and to link match performance data to the correct player profile.
• The in-game ID can be updated via profile settings — subject to verification that the new ID belongs to the same player.
• The in-game ID is private — not displayed on the player's public profile and not visible to other Platform users.
• Retained for the duration of the account and deleted upon account deletion.

14. Public vs Private Profile Data

PART IV — DATA COLLECTED — KYC VERIFICATION

15. What KYC Data Is Collected

16. What Corpse Stores vs eKYC Provider

Important: The Company does not store your full Aadhaar number. Only the last 4 digits are retained on Corpse servers. Your full Aadhaar data is held exclusively by the authorised eKYC service provider in compliance with UIDAI regulations.

17. KYC Data Sharing — Razorpay

The following KYC-verified data is shared with Razorpay India Private Limited, our payment gateway partner, strictly for processing financial transactions:

• Verified bank account details — account number, IFSC code, account holder name — for prize disbursement and organiser settlement transfers.
• PAN number — for TDS deduction and reporting to the Income Tax Department.
• Name as per KYC — for payment beneficiary identification.

This data sharing is mandatory for regulatory compliance and cannot be opted out of. By completing KYC on the Platform, you consent to this data being shared with Razorpay for the stated purposes.

18. KYC Data Retention

• Financial transaction records including KYC data are retained for a minimum of 5 years from the date of the last transaction — as mandated by PMLA 2002.
• The eKYC provider retains KYC data per their own regulatory obligations — the Company does not control the eKYC provider's retention schedule.
• Razorpay retains KYC-related payment data per their own privacy policy and RBI requirements.

PART V — DATA COLLECTED — ARENA & MATCH PARTICIPATION

19. Arena Registration Data

• Arena ID — the unique identifier of the Arena registered for.
• Squad ID — the unique identifier of the squad registered with.
• Player role in squad — Captain or Member.
• Registration timestamp — the exact date and time of registration.
• Payment record (paid arenas only) — Razorpay order reference, payment status, amount paid, timestamp.
• KYC verification status at time of registration — confirming Captain's KYC was valid at registration.

20. Match Result & Screenshot Data

• Match result screenshot — captured via the auto-capture system — stored for result verification.
• Verified match result — officially verified result including squad rankings, kill counts, and game-mode statistics.
• Result submission timestamp — date and time of submission.
• Organiser result submission — organiser's screenshot and submission timestamp.
• Dispute record (if any) — dispute raised, evidence submitted, and Platform determination.

Match result data and screenshots are retained for the duration of the account and for 2 years after account deletion to maintain the integrity of historical competitive records.

21. Squad & Room Card Data

• Squad composition record — the list of players (user IDs) in a squad for each Arena.
• Squad invite token log — records of invite tokens generated, used, and expired.
• Room card data — the custom room ID and password. Deleted from active records after the Arena concludes.

22. Dispute & Support Data

• Support ticket content — the player's description of the issue.
• Evidence submitted — screenshots or files attached to the dispute.
• Support agent interaction log — communications between the player and the support team.
• Resolution record — the outcome of the dispute or support interaction.

Support and dispute data is retained for 2 years from the date of resolution.

PART VI — DATA COLLECTED — ELO & ECOSYSTEM PIPELINE

23. ELO Score Data

• Player ELO score — individual competitive rating, updated in real time after every Arena. ELO can increase or decrease.
• Squad ELO — collective ELO of a squad for a specific Arena.
• Guild ELO — collective ELO of the guild, calculated from guild squad performance.
• ELO history log — record of ELO changes after each Arena including Arena ID, result, change amount, and new total.

ELO data is publicly visible on the player's profile and Platform leaderboard. ELO history is retained for the duration of the account and anonymised after deletion.

24. Ecosystem Tier Data

• Current tier — the player's current tier in the Ecosystem Pipeline (tier names to be confirmed before launch).
• Tier history — a log of tier changes including the date and trigger.
• Seasonal reset record — at each seasonal reset, 60% of the player's ELO is carried forward. Pre-reset and post-reset ELO are both recorded.

25. Match Performance Analytics

• Total arenas participated in — both free and paid.
• Total wins, losses, and placement records.
• Game-mode specific statistics — kill counts, survival times, and statistics derived from verified match results.
• Win/loss ratio and performance trends over time.

PART VII — DATA COLLECTED — GUILD SYSTEM

26. Guild Membership Data

• Guild ID — the unique identifier of the guild the player is a member of.
• Guild membership timestamp — the date and time the player joined the guild.
• Guild join history — all guilds the player has been a member of, with join and departure dates.
• Guild membership status — active member, departed, or removed.

27. Guild Role & Unit Tier Data

• Guild role — Captain, Vice Captain, Manager, or Member — displayed on the guild profile.
• Unit tier — Apex, Specialized, Core, or Rising — displayed on the member's profile within the guild context.
• Role change history — a log of role changes within the guild.
• Unit tier assignment history — a log of unit tier assignments and changes.

28. Guild ELO & Leaderboard Data

• Guild ELO score — the guild's collective competitive rating, updated after each qualifying Arena.
• Guild leaderboard ranking — the guild's current rank on the Platform's public guild leaderboard.
• Guild ELO history — a log of ELO changes after each qualifying Arena.

Guild ELO and leaderboard data are publicly visible. Upon guild dissolution, data is removed from public display but retained in internal records for 2 years.

PART VIII — DATA COLLECTED — ORGANISER DATA

29. Organiser Account & Identity Data

When a user creates an Organiser account or acts in an organiser capacity on the Platform, the following data is collected in addition to their standard Registered User data:

• Organiser role flag — a system designation indicating the user holds Organiser privileges on the Platform.
• KYC verification status — organisers must complete KYC before depositing security pools or receiving settlements. KYC data collection follows the same framework described in Part IV.
• Organiser account creation timestamp — the date and time the user first created an arena as an organiser.
• Organiser subscription tier — the organiser's current subscription tier (Starter, Pro, or Elite), if applicable.

30. Organiser Performance & Reliability Data

The Platform collects and maintains the following organiser performance data to operate its reliability scoring and trust index systems. This data is used to ensure the quality and integrity of arenas hosted on the Platform:

• Arenas created — a complete record of all arenas the organiser has created on the Platform, including arena ID, creation date, format, and status.
• Arenas completed — a record of arenas successfully run to completion.
• Arenas cancelled — a record of arenas cancelled by the organiser, including the stage at which the cancellation occurred and any refund actions triggered.
• Cancellation rate — the percentage of arenas cancelled relative to arenas created, calculated by the Platform's analytics system.
• Reliability score — a composite score calculated by the Platform based on the organiser's completion rate, cancellation history, participant feedback, and payment consistency. This score is used internally for trust assessment and may be displayed on the organiser's public profile.
• Trust index — a broader metric incorporating the reliability score, account age, KYC status, and dispute history.
• Streak performance — consecutive arena completion records used to reward high-performing organisers.
• Dispute records — any disputes raised by participants against arenas organised by the organiser, including the nature of the dispute and the Platform's determination.

Organiser performance data is used to:

• Display reliability and trust information on the organiser's public profile — enabling players to make informed decisions about which arenas to join.
• Determine the organiser's eligibility for advanced Platform features and subscription benefits.
• Identify and investigate organisers with patterns of conduct that may indicate bad-faith operation.

Important: Organiser performance data — including cancellation rate, reliability score, and dispute history — may be visible to Platform users on the organiser's public profile. Organisers should be aware that their operational track record is a public-facing metric on the Platform.

31. Organiser Dashboard Usage Data

When an organiser uses the Platform's organiser dashboard tools, the following usage data is collected:

• Arena creation and configuration actions — the parameters set when creating an arena, including preset selection, entry fee configuration, prize structure, and scheduling.
• Participant management actions — slot fill status monitoring, squad list reviews, and payment status checks.
• Result submission actions — the organiser's result screenshot submissions, submission timestamps, and the 60-second upload window interactions.
• Dashboard access logs — timestamps of organiser dashboard sessions for audit purposes.

Dashboard usage data is used to improve the organiser tools, diagnose technical issues, and maintain audit trails for dispute resolution. It is not shared publicly.

32. Organiser Financial Data

All financial data related to organiser transactions is governed by Part IX of this Policy. For organisers specifically, the following additional financial data is collected:

• Security deposit records — the amount deposited, deposit timestamp, Razorpay reference, and escrow allocation for each arena.
• Organiser settlement records — the final settlement amount, deductions applied (platform commission, GST, bank payout fee), and transfer reference for each completed arena.
• GST invoice records — copies of all GST invoices issued to the organiser for platform commission charged, retained for 7 years per Income Tax Act requirements.
• Refund records — any security deposit refunds issued to the organiser, including partial refunds triggered by cancellation.

33. Organiser Public Profile Data

The following organiser data is publicly visible on the organiser's Platform profile:

PART IX — DATA COLLECTED — FINANCIAL TRANSACTIONS

34. Entry Fee & Payment Transaction Data

• Razorpay order reference — the unique transaction identifier generated by Razorpay.
• Payment amount — the entry fee amount paid.
• Payment method — UPI, net banking, debit card, credit card, or mobile wallet.
• Payment status — initiated, pending, verified, failed, or refunded.
• Payment timestamp — the date and time of the transaction.
• Razorpay webhook log — the server-side confirmation record of payment verification.
• PG charge amount — the 2% payment gateway fee paid by the player.

Payment transaction data is retained for a minimum of 5 years from the date of the transaction in compliance with PMLA and RBI requirements.

35. Prize Disbursement Data

• Disbursement amount — gross prize amount and net amount after TDS and bank payout fee deduction.
• TDS amount deducted — the 30% TDS deducted before disbursement.
• Bank payout fee — the Rs 5.90 bank transfer fee deducted.
• Recipient bank account details — masked account number and IFSC code.
• Disbursement timestamp — the date and time the transfer was initiated.
• Bank transfer reference — the NEFT/IMPS reference number.
• Disbursement status — initiated, credited, or failed.

36. TDS & Tax Compliance Data

• TDS amount deducted per disbursement.
• Recipient PAN number — used for TDS reporting to the Income Tax Department.
• TDS challan reference — the government reference number for TDS deposited.
• Form 26AS filing record — confirmation that TDS deducted has been reported and will appear in the recipient's Form 26AS.

TDS and tax compliance data is retained for a minimum of 7 years in compliance with Income Tax Act record-keeping requirements.

37. Escrow & Financial Record Retention

All financial transaction records — including entry fees, organiser deposits, prize disbursements, platform commissions, TDS deductions, and refunds — are retained for a minimum of 5 years from the date of the transaction as required by PMLA 2002 and RBI guidelines. These records are not deleted upon account deletion.

PART X — DATA COLLECTED — NOTIFICATIONS & COMMUNICATIONS

38. Notification Channels & Data

39. Communication Logs

The Platform maintains logs of all communications sent to users for audit and compliance — confirming required communications were sent, supporting dispute resolution, and troubleshooting delivery failures. Communication logs are retained for 2 years from the date of the communication.

PART XI — DATA COLLECTED — PLATFORM ANALYTICS

40. Firebase Analytics & App Usage Data

The Platform uses Firebase Analytics (provided by Google LLC) to collect aggregated, anonymised data about how users interact with the Platform. This data is used to improve platform features and optimise user experience. Data collected includes:

• Screen views and navigation flow — which screens users visit and in what order.
• Session duration — how long users spend on the Platform per session.
• Feature usage rates — which features are used most and least frequently.
• Crash and error reports — technical errors experienced by users.
• Device and OS distribution — the range of devices on which the Platform is used.
• Geographic distribution — which regions have the highest Platform usage.

Firebase Analytics data is processed by Google LLC on the Company's behalf under a data processing agreement. For information about how Google processes analytics data, refer to the Google Privacy Policy at policies.google.com.

41. Performance & Error Monitoring — Sentry

The Platform uses Sentry (provided by Functional Software Inc.) for application error tracking and performance monitoring. Sentry captures unhandled exceptions and performance metrics to enable the engineering team to identify and resolve technical issues.

The following data may be captured by Sentry in connection with error events:

• Error stack traces — technical descriptions of application errors. These do not contain personal data in standard operation.
• Device type and OS version — to help diagnose device-specific issues.
• App version — to identify which version of the application experienced the error.
• Anonymised user ID — a hashed, non-reversible identifier used to determine how many unique users experienced a given error. The full user ID or any personally identifying information is never sent to Sentry.
• Breadcrumb events — a log of recent user actions immediately before an error occurred — used to reproduce the error. These are limited to technical events (screen navigation, API calls) and do not include personal data.

Sentry data is used exclusively for debugging and improving application stability. It is not used for marketing or user profiling. Sentry retains error data per their own data retention settings.

Sentry is a third-party service provided by Functional Software Inc. For information about how Sentry processes data, refer to sentry.io/privacy.

42. Business Analytics

The Company uses aggregated and anonymised Platform data for internal business intelligence including tournament metrics, engagement metrics, and financial reporting. Business analytics data does not identify individual users and is retained for the duration of the Company's operations.

43. App Store & Play Store Analytics

When users download, install, or use the Corpse app through the Apple App Store or Google Play Store, Apple Inc. and Google LLC respectively collect their own analytics data about app downloads, installation rates, and usage patterns. This data is collected directly by Apple and Google and is subject to their own privacy policies.

• The Company receives aggregated, anonymised analytics reports from Apple App Store Connect and Google Play Console — such as total download counts and crash reports. These reports do not contain individual user data.
• The Company does not control what data Apple or Google collect from your device in connection with the App Store or Play Store. Please refer to Apple's Privacy Policy at apple.com/privacy and Google's Privacy Policy at policies.google.com for information about their data collection practices.
• The App Store and Play Store analytics are entirely separate from the Platform's own analytics described in Sections 40, 41, and 42.

PART XII — HOW WE USE YOUR DATA — PURPOSE MAPPING

44. Full Purpose Mapping Table

PART XIII — DATA SHARING & THIRD PARTIES

45. Third-Party Service Providers

46. No Sale of Personal Data

The Company does not sell, rent, trade, lease, or otherwise transfer personal data to any third party for commercial, marketing, or advertising purposes. Personal data is shared only with the service providers listed in Section 45 for the specific operational purposes stated, and with government or regulatory authorities where required by law.

Important: If you receive any communication claiming to be from Corpse that asks you to share personal data, payment credentials, OTPs, or account information outside the official Platform — it is fraudulent. Contact support@corpsearena.com immediately.

47. Legal & Regulatory Disclosures

The Company may disclose personal data to government authorities, law enforcement agencies, or regulatory bodies where required by law, court order, or government directive — including under the IT Act 2000, PMLA 2002, Income Tax Act 1961, or any other applicable Indian law. The Company will notify the affected user of any such disclosure to the extent permitted by law.

48. Business Transfers

In the event of a merger, acquisition, restructuring, or asset sale involving the Company, personal data may be transferred to the acquiring or successor entity. Users will be notified at least 30 days before such a transfer takes effect, to the extent permitted by applicable law. The acquiring entity will be required to honour the privacy commitments made in this Policy.

PART XIV — DATA STORAGE & SECURITY

49. Where Data Is Stored

• Backend database — PostgreSQL hosted on Neon's managed cloud database service with automated daily backups and point-in-time recovery.
• Application server — Node.js/Express.js API hosted on Render's managed cloud infrastructure.
• Payment data — processed and stored by Razorpay's PCI-DSS compliant infrastructure.
• KYC data — stored by the authorised eKYC service provider on their regulated infrastructure and by Corpse in encrypted form.
• Analytics data — Firebase Analytics data stored by Google LLC. Sentry error data stored by Functional Software Inc.

All Platform data is stored in India to the extent technically feasible and in compliance with applicable data localisation requirements.

50. Security Measures

• HTTPS — all client-server communication is encrypted over TLS. Plain HTTP is rejected.
• JWT-based authentication — all authenticated API requests carry signed session tokens validated on every request.
• Password-free authentication — the Platform does not store passwords, eliminating password-related data breach risks.
• Encrypted storage — sensitive data including PAN numbers and bank account details are stored in encrypted form.
• Input validation — all API inputs are validated against strict schemas. SQL injection is prevented through Prisma's parameterised query interface.
• Webhook signature verification — all Razorpay payment callbacks are verified using HMAC signature validation before any action is taken.
• Role-based access control — Platform staff access to user data is restricted on a need-to-know basis.
• Secure credential management — all sensitive credentials are stored as environment variables and never committed to source control.
• Session token security — JWT session tokens are stored in iOS Keychain / Android Keystore on device — never in plain local storage.

51. Data Breach Response

In the event of a personal data breach likely to result in a risk to data subjects, the Company will:

• Notify the Data Protection Board of India within 72 hours of becoming aware of the breach, as required under the DPDP Act 2023.
• Notify affected users as soon as reasonably practicable via in-app notification and email, describing the breach, data affected, and steps taken.
• Immediately take all reasonable technical measures to contain the breach.

PART XV — DATA RETENTION PERIODS

52. Retention by Data Category — Full Table

PART XVI — DATA AFTER ACCOUNT DELETION

53. Data Deleted Immediately

• Avatar image.
• Active session tokens — all devices signed out immediately.
• FCM device tokens — push notification delivery disabled.
• In-game ID registration.
• Active squad and guild memberships — removed immediately.
• Active arena registrations — subject to financial consequences per the Money Deposit & Receive Policy.
• Phone number (if provided) — removed from notification systems.

54. Data Retained After Deletion

• Email address — retained for 5 years per PMLA.
• Username — anonymised and retained for competitive record integrity.
• ELO history and match records — anonymised and retained for competitive record integrity.
• Financial transaction records — retained for 5 years per PMLA.
• TDS records — retained for 7 years per Income Tax Act.
• KYC data — retained for 5 years per PMLA.
• Support and dispute records — retained for 2 years.
• Organiser performance records — retained for 2 years post-deletion.

Note: 'Anonymised' means the retained data is stripped of all directly identifying information and linked only to an internal reference ID that cannot be used to identify the individual without additional information held separately.

55. Financial Data Retention Post-Deletion

Account deletion does not affect the Company's legal obligations to retain financial records. All transaction records are retained for the mandatory periods regardless of account deletion status and may be required for regulatory audit, tax compliance, and legal proceedings.

PART XVII — MINOR USERS — SPECIAL PROTECTIONS

56. Classification & Age Verification

The Platform collects date of birth at registration to classify users as Minor Users (below 18 years) or adult users. Minor Users cannot complete KYC verification, cannot engage in any financial transaction, and can only participate in Arenas as squad members invited by a KYC-verified adult Captain.

57. Data Minimisation for Minors

• No financial data is collected from Minor Users.
• No KYC or in-depth personal identification beyond registration data.
• Minor Users are not shown in financial leaderboards or prize-related features.

58. DPDP Act Parental Consent Framework

• At registration, users below 18 are classified as Minor Users.
• The Platform presents the DPDP Act parental consent requirement and requests confirmation that a parent or legal guardian has approved the registration.
• Minor User accounts are not permitted to engage in any activity involving sensitive personal data processing without adult account oversight.
• Parents or guardians may request access to, correction of, or deletion of their child's account data by contacting legal@corpsearena.comwith proof of guardianship.

PART XVIII — YOUR RIGHTS UNDER THE DPDP ACT 2023

59. Right to Access

You have the right to obtain confirmation as to whether your personal data is being processed, and if so, to access a summary of the personal data held about you. Submit a request to legal@corpsearena.com from your registered email address. The Company will respond within 30 days.

60. Right to Correction

You have the right to request correction of inaccurate or incomplete personal data held about you. For editable profile data, corrections can be made directly in settings. For data requiring support assistance, contact support@corpsearena.com.

61. Right to Erasure

You have the right to request erasure of your personal data — subject to the Company's legal retention obligations described in Part XV. Account deletion is the primary mechanism for exercising this right. Data that must be retained for legal compliance cannot be erased before the mandatory retention period expires.

62. Right to Withdraw Consent

Under Section 6 of the DPDP Act 2023, you have the right to withdraw consent for the processing of your personal data at any time for processing activities that are based on consent. The Company has designed its consent withdrawal mechanism to be as simple as the original consent process.

How to Withdraw Consent:

• WhatsApp notifications — disable in Settings > Notifications > WhatsApp. Withdrawal takes effect immediately.
• SMS notifications — disable in Settings > Notifications > SMS. Withdrawal takes effect immediately.
• Marketing email communications — click the unsubscribe link in any marketing email. Withdrawal takes effect within 48 hours.
• Analytics data collection — contact legal@corpsearena.com to opt out of Firebase Analytics data collection. Note that transactional and security-related data processing is based on contractual necessity or legal obligation and cannot be withdrawn.

Consequences of Consent Withdrawal:

• Withdrawing consent for SMS or WhatsApp notifications — you will no longer receive communications through these channels. Transactional notifications will continue via in-app and email.
• Withdrawing consent for marketing communications — you will no longer receive promotional emails but will continue to receive transactional emails required for Platform operation.
• Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
• Withdrawing consent for processing that is necessary for Platform operation (contractual necessity or legal obligation) may result in the Company being unable to provide certain services. In such cases, account deletion may be the appropriate course of action.

Important: Consent withdrawal applies only to processing activities based on consent. Processing based on contractual necessity (operating your account), legal obligation (KYC, TDS), or legitimate interests (security monitoring, ELO calculation) continues regardless of consent withdrawal.

63. Right to Grievance Redressal

You have the right to have any grievance related to the processing of your personal data addressed by the Company's Grievance Officer within 30 days. If unsatisfied with the response, you may escalate your complaint to the Data Protection Board of India once established under the DPDP Act 2023.

64. Right to Nominate

Under the DPDP Act 2023, you have the right to nominate another individual to exercise your data rights on your behalf in the event of your death or incapacity. To register a nominee, contactlegal@corpsearena.com with the nominee's details and your relationship to them.

65. How to Exercise Your Rights

PART XIX — COOKIES & LOCAL STORAGE

66. What We Store Locally

The Corpse mobile app stores the following data locally on the user's device:

• Account identifier (non-sensitive) — enabling the app to pre-populate the login screen on return visits.
• UI preferences — notification settings and display preferences configured by the user.
• App state data — locally cached non-sensitive profile data (username, avatar) for faster app load times.

The Platform does not use browser cookies as it is a native mobile application. Local storage is managed by the app's local data management layer.

67. Session Tokens

Authenticated session tokens (JWTs) are stored in the device's secure storage — iOS Keychain or Android Keystore. These tokens are invalidated and deleted on sign-out, expire automatically after 90 days of inactivity, and cannot be used to access account data without a valid, non-expired token.

PART XX — UPDATES TO THIS POLICY

68. How We Notify You of Changes

When a material change is made to this Policy, the Company will send an in-app notification and email to all Registered Users summarising the key changes. The updated Policy is published within the Platform's settings under Legal > Privacy Policy and the 'Last Updated' date is revised.

69. Continued Use & Mandatory Acceptance

Continued use of the Platform following notification of a Policy update constitutes acceptance of the revised Policy — regardless of whether the user has actively reviewed the updated document. This acceptance is mandatory — the Company does not offer an opt-out from updated Privacy Policy terms without account deletion, as the Policy governs necessary data processing for Platform operation.

For material changes that significantly affect user rights — such as changes to data sharing practices or retention periods — the Company will provide a minimum of 14 days notice before the revised Policy takes effect.

PART XXI — GRIEVANCE OFFICER & CONTACT

70. Grievance Officer Details

In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the Digital Personal Data Protection Act, 2023, the Company has designated a Grievance Officer:

71. How to File a Privacy Complaint

• Step 1 — Email legal@corpsearena.com with subject: PRIVACY COMPLAINT — [Brief Description].
• Step 2 — Include your registered email address, a clear description of the complaint or request, and any supporting evidence.
• Step 3 — The Grievance Officer will acknowledge receipt within 24 hours.
• Step 4 — The Company will investigate and provide a written response within 30 days of acknowledgement.
• Step 5 — If the response does not resolve your complaint satisfactorily, you may escalate to the Data Protection Board of India (once operational under the DPDP Act 2023) or seek other legal remedies available under Indian law.

This Corpse Privacy Policy v2.0 was last updated in April 2026 and is effective from May 1, 2026.

Version 2.0 | Corpse — [CORPSE ESPORTS PRIVATE LIMITED]

This is the single, definitive, and complete privacy policy for the entire Corpse platform.