Privacy policy

Rookiely is a cloud platform for running sports academies, operated by Digital Tunnel (“we”). This policy covers:

• The rookiely.com website and the demo requests sent from it.
• The platform itself: the console, front desk, coach app, kiosk and member portal, on each academy’s own address.

Each kind of data has a party responsible for it:

• The academy is the controller of the data about its members, guardians and athletes that it enters into the platform, and decides what it is used for. We are the processor: we handle that data on the academy’s behalf, under its instructions and our agreement with it.
• We are the controller of website visitors’ data, demo requests, and academy staff accounts as far as we need them to run, bill and support the service.

If you are a member of an academy and want to use your rights, contact your academy first; we help it carry out your request.

From website visitors: when you ask for a demo we collect your name, academy name, email, mobile number, number of branches and members, and any notes you write. Our server keeps limited technical data, such as IP address and browser type, for security.

From academy staff: name, email, role, permissions and allowed branches, and a record of sign-ins and changes.

What an academy enters about its members: family, guardian and athlete details (name, mobile, date of birth, and ID number where needed), memberships, attendance, invoices and payments. An academy can keep health notes such as allergies, which only staff with that permission can see.

Payment data: we never store card numbers. The payer enters them on the payment provider’s own page, and we keep only what the provider returns: the transaction reference, status and amount.

• To provide and run the service for each academy: registration, memberships, attendance, billing and messages.
• To issue e-invoices and report them to ZATCA as e-invoicing rules require.
• To answer demo and support requests, and to contact you about your subscription and billing.
• To protect the service: preventing fraud and automated abuse, tracing errors, and keeping a record of changes.
• To meet our obligations under the laws of the Kingdom.

We process data to perform our agreement with the academy, to meet legal obligations such as tax invoicing, for our legitimate interest in protecting and improving the service, and with your consent where that is required, such as the marketing messages an academy sends only to people who opted in.

We never sell or rent data. We rely on trusted providers to run the service, who are bound to protect it and use it only for that purpose:

We may also disclose data when a competent authority requires it under the law.

Platform data is hosted in Microsoft Azure data centres in the European Union. These transfers follow the Personal Data Protection Law and its regulation on transferring personal data outside the Kingdom, with appropriate safeguards that keep the level of protection, and only as far as the service needs.

• Every connection encrypted over HTTPS, and sensitive keys such as payment and e-invoicing keys encrypted when stored.
• Each academy’s data kept apart, and staff access limited by role and branch.
• Two-step verification, passkeys and Microsoft sign-in.
• A log of every change: who made it, when and what changed.
• Bot protection on public forms, and limits on repeated attempts.
• Our team reaches an academy’s data only for support, and only as far as needed.

• We keep an academy’s data for as long as it subscribes.
• When a subscription ends, the data stays available for export for 90 days, then is deleted.
• Invoices and tax records are kept for the period VAT law requires.
• Demo requests are kept for up to 12 months after our last contact.

Academies register young athletes through their guardian, who holds the member-portal account and is responsible for the children’s details. Our website does not collect data from children directly.

Under the Personal Data Protection Law you have the right to:

• Know how your data is collected and used.
• See your data and get a copy of it.
• Ask for your data to be corrected or completed.
• Ask for your data to be deleted when there is no legal need to keep it.
• Withdraw consent for processing that relies on it.

Send your request to hello@rookiely.com; we reply within 30 days. You can also complain to the Saudi Data and AI Authority (SDAIA).

• rookiely.com uses no advertising or tracking cookies.
• The sign-in page keeps your academy’s address in your browser to make your next sign-in easier; you can clear it in your browser settings.
• The platform uses only essential cookies for sign-in sessions, set securely and not readable by pages.
• Cloudflare Turnstile may use what it needs to check that a visitor is not a bot.

We may update this policy when the service or the law changes. The date of the last update is at the top of the page, and we tell subscribing academies about any material change before it takes effect.