PRIVACY POLICY

We collect the minimum needed to let one person cast one vote per battle and to show results by country: your email, the country you choose, your votes, and technical data to stop abuse. If you buy the Unlimited Pass, Razorpay handles the payment and we keep only the order reference. If advertising is on, Google AdSense may set advertising cookies, with your consent where the law requires it. We never sell personal data, and you can delete your account yourself.

Batlio (batlio.com), home of World Battle, is a brand operated by IM Integrated-Minerals LLP. This policy explains what IM Integrated-Minerals LLP collects and why.

• Account: your email address; if you sign in with Google, the basic profile Google shares (name, picture, verified email).
• Where you vote from: the country you choose (required), and the region/state and city if you add them.
• Your votes: which side you picked in each battle and when.
• Preferences: your display name and email preferences, and the date you accepted the terms.
• Technical data: a salted one-way hash of your IP address, your browser's user-agent, and the network country reported by our edge provider, used only for abuse protection and as a fallback when you have not chosen a country yet.
• Payments: only if you buy the Unlimited Pass. We store the Razorpay order id, payment id, amount, currency, status and date. Your card, UPI or bank details go straight to Razorpay and never reach our servers.
• Advertising: if advertising is on and you have consented where consent is required, Google AdSense may collect the data described under “Advertising and consent” below. We do not receive it.

• To run the service you asked for (performance of a contract): signing you in, counting one vote per person, showing results by country.
• To keep voting fair (legitimate interest): rate limits, duplicate detection and abuse investigation.
• To email you new battles (consent): only if you opted in; withdraw any time.
• To sell and honour the Unlimited Pass (performance of a contract and legal obligation): taking payment through Razorpay, activating the pass on your account, handling refunds, and keeping the records tax law requires.
• To show advertising (consent in the EEA, UK and Switzerland; legitimate interest elsewhere): letting Google AdSense serve ads on the free version of the site.
• To meet legal duties (legal obligation): responding to lawful requests and grievance handling.

We use a small number of processors under contract, each only for the purpose listed:

• Resend delivers our emails (sign-in codes, notices, opted-in marketing).
• Microsoft Azure hosts the site, database and edge network; data is stored in the Central India region.
• Google is used if you choose “Continue with Google”, and, when advertising is on, Google AdSense serves the ads and Google's consent tool records your advertising choices. Google's own privacy policy applies to both.
• Razorpay Software Private Limited processes payments for the Unlimited Pass. It receives your email address and the amount, handles your card, UPI or netbanking details directly, and is a PCI DSS compliant payment gateway with its own privacy policy.

We do not sell or rent personal data and we do not share it with data brokers. Advertising partners receive only what your browser sends them when an ad loads, as described in the next section; we never hand them your email, your votes or your account.

• Account data: while your account exists. Delete it from your account page and it is removed immediately.
• Votes: individual vote records are deleted with your account; aggregated counts (which contain no personal data) are kept.
• Sign-in codes: 15 minutes. Sessions: up to 30 days, or until you sign out.
• Abuse logs (hashed IPs): up to 90 days.
• Email delivery logs: up to 12 months.
• Order and payment records for the Unlimited Pass: 8 years from the payment, as required by tax law. They survive account deletion in a form that no longer identifies you beyond what the law requires.

Two kinds of cookies can be set on Batlio: the ones the service needs, and, only when advertising is on, advertising cookies from Google.

Strictly necessary, first-party and HTTP-only. These do not need your consent and are always set:

• wb_session (__Secure-wb_session on https) keeps you signed in for up to 30 days; removed when you sign out.
• wb_oauth protects the “Continue with Google” step against forgery; expires after 10 minutes.
• wb_admin is staff only, set when our team signs in to the admin console; never set for regular visitors.

Advertising cookies (Google). When advertising is on, Google AdSense may set cookies and use similar technologies to serve ads, limit how often you see one, measure their performance and, if you allow it, personalise them. Google's consent tool also stores your consent choice. If you are in the EEA, UK or Switzerland none of these are set until you consent, and you can change your choice from the “Privacy settings” link in the footer. Holders of the Unlimited Pass see no ads and get no advertising cookies.

We do not use analytics or cross-site tracking cookies of our own.

Advertising is what keeps Batlio free. Our advertising partner is Google AdSense. When advertising is on, ads appear below a battle's results and between cards in the feed, never inside the voting arena.

• What Google may collect. When an ad loads, your browser sends Google your IP address, the page you are on, your device and browser details, and any Google advertising cookie already set. Google uses this to serve and measure ads and, where you have allowed it, to personalise them based on your visits to this and other sites. Google describes this in its own privacy policy and at How Google uses information from sites that use its services.
• Consent in the EEA, UK and Switzerland. If you visit from the European Economic Area, the United Kingdom or Switzerland we show a consent dialog powered by Google's certified consent tool before any advertising cookie is set. You can accept, refuse or manage your choices there, and reopen it any time from the “Privacy settings” link in the footer. If you refuse, you may still see ads, but they are not personalised and use no advertising cookies.
• Opting out elsewhere. Wherever you are, you can turn off personalised ads at Google Ads Settings, use the “Privacy settings” link in the footer where it is shown, or block cookies in your browser. The Unlimited Pass removes ads altogether.
• What we never do. We do not sell personal data, we do not give advertisers your email, votes or account details, and we do not show ads to people we know are under 13.

If you buy the Unlimited Pass, the payment is processed by Razorpay Software Private Limited. The checkout is Razorpay's: your card number, CVV, UPI id or bank login are entered on their form, encrypted and handled by them, and never touch our servers.

• What we store: the Razorpay order id, the payment id, the amount, the currency, the status, the date, and which account the pass was activated on. That is what we need to activate the pass, answer support questions and process a refund.
• What Razorpay receives from us: your email address, the amount and a description of the purchase. Razorpay may also collect device and fraud-prevention signals under its own privacy policy.
• How long: 8 years, because Indian tax and accounting law requires it. This is the one set of records we cannot delete on request, although it is kept in a form that identifies you only as far as the law needs.

Under the Digital Personal Data Protection Act, 2023 you have the right to access information about your personal data, to correct, complete or update it, to have it erased, to withdraw consent (for example to marketing emails), to nominate someone to exercise your rights if you die or become incapacitated, and to grievance redressal.

• Change your name, country, region, city and email preferences yourself on your account page.
• Delete your account yourself from the bottom of your account page; it takes effect immediately. Payment records for the Unlimited Pass are the one exception, kept as tax law requires; the pass itself ends with the account.
• For anything else, email support@batlio.com. We reply within 2 business days. If you are unhappy with our answer you may complain to the Data Protection Board of India or, where applicable, your local data protection authority.

Batlio is not for children under 13. We do not knowingly collect data from them; if you believe we have, email support@batlio.com and we will delete it.

All traffic is encrypted in transit. Sign-in codes and session tokens are stored only as one-way hashes. IP addresses are hashed with a secret salt before storage. Access to production data is limited to the people who run the service. Payment credentials never reach our servers, so there is nothing there to breach.

We may update this policy; the date at the top shows the current version. Material changes are announced on the site or by email.

As required by the Information Technology Act, 2000 and the rules under it, and by the Digital Personal Data Protection Act, 2023, here is the person responsible for complaints about your data.

• Name: Samarth Kumar Saxena
• Designation: Grievance Officer
• Entity: IM Integrated-Minerals LLP
• LLPIN: AAW-5083
• PAN: AAIFI7447K
• GSTIN: 07AAIFI7447K1ZW
• Address: Flat No. D-67, Arya Nagar Apartment, 91, I.P. Extension, Patparganj, New Delhi, Delhi 110092, India
• Email: support@batlio.com (subject “Grievance”)
• Phone: +91 92171 78088

We acknowledge a grievance within 48 hours and resolve it within 30 days. If you are not satisfied with the outcome, you may complain to the Data Protection Board of India.