Privacy Policy
Last updated: April 15, 2026
Welcome to Orusta. This Privacy Policy describes how Challenge Arena Software FZCO ("we", "our", "Orusta") collects, uses, and protects your personal data when you use our mobile application and related services (the "Services").
1. Data controller
Challenge Arena Software FZCO License No. 80218, IFZA Free Zone IFZA Business Park, Building A1, Dubai Digital Park Dubai Silicon Oasis, Dubai, United Arab Emirates
Data protection contact: privacy@orusta.com Legal contact: legal@orusta.com
2. Data we collect
When you use Orusta, we collect the following categories of data:
- Account data: email address, Google ID (if you sign in with Google), username, profile picture.
- Profile data: age, gender, height, weight, practiced sports, training level. Some of these are optional.
- User-generated content: challenge videos, chat messages, battle messages, meet-up posts, submitted ideas, votes.
- Location data: approximate city only (never continuous precise coordinates), collected only when you deliberately use the meet-up search feature.
- Technical data: device identifier, app version, operating system, IP address, language.
- Audio/video streams: real-time audio and video during battles (not permanently recorded unless explicitly submitted).
We collect no advertising tracking data and use no intrusive analytics SDKs (Firebase Analytics, Facebook SDK, Mixpanel, etc.).
3. Purposes and legal basis
| Purpose | Legal basis |
|---|---|
| Creating and managing your account | Contract performance |
| Community features (rankings, XP, levels) | Contract performance |
| Content moderation and safety | Legitimate interest |
| Communications (transactional emails, in-app notifications) | Contract performance |
| Service improvement | Legitimate interest |
| Marketing newsletters | Consent (opt-in) |
4. Recipients and sub-processors
Some of your data is transmitted to technical providers essential to the operation of the service:
- Amazon Web Services (AWS) — database hosting (Paris region, eu-west-3) and video storage (S3).
- OVHcloud — Kubernetes cluster hosting (France).
- Google LLC — OAuth authentication (only if you choose to sign in with Google).
- LiveKit, Inc. — real-time audio/video streaming infrastructure for battles.
- Transactional email services — sending confirmation and magic link emails.
We do not sell or rent your data to third parties.
5. Data retention
- Account data: retained as long as your account is active. Deleted within 30 days of an account deletion request.
- Challenge videos: retained until you delete them or they are rejected by moderation.
- Chat messages: retained for the duration of the conversation, then purged according to our retention policy.
- Technical logs: up to 90 days.
6. Your rights
Orusta respects user rights in accordance with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and with the General Data Protection Regulation (GDPR) for users residing in the European Economic Area. You have the following rights at any time:
- Access to your personal data.
- Rectification of inaccurate data.
- Erasure (right to be forgotten) — available directly from within the app.
- Portability — export of your data upon request.
- Objection to processing for legitimate reasons.
- Withdrawal of consent for consent-based processing at any time.
- Complaint to the competent supervisory authority (UAE Data Office for UAE residents, your local data protection authority for EEA residents).
To exercise these rights: privacy@orusta.com.
7. Security
We implement appropriate technical and organizational measures to protect your data: encryption in transit (HTTPS/TLS), restricted database access, strong authentication, and administrator access logging.
8. Minors
Orusta is intended for users aged 13 or older. For users residing in the European Economic Area and under 16 (or a lower age defined by local law), parental or legal guardian consent is required. We do not knowingly collect data from children under 13. If you are a parent or guardian and believe a child has provided us with personal data, please contact us at privacy@orusta.com for immediate deletion.
9. International data transfers
Challenge Arena Software FZCO is based in Dubai, United Arab Emirates. Your data may be processed and stored across multiple jurisdictions, including the UAE, the European Union (AWS Paris servers), and the United States (Google, LiveKit). Such transfers are governed by appropriate safeguards (GDPR standard contractual clauses, technical security measures) to ensure equivalent protection.
10. Changes
We may update this policy from time to time. Any material changes will be notified through the app or by email. The current version is always available within the app and at https://orusta.com/en/privacy.
Contact
For any question regarding your data: privacy@orusta.com For any legal inquiry: legal@orusta.com