Securing Your Privacy & Sports Data

Usturais committed to protecting your privacy and personal data in accordance with the Kingdom of Saudi Arabia's Personal Data Protection Law (PDPL), issued under Royal Decree No. M/19 (1443H), Communications, Space & Technology Commission (CST/CITC) guidelines, and applicable international standards.

• Account data: Name, email address, password (fully hashed).
• Organization data: Club or academy name, city, timezone.
• Operations data: Events, teams, venues, talent profiles, media files.
• Usage data: System security logs, login timestamps, and verification IP address.

Your data is processed exclusively to operate the platform: organizational account management, sports event scheduling, fan engagement, talent intelligence, real-time notifications, and ongoing system performance improvement.

All data is stored and processed within the Kingdom of Saudi Arabia on AWS me-south-1 (Bahrain/Riyadh). We do not sell or share your data with third parties for commercial purposes. We may share data with necessary technical service providers (e.g., AWS) under strict data processing agreements.

• Passwords hashed securely with bcrypt (12 rounds).
• Short-lived JWT tokens (15 minutes) with automatic refresh.
• Account lockout after 5 consecutive failed login attempts (NCA security standard).
• Automatic session expiry after 30 minutes of inactivity.
• Row-level data isolation between sports organizations.
• Immutable audit logs generated for all sensitive actions.

Under the KSA PDPL, you have the full right to:

• Access the personal data we hold about you and verify its accuracy.
• Correct or update any inaccurate organizational details.
• Request deletion of your data ("right to be forgotten"), subject to statutory retention guidelines.
• Object to the processing of your data under specific conditions.
• Receive your data in a portable, structured, machine-readable format.