NXT FIGHT: Privacy Policy

Version 1.0 (Phase 1) Effective date: 26 July 2026 Last updated: 14 July 2026

This Privacy Policy explains how FYYTR Sports FZC LLC, which operates the NXT FIGHT platform ("NXT FIGHT", "we", "us", "our"), collects, uses, shares and protects your personal data when you use the NXT FIGHT website (nxtfight.com, app.nxtfight.com) and mobile apps (iOS and Android) (together, the "Platform"). It is written to align with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, "PDPL") and, where it applies to you, the EU/UK GDPR.

By using the Platform you acknowledge this Policy. Please also read our Terms of Service and Liability Waiver.

1. Who we are

NXT FIGHT is a digital network for the UAE fight community: fighters, coaches, gyms, promoters, federations and fans. It provides public profiles, rosters, event listings, discovery/search, verification badges, networking and notifications.

• Data controller: FYYTR Sports FZC LLC, Business Centre, Sharjah Publishing City Free Zone, Sharjah, UAE.
• Privacy contact: privacy@nxtfight.com
• Data-protection contact: Mudassar Khan (Founder, NXT FIGHT), legal@nxtfight.com

2. The data we collect

2.1 Data you give us

Account & identity

• Name, email address, password (stored only as a secure hash; we never see your plain password).
• If you sign in with Google, we receive your name, email and profile picture from Google; we do not receive your Google password.
• Email-verification and password-reset codes (short-lived, stored hashed).

Profile data (varies by role)

• Fighters: age, gender, body weight and weight class, discipline(s), experience level (amateur/professional), city, tagline, bio, achievements, profile and cover photos, gym affiliation, social links (e.g. Instagram, YouTube), and fight record (wins/losses/draws), including data synced from public sources such as BoxRec where you provide it.
• Coaches / gyms / promoters: professional details, roster, facilities and services, location and contact details, media.
• Federation officers: granted by an administrator; used to operate the read-only federation control room.

Media: photos and videos you upload to your profile, gym, or events.

Verification data: documents and information you submit to earn a verification badge (e.g. gym, event, federation or admin verification), including a federation ID where relevant.

Guardian & minor data (fighters aged 16–17): where a fighter is a minor, the parent/legal guardian submits the guardian's name and relationship, the guardian's Emirates ID or passport, the minor's Emirates ID / passport / birth certificate, and a signed parental consent letter. See §11 and the Guardian Consent document.

Sponsor / partner enquiries: if a brand submits the "become a sponsor/partner" form, we collect the business and contact details provided.

Communications: messages you send us for support, and reports you file about other users or content.

2.2 Data we collect automatically

• Device & push tokens: when you enable notifications we store a push token (Expo / Apple APNs / Google FCM) and the device platform (iOS/Android) so we can deliver notifications. Dead tokens are pruned automatically.
• Technical & security data: IP address and request metadata used for rate limiting and abuse prevention, session tokens, and basic diagnostics/logs.
• Usage data: how you interact with the Platform (pages/screens viewed, searches, features used), used to operate and improve the service.

We do not collect precise background location, and in Phase 1 we do not process payment card details ourselves (see §5).

3. Why we use your data (and our legal basis)

Where we rely on consent (e.g. minors, marketing, push notifications) you can withdraw it at any time (§9).

4. Public by design: what others can see

NXT FIGHT is a public professional network. Profiles, rosters, event listings and verification badges are intended to be public and may be visible to other users and, in some cases, to anyone on the internet and to search engines. Do not put anything in a public field that you do not want to be public. You control much of what appears via your profile settings, and unverified fighters/coaches/promoters are hidden from public discovery until an administrator verifies them.

5. Sharing and service providers (sub-processors)

We do not sell your personal data. We share it only:

• With other users / the public, your public profile and related content, by design (§4).

• With service providers who process data on our behalf, under contract:

  Provider	Role	Data involved
  MongoDB Atlas	Primary database hosting	All stored account/profile/content data
  Amazon Web Services (S3)	Media & document storage	Photos, videos, verification/guardian documents
  Ably	Real-time messaging	Notification delivery metadata
  Expo / Apple APNs / Google FCM	Push notifications	Device push tokens
  Resend	Transactional email	Email address, message content
  Google	Sign-in (OAuth)	Name, email, profile picture (if you use Google)
  Apple App Store / Google Play	App distribution	Store-side account & crash data per their policies

• With authorities, when required by law, court order, or to protect the rights, safety and property of users or the public.

• In a business transfer, if we merge with or are acquired by another entity, data may transfer subject to this Policy.

6. International transfers

Some providers process data outside the UAE (e.g. in the EU or US). Where we transfer personal data internationally we use appropriate safeguards as required by the PDPL and, where relevant, GDPR (such as adequacy decisions or contractual clauses).

7. How long we keep it (retention)

• Active accounts: for as long as your account is active.
• After deletion: you can delete your account in-app (Settings → Danger zone) or at app.nxtfight.com/delete-account. When you do, your account and profile are erased immediately and permanently; there is no grace period or reactivation. Residual copies in encrypted backups are purged within 30 days, except for the limited records we must retain (below).
• Verification & guardian-consent documents: retained while the account is active and deleted together with the account when it is deleted. Guardian-consent documents are also deleted as soon as a guardian withdraws consent, whether or not the account is deleted (see Guardian Consent §A5).
• Historical public records: where you appeared on another user's public content before you deleted your account — for example your name on a past event's fight card, or a credit on a news post — a limited snapshot (your public/ring name, and where it was shown, your photo) may remain on that historical record so the record stays intact. It is no longer linked to your account, and you can ask us to remove a specific instance by emailing privacy@nxtfight.com.
• Safety, dispute and legal records: retained as long as needed to handle disputes, enforce our terms, or comply with law.
• Security logs: retained for a limited period for abuse prevention.

8. Security

We protect data with measures including: encryption in transit (HTTPS/TLS), hashed passwords (bcrypt), signed/expiring access tokens, access controls on stored media and documents, rate limiting and abuse detection, and least-privilege access for staff. No system is perfectly secure, but we work to protect your data and will notify you and the relevant authority of a personal-data breach where the law requires.

9. Your rights

Subject to the PDPL and, where applicable, GDPR, you may:

• Access the personal data we hold about you;
• Correct inaccurate data (much of it is editable directly in your profile);
• Delete your account and data ("right to be forgotten");
• Restrict or object to certain processing;
• Withdraw consent where processing relies on it;
• Port your data to another service.

To exercise these rights, use in-app account controls or email privacy@nxtfight.com. You can delete your account in-app/on the web, or at app.nxtfight.com/delete-account. You also have the right to complain to the UAE Data Office (or your local data-protection authority).

10. Content reporting, blocking & moderation

You can report or block content and users. We review reports and may remove content or suspend accounts. We aim to act on serious reports promptly. See the Terms of Service for prohibited content and enforcement.

11. Children and minors

NXT FIGHT is not open to children under 16. Fighters aged 16–17 may use the Platform only with verified parental/guardian consent: the guardian must submit the identity and consent documents described in §2.1, which an administrator reviews and approves before the minor gets normal access. All other roles are 18+. We process a minor's data on the basis of the guardian's consent and to protect the minor. A guardian may withdraw consent at any time by contacting privacy@nxtfight.com; we will then disable the minor's account and delete the guardian and minor identity documents, or delete the account entirely if the guardian asks. If we learn we have collected data from someone under 16, or from a 16–17 minor without valid guardian consent, we will delete it. See the Guardian Consent document.

12. Cookies & similar technologies

The website uses strictly necessary cookies/local storage for sign-in and session management, and basic analytics to operate and improve the service. The mobile apps use device storage and identifiers for the same purposes. You can control cookies through your browser; disabling necessary cookies may break sign-in.

13. Changes to this Policy

We may update this Policy. We will change the "Last updated" date and, for material changes, notify you in-app and/or by email before they take effect. Continued use after the effective date means you accept the updated Policy.

14. Contact

• Privacy: privacy@nxtfight.com
• Support: support@nxtfight.com
• Legal / data protection: legal@nxtfight.com
• Operator: FYYTR Sports FZC LLC, Business Centre, Sharjah Publishing City Free Zone, Sharjah, UAE

Revision history