Wecap privacy policy
Wecap collects only the data the operator needs to run fantasy cricket contests under the Promotion and Regulation of Online Gaming Act, 2025. The working reference covers.
What we collect, why, how long
Three categories of data, each with a documented purpose and retention window.
| Category | Purpose | Retention |
|---|---|---|
| Identity | KYC verification, sign-in, withdrawals | Account lifetime + 7 years (regulatory) |
| Wallet | Deposits, withdrawals, contest entries | Account lifetime + 7 years (regulatory) |
| Device | Two-factor binding, security alerts | Until unbound by user; then 30 days |
| Matchday activity | Contest engine scoring, leaderboards | Account lifetime + 3 years |
| Support | Customer care queries and replies | Account lifetime + 3 years |
Your rights over your data
Three rights you can exercise at any time.
Request a copy
You can request a copy of the data we hold on your account. The desk replies within 7 working days with a downloadable archive.
Correct what's wrong
If you spot anything incorrect, raise a correction request via the in-app wallet menu. The desk corrects verified errors within 7 working days.
Delete the account
Account deletion is one tap in the wallet menu. KYC records are retained for 7 years under the PROG Act, 2025; everything else is purged.
Who we share data with
Three categories of recipient, each under a documented contract.
PAN and Aadhaar verification under the PROG Act, 2025. The partner is named in the in-app legal menu.
UPI, net-banking and card processing. The aggregator is named in the in-app legal menu.
Under the PROG Act, 2025, certain reports are shared with the regulator on request. Reports are scoped to the regulatory requirement.
Last reviewed 22 Jul 2026. The full policy with all subsections lives in the in-app legal menu and is the authoritative version.
What the desk does not collect
The desk is opinionated about what we don't collect. The list below is the working boundary; readers can audit the privacy policy for any field they don't see.
Sensitive fields
- Full card numbers (handled by the payment aggregator)
- CVV — never stored or transmitted by Wecap
- Bank PIN or UPI PIN — never seen by Wecap
- Full Aadhaar number on chat — only last four digits used
- Browser fingerprinting — we don't use fingerprinting
Behavioural fields
- Off-app browsing history
- Third-party tracking pixels
- Cross-site identity matching
- Precise geolocation (state-level only)
Where data is processed
Wecap processes data on servers located in India. KYC partners operate under Indian data protection law. The desk does not transfer personal data outside India.
| Data category | Processor | Location |
|---|---|---|
| Identity | Wecap + KYC partner | India |
| Wallet | Wecap + payment aggregator | India |
| Device | Wecap | India |
| Matchday activity | Wecap | India |
| Support | Wecap | India |
Reader questions about Wecap privacy
Reader questions sent to the desk in the last quarter, answered in editorial voice. Send yours via /contact/.
Does Wecap sell my data to third parties?
No. Wecap shares data only with the KYC partner, the payment aggregator and the regulator (on request, under PROG Act, 2025). Data is never sold to advertisers, brokers or data marketplaces.
Can I see exactly what Wecap holds on me?
Yes. Send a request to the contact form with "Data access request" in the subject line. The desk replies within 7 working days with a downloadable archive of the data held.
Does Wecap use cookies for tracking?
Wecap uses functional cookies only: session, auth, language preference. No third-party tracking cookies, no analytics pixels, no advertising cookies. The session cookie clears on logout.
What happens to my data after account deletion?
KYC records stay for 7 years under PROG Act, 2025; wallet and contest records stay for 3 years; everything else is purged at T+90 days. Account access is removed at T+7 days.
Does Wecap use AI to profile my contest activity?
Wecap uses scoring engines to compute contest results; it does not use AI profiling for marketing or credit decisions. The contest engine is deterministic; the editorial column is human-written.
Wecap and users under 18
Wecap is restricted to adults aged 18 and above. KYC enforces age verification before the first deposit. The desk's policy on users under 18 is documented here.
If a user under 18 creates an account in error, the desk suspends the account within 24 hours of detection. KYC records are retained for the regulatory window; contest records are retained for the regulatory window; everything else is purged.
Parents or guardians who find an under-18 account can contact the desk via the contact form. The desk reviews the request within 24 hours and confirms the suspension in writing.
Recent changes to the privacy policy
The desk publishes every material change to the privacy policy. Routine clarifications (typo fixes, citation updates) ship without separate notice.
| Date | Change | Reason |
|---|---|---|
| 22 Jul 2026 | Updated PROG Act 2025 references | Federal framework implementing rules |
| 08 Jun 2026 | Clarified retention windows | KYC partner change |
| 21 Apr 2026 | Added international transfers clause | Standard clarifier |
| 12 Mar 2026 | Added self-exclusion data clauses | PROG Act 2025 alignment |
| 21 Feb 2026 | Updated third-party processor list | Payment aggregator change |
Wecap's compliance posture in detail
Wecap operates as a real-money online gaming platform under the Promotion and Regulation of Online Gaming Act, 2025. The compliance posture is documented below.
KYC at every deposit
Identity verification runs at sign-up, at the first deposit, and at any withdrawal request above the standard cap. Verification is mandatory under the PROG Act, 2025.
Deposit & session caps
Wecap defaults every account to a daily deposit cap and a session timer. Users can lower limits immediately; raises require a 30-day cool-down.
Self-exclusion
Self-exclusion is one tap in the wallet menu. Cool-down periods run from 24 hours to permanent. Reactivation requires a verified cooling-off period.
What happens in the event of a data breach
Wecap maintains an incident response plan with notification timelines aligned to Indian law. The procedure is documented below.
- 1Detection
The incident response team detects the breach through monitoring, user reports, or third-party notification.
- 2Containment
The team contains the breach within 24 hours of detection. Affected systems are isolated; user accounts are reviewed.
- 3Notification
Affected users are notified within 72 hours of detection. The regulator is notified per the PROG Act 2025 implementing rules.
- 4Remediation
The team remediates the breach within 7 days of detection. Affected users receive a written remediation summary.
Your data rights, in detail
Wecap recognises five data rights under Indian law. Each right is exercisable via the contact form or the in-app wallet menu.
Access
Request a copy of the data we hold on your account. The desk replies within 7 working days with a downloadable archive.
Correction
Correct anything that's wrong. The desk corrects verified errors within 7 working days; KYC errors are routed to the KYC partner.
Deletion
Delete your account. The desk processes the deletion within 7 working days; regulatory KYC retention is honoured.
Restriction
Restrict processing of certain data categories while a query is being resolved. The wallet menu has the restriction option.
Complaint
Complain to the data protection authority if your query is not resolved. The desk provides the relevant authority contact on request.
Data retention under Indian law
Wecap retains data per Indian law. The retention windows are documented below.
| Data category | Retention | Authority |
|---|---|---|
| KYC records | 7 years from last transaction | PROG Act 2025, PMLA 2002 |
| Wallet records | 7 years from last transaction | PMLA 2002, Income Tax Act |
| Contest records | 3 years from contest settlement | PROG Act 2025 |
| Support records | 3 years from last interaction | Consumer Protection Act 2019 |
| Marketing preferences | Until withdrawn | IT Act 2000 |
Why Wecap publishes an explicit privacy policy
Indian law requires explicit privacy disclosures for any platform that processes personal data. The desk publishes the policy in plain language.
Required by law
The Information Technology Act, 2000 (and the SPDI Rules, 2011) require explicit privacy disclosures. The policy meets the statutory requirement.
Real-money gaming
The Promotion and Regulation of Online Gaming Act, 2025 sets additional disclosure duties for real-money platforms. The policy meets those duties.
Consumer Protection Act, 2019
The Consumer Protection Act, 2019 gives consumers the right to information about how their data is used. The policy meets that right.