Privacy Policy

1 Introduction

AmaX Ltd. ("AmaX", "we", "us", or "our") builds and operates the AmaSports platform: a mobile application for player profiles, live scoring and match statistics across multiple sports, a companion website, and an administrative control panel used by our staff and academy partners to manage matches, teams and live scores (collectively, the "Platform").

This Policy describes what personal data we process when you create an account, browse the Platform, submit an enquiry, or make a payment — for example an annual player subscription or a pay-per-match live-stream unlock — through our payment partner PayHere. By using the Platform or completing a payment, you agree to the collection and use of information as described here.

2 Who we are

AmaSports is owned and operated by AmaX Ltd., headquartered in Colombo, Sri Lanka, with a regional office in Moradabad, India. Full contact details are listed in Section 15 below. AmaX Ltd. is the "data controller" responsible for the personal data described in this Policy.

3 Information we collect

We collect the following categories of information:

a. Account information

Full name, email address, password (stored as a salted, irreversible hash — we cannot see or recover your plain-text password), account role (player/student, coach, or admin), and profile photo or avatar.

b. Player & sports profile data

Sport(s) played, team/school/college affiliation and logos, age category, match and career statistics relevant to the sport (for example batting/bowling figures, goals, times, distances, or bout records), achievement badges, player photographs, and match participation history. Coaches, academies, and administrators may enter or manage this data on behalf of the athletes they supervise.

c. Identity verification data

One-time passcodes (OTP) sent to your email or phone number to confirm you own the account. OTPs are short-lived and are not retained once verification is complete.

d. Payment & subscription data

When you purchase a player subscription or unlock a paid live stream, we record the amount charged, currency, your billing country, the plan or match purchased, a transaction/order reference, and the payment status and timestamp returned to us by our payment processor. We do not collect, transmit, or store your full card number, CVV, or online banking credentials — those are entered directly on PayHere's own secure, PCI‑DSS‑compliant payment pages. See Section 5 for details.

e. Support & contact-form data

Your name, email address, chosen enquiry topic, and the content of any message you send us through the Contact Us screen.

f. Technical & usage data

IP address, browser or device user-agent, session identifiers, sign-in timestamps, and general diagnostic/log data we need to operate the Platform securely and reliably.

g. Live match data

Ball-by-ball and match score updates are synced in real time through our Firebase-backed live scoring service. This is public sporting information (scores, overs, wickets, sets, etc.) and is not linked to your personal account.

4 How we use your information

• Create and manage your account and player, coach, or admin profile;
• Display match schedules, live scores, statistics, and achievements within the Platform;
• Process subscription and live-stream-unlock payments and maintain your purchase/order history;
• Send essential account, OTP-verification, and transactional emails or notifications;
• Respond to enquiries submitted through Contact Us;
• Detect, prevent, and investigate fraud, abuse, and security incidents;
• Maintain, troubleshoot, and improve the Platform's features and performance; and
• Comply with legal, tax, and regulatory obligations, including those required by our payment partners.

5 Payments — PayHere

AmaSports charges for annual player subscriptions and single-match live-stream unlocks. All card, bank, and wallet payments are handled by our payment processor, PayHere (Pvt) Ltd, a licensed payment service provider regulated by the Central Bank of Sri Lanka — not directly by AmaX.

• When you choose to pay, you are redirected to a secure, hosted checkout page operated by PayHere.
• You enter your card, bank, or wallet details directly on PayHere's page; AmaX's servers never receive or store your full card number, expiry date, CVV, or banking credentials.
• Once payment succeeds, PayHere notifies AmaSports of the result (success, failure, or cancellation) together with a transaction reference, the amount, and the currency, so we can activate your subscription or stream access.
• PayHere processes this data under its own privacy policy and is independently responsible for the security of the payment details you provide to it: PayHere Privacy Policy.
• We retain a record of your transactions (amount, date, plan, and status) for accounting, support, and legal/tax purposes even after the payment itself is complete.
• Refunds, when approved, are always paid back to the original payment method used at checkout — see our Refund Policy.

6 Cookies & local storage

Our admin panel and website use standard session cookies to keep administrators signed in and to protect forms against cross-site request forgery. The AmaSports mobile app uses on-device secure storage (not browser cookies) to keep you signed in between sessions. We do not use third-party advertising cookies or trackers.

7 Sharing your information

We share personal data only with the following categories of recipients, and only as needed to run the Platform:

Every third party we work with is contractually required to protect your data and to use it only for the purpose we've engaged them for.

8 Youth athletes & children

Many athletes featured on AmaSports are students and youth players. AmaSports accounts (login credentials) are intended for users aged 18 or over, or for coaches, parents, guardians, or academy staff who create and manage player profiles on behalf of a minor athlete. We do not knowingly collect personal information directly from a child under 13 (or the minimum age of digital consent in their jurisdiction) without the involvement of a parent, guardian, or supervising coach/academy.

If you believe a minor has provided us personal data directly and without appropriate consent, please contact us at alex@amaxlk.com and we will review and remove it as appropriate.

9 Data retention

We keep account and profile data for as long as your account remains active, plus a reasonable period afterwards to allow reactivation and to meet legal, tax, and dispute obligations. Transaction records are retained for as long as required by applicable accounting and tax law. OTP codes are deleted shortly after they expire or are used. You may request earlier deletion — see Section 11.

10 Security

We use industry-standard safeguards to protect your data, including encrypted connections (HTTPS/TLS) between the app, website, and our servers, salted password hashing, access-controlled admin accounts, and reliance on our PCI‑DSS‑compliant processor (PayHere) for all payment card handling. No method of transmission or storage is 100% secure, but we work continuously to protect your information against unauthorized access, alteration, disclosure, or destruction.

11 Your rights & choices

• Access and update most of your profile information directly within the app;
• Request a copy of the personal data we hold about you;
• Request correction or deletion of your account and associated data;
• Opt out of non-essential communications from us at any time;
• Withdraw consent previously given, where processing relies on consent.

To exercise any of these rights, contact alex@amaxlk.com. Depending on where you live — for example under the Sri Lanka Personal Data Protection Act, No. 9 of 2022, the EU/UK GDPR, or other local law — you may have additional rights; we will honour requests to the extent required by the law that applies to you.

12 International transfers

AmaX operates from Sri Lanka and India and relies on global infrastructure and payment providers. As a result, your data may be processed or stored in a country other than where you live. Wherever this happens, we require the recipient to protect your data to a standard consistent with this Policy.

13 Third-party links

The Platform may link out to third-party sites or services — including PayHere and embedded live-stream video — that are governed by their own privacy policies. We encourage you to review those policies before sharing information with them.

14 Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, features, or legal requirements. We will update the "Effective date" above whenever we do, and where a change is material we will take reasonable steps to notify you (for example, in-app or by email) before it takes effect.

15 Contact us

If you have questions about this Privacy Policy or how your data is handled, reach us at: