Privacy Policy

This policy explains what NEOSTATION collects when you sign up as a member or play at the venue, and what we do with it.

Only what is needed to run the lounge and bill you correctly:

• Account details: your username, display name, email address and (optionally) phone number.
• Play history: which station you used, when a session started and ended, and how many players.
• Money: invoices and their line items, payment method, wallet balance and top-ups, and loyalty points.
• Membership: your plan, its status and renewal date.
• A profile picture, only if you upload one.

We do not collect card numbers or bank details. Payments are taken at the counter and only the method used (for example UPI or cash) is recorded against the invoice.

• To run sessions and charge the correct amount.
• To keep an accurate financial record, including refunds and corrections.
• To operate memberships, the wallet and loyalty points.
• To send you your invoice, if you ask for it on WhatsApp.
• To understand when the venue is busy, so we can staff and price sensibly.

If you have given us your number, we may occasionally message you about offers or quiet-hour deals. You can opt out at any time · tell any staff member, or reply asking to stop, and we will mark your account so no further marketing is sent. Opting out does not affect invoices or anything else you have asked us to send.

Your record is visible to you and to NEOSTATION staff. It is not sold, and it is not shared with anyone else except the services we need to operate:

• Supabase, which hosts the database and handles logins.
• Railway, which hosts the application.
• WhatsApp, but only when a message is actually sent to you.

An invoice link you are sent contains a private token. Anyone with that exact link can view that one invoice, so treat it like a receipt and only share it with people you want to see it.

Financial records · invoices, payments and refunds · are kept as long as we are required to retain accounts. Your profile is kept while your account is open. Ask us to close your account and we will remove your personal details, keeping only the transaction records we are obliged to hold.

Under India's Digital Personal Data Protection Act and comparable laws such as the GDPR, you can:

• Ask for a copy of the personal data we hold about you.
• Ask us to correct or complete anything that is wrong.
• Withdraw consent for marketing at any time, with no effect on anything else.
• Ask us to delete your account and personal details · you can also do this yourself from your account page.
• Nominate someone to exercise these rights on your behalf if you are unable to.

We act on a valid request within a reasonable time and never charge to do so.

We rely on your consent to send marketing, which you give by opting in and can withdraw at any time. Everything else · running your sessions, billing, and keeping lawful records · we do to provide the service you asked for and to meet our legal obligations.

Accounts are intended for adults. Where a minor uses the venue, we expect a parent or guardian to consent and to hold any account.

Passwords are stored only as salted hashes and are never visible to us. Data is encrypted in transit, and access to member records is restricted to signed-in staff. No system is perfectly secure, but we take reasonable measures to protect your information.

If you have a concern about how your data is handled, ask at the counter or speak to the owner. We take privacy complaints seriously and will respond. If we cannot resolve it, you may escalate to the Data Protection Board of India.