Privacy Policy

Welcome to SnookBill ("Company," "we," "our," or "us"). We are committed to protecting the privacy and security of your personal information. This Privacy Policy explains what data we collect, how we use it, with whom we share it, and what rights you have over your data when you use the SnookBill platform — a SaaS-based snooker and pool club management system accessible at snookbill.com and its subdomains ("Service" or "Platform").

By registering for or using SnookBill, you acknowledge that you have read, understood, and agree to this Privacy Policy. If you do not agree, please discontinue use of the Service.

1. Who This Policy Applies To

This Privacy Policy applies to:

• Club Owners (Account Holders): Individuals who register and manage a club account on SnookBill.
• Staff Members: Users added by a club owner to operate the platform.
• End Customers (Club Patrons): Individuals whose data (name, contact, billing history) is entered into the platform by a club owner or staff.
• Website Visitors: Any person who visits our marketing website or login page.

2. Data We Collect

2.1 Information You Provide Directly

• Account Registration: Full name, email address, phone number, physical address, and a password (hashed — never stored in plain text).
• Business Information: Club or business name associated with your account.
• Customer Records: Names and mobile numbers of your end customers (club patrons) entered by you or your staff.
• Transaction Data: Game billing records, food & beverage (F&B) order histories, payment records, and outstanding balances.
• Communications: Messages or queries you submit to our support team via email or WhatsApp.

2.2 Information Collected Automatically

• Log Data: IP address, browser type, operating system, pages visited, time and date of visits, and referring URLs.
• Session Data: Authentication tokens used to maintain your login session.
• Device Data: Device type (mobile, tablet, desktop) and screen resolution for optimising the UI.
• Usage Data: Features used, tables created, time on platform — collected in aggregate and anonymised for analytics.

2.3 Cookies and Similar Technologies

We use the following types of cookies:

• Essential Cookies: Required for the platform to function (e.g., session authentication). You cannot opt out of these.
• Analytics Cookies: Used to understand how users interact with the platform. These are anonymised and aggregated.

You may disable non-essential cookies through your browser settings, but this may affect platform functionality.

3. Legal Basis for Processing

We process your personal data under the following legal bases:

• Contractual Necessity: To deliver the Service you have signed up for and to fulfil our obligations under our Terms of Service.
• Legitimate Interests: To improve our platform, prevent fraud and abuse, and ensure platform security.
• Consent: Where you have expressly provided consent, such as receiving marketing communications.
• Legal Obligation: Where we are required to process data to comply with applicable laws of Nepal.

4. How We Use Your Information

• To create and maintain your account and authenticate your access.
• To operate, deliver, and improve the core features of SnookBill (billing, ledger, F&B, analytics).
• To process subscription payments and manage your billing cycle.
• To communicate with you about account activity, security alerts, and important platform updates.
• To provide customer support in response to your inquiries.
• To detect and prevent fraudulent activity, misuse, and security threats.
• To comply with our legal obligations under the laws of Nepal.
• To generate aggregated, anonymised analytics to understand platform performance.

We do not use your data or your customers' data for advertising or marketing to third parties.

5. How We Share Your Information

We do not sell, rent, or trade your personal data. We may share your data only in the following limited circumstances:

5.1 Service Providers

We engage trusted third-party service providers who help us operate the platform, including:

• Database & Hosting: Supabase (PostgreSQL) and Vercel for cloud infrastructure and storage.
• Authentication: NextAuth.js for session management.

These providers are contractually bound to handle your data securely and only for the purposes of providing services to SnookBill.

5.2 Legal Requirements

We may disclose your data if required by law, court order, or governmental authority under applicable Nepali law, or to protect the rights, property, or safety of SnookBill, its users, or the public.

5.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity. We will notify you via email or a prominent notice on the platform before such a transfer occurs, and you will retain the right to request deletion of your data.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you with the Service. Specifically:

• Active Accounts: Data is retained for the duration of your subscription.
• After Account Termination: We retain your data for 30 days to allow you to request a backup export. After this period, all identifiable account data is permanently deleted.
• Anonymised Data: Aggregate, anonymised usage data that cannot identify you may be retained indefinitely for analytics and product improvement.
• Legal Obligations: Where required by law, we may retain certain records for the minimum period mandated by applicable Nepali legislation.

7. Data Security

We take data security seriously and implement the following measures:

• Encryption in Transit: All data transmitted between your browser and our servers is encrypted via HTTPS (TLS 1.2+).
• Encryption at Rest: Sensitive data stored in our database is encrypted at the infrastructure level.
• Password Hashing: Passwords are hashed using industry-standard bcrypt algorithms. We never store plain-text passwords.
• Role-Based Access Control: Access to data is restricted based on user roles (Owner, Staff, Manager, Super Admin). Staff can only access their assigned club's data.
• Admin Password Resets: Password reset requests by staff require Super Admin approval, providing an additional layer of security.
• Infrastructure Security: Our hosting partners (Vercel, Supabase) maintain SOC 2-compliant infrastructure with regular security audits.

While we implement robust security measures, no internet-based service can guarantee 100% security. In the event of a data breach that materially affects your rights, we will notify you promptly and take immediate corrective action.

8. Your Rights Over Your Data

You have the following rights with respect to your personal data:

• Right of Access: You may request a copy of all personal data we hold about you.
• Right of Rectification: You may correct inaccurate or incomplete personal data via your account settings or by contacting us.
• Right of Erasure: You may request deletion of your account and associated data, subject to our 30-day retention policy and any legal obligations.
• Right to Data Portability: You may request an export of your club data (customer records, billing history, transaction data) in JSON format at any time.
• Right to Restrict Processing: You may request that we limit how we process your data in certain circumstances.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at manish.agrawal.np@gmail.com. We will respond within 30 days.

9. Club Owner Responsibilities (Data Controller Obligations)

When you use SnookBill to store data about your customers (club patrons), you act as the Data Controller for that data, and SnookBill acts as the Data Processor on your behalf. As a club owner, you are responsible for:

• Ensuring you have a lawful basis to collect and process your customers' personal information.
• Informing your customers that their data (name, phone number, billing history) is stored on SnookBill.
• Handling customer data access or erasure requests from your patrons.
• Ensuring your use of SnookBill complies with applicable data protection laws in your jurisdiction.

10. Children's Privacy

SnookBill is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If we discover that a person under 18 has provided us with personal data, we will take immediate steps to delete such information. If you believe we have inadvertently collected data from a minor, please contact us immediately.

11. International Data Transfers

SnookBill operates primarily from Nepal, but uses cloud infrastructure providers (Vercel, Supabase) whose servers may be located in other countries. By using our Service, you consent to your data being transferred to and processed in those countries. We ensure our service providers maintain adequate data protection standards through contractual agreements.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page.
• Notify you via email or a prominent in-app notification.
• Where required by law, obtain your renewed consent.

Your continued use of the Service after any changes signifies your acceptance of the updated policy.

13. Governing Law

This Privacy Policy is governed by the laws of Nepal, including but not limited to the Electronic Transaction Act, 2008 (2063 B.S.) and the Privacy Act, 2018 (2075 B.S.). Any disputes arising from this policy shall be subject to the jurisdiction of the competent courts of Nepal.