CRASSHO Privacy Policy
This Privacy Policy explains how personal data is collected, used, shared and protected when you play CRASSHO, a behavioural road-safety game for players aged 9 and above. CRASSHO is designed and developed by Scasys Technologies Private Limited ("Scasys", "we", "us") under the developer name "Rosa Motion". For the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules made under it ("DPDP Rules"), Scasys is the Data Fiduciary.
In short, for young players
- •We collect only what we need to run the game and help you learn road safety.
- •If you are under 18, a parent or guardian must say yes before you start playing.
- •We do not sell your information, and we do not show you ads based on how you play.
- •You or your parent can ask to see, fix or delete your information at any time.
1. Who can use CRASSHO
- •Players must be 9 years or older. We do not knowingly collect data from anyone younger. If we find that we have, we will delete it.
- •Under the DPDP Act, a child is anyone under 18. Before we process a child's personal data, we obtain verifiable consent from the child's parent or lawful guardian. The same applies to a person with a disability who has a lawful guardian.
- •If a school, NGO or other institution gives CRASSHO to its students, it must make sure the required parental consent is in place. We process that data only for the purposes in this Policy.
- •This Policy is available in English and Hindi, and on request in any language listed in the Eighth Schedule to the Constitution of India.
2. What we collect and why
We ask for your consent, through a clear notice, before we collect personal data. We use it only for the purposes below.
| What we collect | Examples | Why we need it |
|---|---|---|
| Player profile | Nickname, age or age band, avatar | To set up your profile and apply age checks |
| Parent or guardian details | Name, email or mobile number, record of their consent | To obtain and record verifiable parental consent, and to send notices |
| Gameplay and learning data | Levels, scores, choices made in road scenarios, hazard responses, time played | To run the game, show progress, adjust difficulty and give safety feedback |
| Device and technical data | Device type, operating system, app version, language, IP address, crash logs, input and connection quality when the game is streamed from the cloud | To keep the game secure, fix bugs and make it run smoothly |
| Support messages | What you or your parent write to us | To answer questions and requests |
What we do not collect. We do not collect precise location, contacts, photos, camera or microphone recordings, or payment details of children.
How we use it. Only to:
- 1.provide, personalise and improve the road-safety learning experience;
- 2.keep the Service safe, secure and working;
- 3.contact the parent or guardian about consent, account and safety matters;
- 4.meet our legal obligations; and
- 5.study anonymised, combined data to improve road-safety content. Truly anonymised data no longer identifies anyone.
Consent. Consent is free, specific, informed and clear. You or your parent can withdraw it at any time, as easily as it was given. If consent is withdrawn, we stop processing the data and erase it unless the law requires us to keep it. Parts of the game that need that data may then stop working.
3. Children's data: our extra safeguards
- •Parental consent first. We obtain verifiable consent from a parent or lawful guardian before processing a child's personal data, using a method permitted under the DPDP Rules. Until we have it, the child's profile is not activated.
- •No tracking, profiling or targeted ads. We do not track or behaviourally monitor children, and we do not direct advertising at them. We do not process children's data in any way that is likely to harm their well-being.
- •How the game uses play data. CRASSHO's learning design looks at how a player responds to road scenarios inside the game. It does this only to give feedback and choose the next lesson, which is the service the child and parent signed up for. We do not use this data to build profiles outside the game, to advertise, to sell, or to share with insurers, employers, schools or any other third party for their own use.
- •Limited visibility. A child's public name is a nickname. We never show a child's full name, school or contact details to other players.
- •Parents stay in control. A parent or guardian can review, correct or delete the child's data, and withdraw consent, at any time (see section 5).
4. Sharing, storage and security
Who sees the data. We do not sell personal data. We share it only with:
- •service providers (Data Processors) who help us run CRASSHO, such as cloud hosting, crash reporting and email or SMS delivery. They act on our instructions under written contracts and may not use the data for their own purposes;
- •courts, regulators and government authorities, where the law requires it; and
- •a successor, if our business is merged or transferred. The same protections will continue to apply.
"Rosa Motion" is our developer name, not a separate recipient.
Where it is stored. Data is stored on secure cloud servers. We prefer servers in India. Data may be processed in other countries, except any the Central Government restricts under the DPDP Act.
How long we keep it.
- •Profile and gameplay data: while the account is active.
- •If a parent withdraws consent or asks for deletion, we erase the data within [30] days, except where the law requires us to keep it.
- •If an account is inactive for [12] months, we notify the parent or guardian, then erase it.
- •Records of parental consent, and security and access logs, are kept for the period the law requires, which is at least one year for logs.
How we protect it. We use encryption in transit, access controls limited to staff who need the data, secure development practices and regular reviews. No system is perfectly secure. If a personal data breach occurs, we will inform the Data Protection Board of India and affected Data Principals (or, for a child, the parent or guardian) as the law requires.
5. Your rights, and how to reach us
Under the DPDP Act, you (a "Data Principal") have the right to:
- •Access a summary of the personal data we hold, how it is used, and who it has been shared with;
- •Correct, complete or update your data;
- •Erase your data when it is no longer needed or you withdraw consent;
- •Withdraw consent at any time;
- •Get your grievance addressed; and
- •Nominate another person to exercise these rights if you die or become unable to act.
For a child, the parent or lawful guardian exercises these rights. To make a request, write to the Grievance Officer below. We may ask for details to confirm who you are, and for a parent, their relationship to the child. We aim to reply within 15 days and will resolve requests within the time the DPDP Rules prescribe.
In return, please give accurate information, do not impersonate anyone, and do not make false or frivolous complaints.
Grievance Officer
If you are not satisfied with our response, you may complain to the Data Protection Board of India.
6. Cookies and similar technologies
We use only the cookies or local storage the game needs to work and stay secure. We do not use advertising or cross-site tracking cookies.
7. Changes to this Policy
We may update this Policy. We will tell parents and guardians through the game or by email before any important change takes effect. If a change affects how a child's data is used, we will ask for fresh consent. The effective date at the top shows the current version.
8. Governing law
This Policy is governed by the laws of India, including the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.