Privacy Policy

1. About this policy

RiverStacks provides software that helps poker rooms and their guests manage table availability, seat requests, waitlists, seating and attendance. Players may also maintain optional personal session notes and financial tracking that is private to them.

RiverStacks does not provide gambling, wagering, payment, wallet, money-transfer or cashier services.

2. Data we collect

• Account and profile data, including name, email address, telephone number, profile image, authentication status, venue membership, role and preferences.
• Venue and operational data, including tables, games, stakes, seat requests, waitlists, holds, seating, attendance, movements, departures, staff assignments, floor requests, notes and audit history.
• Optional Player-private notes, buy-ins, rebuys, add-ons, cash-outs, prizes and bankroll information. This is personal tracking only and is not visible to Operators or Dealers through RiverStacks.
• Event saves, reminders, campaign participation, qualifying attendance, points, rank, notifications and support communications.
• Content safety: reports include the reporting account, venue and content identifiers, selected reason, submission time and review status. Publisher-hiding preferences identify the account and venue publisher. Authorized RiverStacks platform administrators may review reported published content and messages; reports are not automatically forwarded to venue staff and do not include Player-private financial tracking.
• Device and technical data needed for security, sign-in, push notifications, diagnostics, connectivity and synchronization.

3. How we use data

• Create, authenticate and secure accounts and connect users to the correct venue and role.
• Display live tables and availability and manage requests, waitlists, seating, attendance and floor operations.
• Provide Player-owned tracking, events, attendance-based campaigns, leaderboards and analytics.
• Deliver account, operational, support and push communications.
• Prevent misuse, investigate incidents, maintain audit records, improve the service and comply with applicable law.

4. Venue responsibilities

Poker rooms and casinos control the venue information and operational records entered by their authorized staff. They are responsible for lawful use, limiting staff access and providing venue-specific notices required by law.

RiverStacks controls account administration, service security, Player-private tracking and direct support. Requests involving venue-created records may require coordination with the venue.

5. When data is shared

RiverStacks does not sell personal data and does not disclose Player-private financial tracking to venue Operators or Dealers.

Supabase provides account authentication, database and synchronization services. Enabled Android device alerts use Expo Push Service and Google Firebase Cloud Messaging, including push tokens and a randomly generated app-installation identifier. Website demo enquiries include the contact and venue details you submit and are delivered to our support team through our email provider. The website integrates Vercel Web Analytics for visitor and usage measurement. Browser or device storage is used for sign-in and preferences. Selecting an event image may upload that selected image; it does not give staff access to your entire photo library.

Player-private tracking is excluded from organization-owner, Operator and Dealer application views. This is an application access boundary, not a promise of end-to-end encryption or that infrastructure providers can never process stored data. Authorized service administration may process data where necessary for support, security, legal requests or verified deletion.

• The venue linked to the relevant request or attendance, and its authorized organization owner and staff, subject to their roles. Unrelated organizations do not receive access to that operational data through the service.
• Infrastructure, authentication, hosting, database, email, notification, analytics, security and support providers acting on our behalf.
• Apple, Google and Expo where required for app distribution or notifications.
• Professional advisers, regulators, courts or authorities where legally required, or a successor to the RiverStacks service subject to safeguards.

6. International processing

Some providers may process data outside India. RiverStacks uses providers and safeguards intended to protect personal data and follows applicable cross-border restrictions.

7. Data retention

Where retention is required, use is restricted and unnecessary identifiers are removed or de-identified where reasonably possible. Account deletion includes associated personal data, not just disabling login. Retention exceptions must have a specific security, fraud-prevention, legal or other lawful purpose; the existence of an attendance or audit record is not by itself a reason to keep all identifying data indefinitely. We explain any applicable exception when handling a verified request. Data held by service providers is included in the deletion process where applicable.

• Account and preference data is generally kept while an account remains active.
• Player-private tracking is kept until the Player removes it or requests account deletion, subject to backup and legal requirements.
• Limited attendance, seat-assignment, staff-activity and audit information may be retained where necessary for a specific lawful security, fraud-prevention, dispute-resolution or legal purpose.
• Invalid push tokens are removed or disabled. Security logs and protected backups may remain for a limited period before scheduled deletion.

8. Security

RiverStacks uses authenticated access, role-based permissions, encrypted connections, database access policies, restricted private-data interfaces and audit records. No electronic service is completely secure, so users must protect passwords and shift PINs and promptly report suspected unauthorized access.

9. User choices and rights

Official attendance cannot be edited as private Player tracking. Questions about venue attendance should be raised with the venue or RiverStacks support.

Send requests from the registered email address to info@riverstacks.com. Reasonable identity verification may be required.

• Request access to or correction of personal data.
• Request deletion of an account and eligible personal data.
• Withdraw consent where processing depends on consent.
• Change preferences or raise a privacy grievance.

10. Notifications

Optional device notification delivery can be disabled in device settings. Player device-alert enrolment is available where supported; the Operator app does not currently provide the same enrolment control. Disabling permission does not itself guarantee immediate deletion of an existing server registration. Essential account, authentication, security and service messages may still be sent when necessary.

11. Age requirement

RiverStacks is not intended for anyone under 18. Users must also meet the legal age, entry rules and participation requirements of the relevant venue and jurisdiction.

12. Changes to this policy

RiverStacks may update this policy when the service, legal requirements or data practices change. The revised date will be shown and material changes may be communicated through the app, website or registered email address.

13. Privacy grievances and contact

Amrit Navlani, trading as RiverStacks; Pune, Maharashtra, India; info@riverstacks.com; https://www.riverstacks.com.

Use the subject “Privacy request” or “Privacy grievance” and include the account email and a clear description. RiverStacks normally acknowledges a grievance within seven business days and aims to resolve it within 30 days, subject to verification and complexity.