Spin Rummy Privacy Policy & Data Protection Framework

1. Institutional Preamble: The Spin Rummy Privacy Policy

Welcome to Spin Rummy, accessible via our flagship website spinrummy.club and our official mobile application client (the “Platform”). The Platform is owned, engineered, and operated by Spin Rummy Interactive Labs Ltd. (hereinafter referred to as the “Company”, “Data Fiduciary”, “we”, “us”, or “our”), a premier gaming technology corporation duly registered under the Ministry of Corporate Affairs (MCA), Government of India (Corporate profile: About Us).

The Company operates in full compliance with Indian skill-gaming jurisprudence as established by the Supreme Court of India in State of AP v. K. Satyanarayana (1968) (detailed under Legality & Fair Play). This Spin Rummy Privacy Policy delineates the protocols, methodologies, and technical safeguards through which we collect, receive, store, process, transmit, decrypt, and manage your personal data and Sensitive Personal Data or Information (SPDI) when you create an account, verify your identity, deposit wallet funds, participate in 13-card cash tables, or execute withdrawals governed by our Terms & Conditions.

2. Definitions & Interpretative Framework

For the purposes of this Privacy Policy, capitalized terms shall carry the definitions ascribed under the DPDP Act 2023 and the IT Rules:

• “Data Principal” (“User”, “Player”, “You”): Any natural person who registers an account, browses our website, downloads our APK, or engages in real-money or practice card games on Spin Rummy.
• “Personal Data”: Any data about an individual who is identifiable by or in relation to such data.
• “Sensitive Personal Data or Information (SPDI)”: Specific categories of sensitive personal data including bank account numbers, IFSC codes, UPI Virtual Payment Addresses (VPAs), biometric or identity verification tokens, and confidential authentication credentials.
• “Processing”: In relation to personal data, a wholly or partly automated operation or set of operations performed on digital personal data, including collection, recording, organization, structuring, storage, retrieval, use, disclosure, dissemination, or erasure.
• “Consent Manager”: A person registered with the Data Protection Board of India who serves as a single point of contact to enable a Data Principal to give, manage, review, and withdraw consent.

3. Comprehensive Categories of Information We Collect

To provide a high-velocity, mathematically fair, and zero-bot gaming ecosystem, Spin Rummy collects only such digital data as is strictly necessary (Principle of Data Minimization):

3.1. Directly Provided Registration & Profile Data

• Mobile Number & OTP Credentials: Your primary Indian 10-digit mobile number, verified via programmatic cryptographic One-Time Password (OTP) validation.
• Player Persona & Custom Avatars: Screen username, display badge, and optional avatar selection chosen by you during onboarding.
• Communications & Support Inquiries: Direct messages, ticketing history, voice logs, and attachments submitted to our 24/7 VIP Support Desk.

3.2. Sensitive Personal Data (SPDI) for Financial & KYC Settlement

• Statutory Tax Identifiers (PAN Card): Permanent Account Number (PAN) details collected strictly to comply with Section 194BA of the Indian Income Tax Act regarding Tax Deducted at Source (TDS) on net winnings, as detailed in our Refund & Withdrawal Policy.
• Proof of Identity & Age (Aadhaar / Passport / Voter ID): Government-issued identity documents utilized via masked, offline verification or UIDAI-approved digital KYC aggregators to guarantee player age (strictly 18+) and residential qualification.
• Banking & UPI Settlement Coordinates: Beneficiary bank account holder name, IFSC code, and validated UPI Virtual Payment Address (Google Pay, PhonePe, Paytm, BHIM) utilized exclusively for executing automated 60-second cashouts. We never store raw credit card numbers, debit card magnetic stripe data, or payment gateway CVVs.

3.3. Technical, Hardware & Network Telemetry

• Hardware Device Fingerprint: Programmatic hardware UUID, device manufacturer, model identifier, operating system version (e.g., Android API level), and screen resolution.
• Network & Connection Parameters: Internet Protocol (IP) address, mobile network operator (carrier), network type (4G/5G/Wi-Fi), and latency telemetry to our Mumbai AWS edge clusters.
• Application Integrity & Anti-Tamper Telemetry: Binary checksum hashes, root detection telemetry, emulator detection flags, and memory-hooking monitor logs deployed strictly to combat unauthorized client modifications and artificial botting.

3.4. Geolocation Verification Telemetry

• IP-Based & Coordinate Geofencing: Coarse IP geolocation and device GPS coordinate vectors captured exclusively at the moment of joining real-money cash tables to verify that the player is not physically located within restricted states where real-money skill gaming is legally barred (Assam, Odisha, Telangana, Andhra Pradesh, Nagaland, and Sikkim) per our Legality Guidelines.

3.5. Cardroom Gameplay & Behavioral Telemetry

• Table Interaction Logs: Microsecond timestamps of card draws, discards, declaration shows, meld arrangements, and folding actions.
• Anti-Collusion Behavioral Matrix: Table pairing frequency, betting patterns, and seat distribution history processed by algorithmic surveillance models to detect illegal chip dumping or coordinated team-play, ensuring complete alignment with our Responsible Gaming Safeguards.

4. Lawful Purpose & Basis for Data Processing Under DPDP Act 2023

Under the provisions of Sections 4 and 6 of the DPDP Act 2023, the Company processes your digital personal data exclusively on the basis of informed, explicit, and unconditional consent, and for legitimate purposes recognized by law:

• Game Provisioning & Table Matching: Provisioning authentic 13-card Indian Rummy tables (Points, Pool 101/201, and Deals), executing certified cryptographic RNG shuffling, and administering tournament leaderboards.
• Automated Instant Liquidity: Validating account ownership and routing wallet payout instructions through automated NPCI IMPS / UPI switches to execute cashouts in under 60 seconds as guaranteed under our Refund & Withdrawal Policy.
• Compliance with Indian Tax Laws: Computing net winnings and remitting 30% statutory TDS to the Central Board of Direct Taxes (CBDT) under Section 194BA, alongside generating quarterly Form 16A TDS certificates for players.
• Platform Integrity & Zero-Bot Enforcement: Real-time behavioral surveillance to isolate emulators, automated scripting engines, multi-accounting on identical IP ranges, and syndicates.
• Responsible Gaming Protections: Monitoring player session durations and deposit velocities to enforce configurable daily deposit ceilings and voluntary cooling-off periods per our Responsible Gaming Program.

5. Cookies, Local Storage & Analytical Identifiers

When you browse spinrummy.club, we utilize lightweight, privacy-preserving tracking technologies:

• Strictly Necessary Cookies: Cryptographic session tokens required to authenticate user sessions, maintain state across pages, and prevent Cross-Site Request Forgery (CSRF).
• Security & Anti-Fraud Tokens: Local storage flags deployed to identify unique browser hardware profiles and block malicious automated scrapers.
• Performance & Telemetry Cookies: Aggregate, anonymized Core Web Vitals telemetry utilized to monitor page load velocities, edge caching performance, and responsive UI rendering.

You may disable non-essential cookies via your web browser preferences; however, disabling authentication tokens may prevent seamless access to portal features.

6. Financial Transaction Security & Tokenization Standards

As guaranteed under our financial security protocols, all fiscal operations adhere strictly to guidelines issued by the Reserve Bank of India (RBI) and the National Payments Corporation of India (NPCI):

• PCI-DSS Level 1 Encrypted Gateways: Inbound deposits are processed exclusively through licensed, RBI-regulated payment aggregators (Razorpay, Cashfree, PayU). Payment card data is processed using mandatory card-on-file tokenization; the Company never receives or stores your complete 16-digit card number or CVV.
• Direct NPCI IMPS & UPI Switches: Outbound cash withdrawals are disbursed directly via bank-grade API integrations into your validated UPI handle or IMPS bank account with zero intermediate escrow delays.
• Segregated Escrow Accounts: As outlined in About Us, all player balances are maintained in dedicated trust accounts separate from corporate operational funds, protecting your capital at all times.

7. Absolute Prohibition on Sale of Personal Data

8. Authorized Disclosures & Third-Party Service Providers

We share personal data strictly on a need-to-know basis with verified third-party entities who are bound by stringent contractual data protection agreements:

• Telecommunication SMS Gateways: Programmatic telecom aggregators (e.g., ValueFirst, Gupshup) for delivering transactional OTP codes and withdrawal status notifications.
• KYC Verification Partners: Government-authorized verification partners for automated algorithmic validation of PAN and Aadhaar identity tokens.
• Statutory & Regulatory Authorities: Competent Indian law enforcement agencies, courts of law, or tax authorities upon receipt of a lawful, verified judicial order under Section 91 of the Code of Criminal Procedure (CrPC) or applicable statutory mandates.

9. Technical Security, Cryptography & Cloud Infrastructure

The Company maintains state-of-the-art technological security standards conforming to ISO/IEC 27001 (Information Security Management) and SOC 2 Type II specifications:

• End-to-End TLS 1.3 Transport Encryption: All data transmitted between your device and our servers is secured using 256-bit asymmetric TLS 1.3 encryption.
• AES-256 At-Rest Cryptography: All database records containing personal identifiers, KYC images, and banking details are encrypted on disk utilizing military-grade Advanced Encryption Standard (AES) with 256-bit keys.
• Sovereign Cloud Hosting: All production databases, application servers, and cryptographic RNG clusters are hosted within ISO 27001-certified Amazon Web Services (AWS) data centers located physically within the territory of India (Mumbai Region, ap-south-1).
• Periodic Penetration Testing (VAPT): Independent CERT-In empaneled security auditing firms conduct bi-annual Vulnerability Assessment and Penetration Testing (VAPT) across our web and mobile infrastructure.

10. Data Retention & Erasure Protocols

We retain your personal data only for as long as your account remains active or as is strictly necessary to fulfill the operational purposes described herein. Upon receipt of a verified account closure request:

• Gameplay & Session Telemetry: Anonymized or securely purged within 90 days of account termination.
• Financial & KYC Records (Statutory Archival): Under Section 12 of the Prevention of Money Laundering Act (PMLA), 2002, and Section 194BA of the Income Tax Act, 1961, all financial transaction ledgers, TDS remittance histories, and associated KYC verification proofs are mandatorily archived for a statutory period of seven (7) years, after which they are permanently shredded through automated cryptographic deletion routines.

11. Player Rights Under The Spin Rummy Privacy Policy & DPDP Act 2023

As a Data Principal under Section 12 of the DPDP Act 2023, you are endowed with comprehensive statutory rights which you may exercise at any time without penalty:

• Right to Access Information (Section 11): You possess the right to obtain a summary of your personal data processed by us, the identities of all data processors with whom such data has been shared, and any other relevant operational details.
• Right to Correction & Erasure (Section 12): You may inspect, rectify inaccurate personal records, update obsolete contact information, or request the complete deletion of non-statutory data from our systems.
• Right to Grievance Redressal (Section 13): You possess an unfettered right to lodge a formal complaint regarding data handling with our designated Grievance Officer, and if unsatisfied, escalate the dispute to the Data Protection Board of India.
• Right to Nominate (Section 14): You have the legal right to nominate any individual who, in the event of your death or permanent incapacity, shall exercise your rights as a Data Principal.
• Right to Withdraw Consent: You may withdraw your consent for future data processing at any time by contacting our compliance desk. Please note that withdrawing consent for essential data (e.g., mobile OTP or KYC) will necessitate the closure of your real-money wallet.

12. Absolute Protection of Minors (Strict 18+ Prohibition)

13. Statutory Grievance Redressal Mechanism & Officer Details

In strict compliance with Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and Section 13 of the Digital Personal Data Protection Act, 2023, the Company has designated a full-time, senior Grievance Redressal Officer:

14. Governing Law & Dispute Resolution

This policy, and any disputes, controversies, or claims arising out of or in connection with the processing of your personal data, shall be governed by, construed, and enforced exclusively in accordance with the laws of the Republic of India. Subject to the dispute redressal provisions outlined in our Terms & Conditions, the competent civil courts situated in Mumbai, Maharashtra, India shall possess sole and exclusive jurisdiction over all legal proceedings.

15. Amendments to This Spin Rummy Privacy Policy

The Company reserves the right to amend, update, or modify this Privacy Policy periodically to reflect technological advancements, evolving jurisprudence, or statutory modifications under the DPDP Act. Whenever material amendments occur, we will post an updated revision notice across the Platform and update the “Effective Date” at the top of this document. Continued engagement with our cardroom following published revisions constitutes your deemed acknowledgment and acceptance of the revised terms.