Privacy Policy

1. Information We Collect

1.1 Information You Provide Directly

When organizers are onboarded through our License Agreement invite flow or create accounts, we may collect:

• Full legal name, organization name, job title, and business address (captured during the electronic signing of the EloSeed License Agreement).
• Email address, used as the primary account identifier and for sending magic-link sign-in URLs, executed agreement copies, and operational notices.
• Brand assets uploaded to your circuit, including logo files stored in our Supabase-hosted private storage buckets.
• Tournament content entered into the platform: seeding rosters with player handles and rank data, standings, brackets, rulebooks, penalty logs, and event results.
• Internal admin manuals or guides uploaded to the private Admin Rulebook tab (PDF, TXT, or MD files, stored in a private bucket).
• Team registration submissions, including team name, player handles, and rank selections submitted via the /c/[slug]/register form.
• Start.gg API tokens (where an organizer elects to use a per-circuit override token), stored encrypted at rest using AES-256-GCM.

1.2 Information Collected Automatically

We and our infrastructure providers automatically collect certain information when you interact with the Services:

• Usage and analytics data: each public demo or circuit page open is logged with the circuit slug and a timestamp. No personally identifiable information (PII) is attached to these beacon events.
• IP addresses associated with team registration submissions are hashed before storage and are never stored or logged in raw form.
• Server logs generated by our hosting provider (Vercel) and database provider (Supabase), which may include request metadata such as IP addresses, browser user-agent strings, and accessed URLs, retained per those providers’ standard policies.
• Authentication session tokens managed by Supabase Auth, stored in browser cookies to maintain signed-in state.

1.3 Information from Third Parties

If an organizer connects a Start.gg account via our integration:

• We query the Start.gg GraphQL API using a platform-level EloSeed admin token to retrieve tournament event data, including entrant names, seeding positions, and match results. This data is stored in your circuit’s content records.
• We do not access or store Start.gg user passwords or payment information.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Providing the Services: operating organizer consoles, rendering public circuit pages, processing team registrations, generating seeding and bracket data, and storing circuit content.
• Account management: sending magic-link sign-in emails, onboarding wizard communications, and organizer invitation emails via the Resend email delivery service.
• License Agreement execution: generating, storing, and emailing executed PDF copies of the EloSeed License Agreement to organizers and to the EloSeed operator.
• Platform analytics: aggregating public page-open counts by circuit slug to surface usage data to internal EloSeed staff via the /admin/analytics dashboard.
• Security and abuse prevention: the hashed IP addresses associated with registration submissions support a rate-limiting mechanism (5 submissions per minute per IP per circuit) to prevent automated abuse.
• Legal compliance and enforcement: maintaining records necessary to honor our contractual obligations and enforce the terms of the License Agreement.
• Improving the Services: understanding how organizers use platform features in order to guide product development.

3. How We Share Your Information

We do not sell your personal information. We may share information in the following limited circumstances:

3.1 Service Providers

We engage sub-processors to operate the Services, including:

• Supabase (database, authentication, and object storage) – hosts all platform data, including organizer records, circuit content, stored PDFs, and authentication tokens.
• Vercel (hosting and serverless compute) – serves all web routes and Next.js server actions.
• Resend (transactional email) – delivers invite, magic-link, and agreement-copy emails. Email content may include your name, organization, and the executed PDF as an attachment.
• Start.gg (third-party integration, optional) – queried on your behalf when you use the Start.gg integration; Start.gg’s own privacy policy governs their data practices.

3.2 Legal Requirements

We may disclose information if we believe in good faith that doing so is required to: (a) comply with applicable law or legal process; (b) protect the rights, property, or safety of EloSeed, our users, or the public; or (c) enforce our agreements.

3.3 Business Transfers

If EloSeed is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your personal information is transferred and becomes subject to a different privacy policy.

3.4 With Your Consent

We may share your information for any other purpose with your explicit consent.

4. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Policy, unless a longer retention period is required by law:

• Organizer account data and License Agreement records are retained for the duration of the organizer’s agreement with EloSeed and for a commercially reasonable period thereafter to satisfy legal and audit obligations.
• Team registration records, including hashed IP addresses and roster submissions, are retained for the lifecycle of the relevant circuit.
• Executed agreement PDFs stored in the private “agreements” Supabase Storage bucket are retained as legal records.
• Anonymous page-open analytics (slug + timestamp) are retained indefinitely in aggregated form.

You may request deletion of your personal data as described in Section 6.

5. Data Security

We implement reasonable technical and organizational measures to protect your information, including:

• Row-Level Security (RLS) policies enforced at the Postgres database layer, ensuring organizers can only access their own circuit data.
• Separate service-role and anon-key Supabase clients: the service-role client (which bypasses RLS) is used exclusively in server-side code marked server-only and is never exposed to browser-side requests.
• AES-256-GCM encryption at rest for any per-organizer Start.gg API tokens stored in the database.
• IP address hashing before storage for rate-limiting records.
• Private Supabase Storage buckets (not publicly accessible) for executed agreements and internal admin guides; access is mediated through short-lived signed URLs generated server-side.

No security system is impenetrable. We cannot guarantee absolute security of your information.

6. Your Rights and Choices

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate personal information.
• Request deletion of your personal information, subject to our legal retention obligations.
• Object to or restrict certain processing activities.
• Data portability (receiving your data in a structured, machine-readable format).

To exercise any of these rights, please contact us at support@eloseed.gg. We will respond within the timeframe required by applicable law. Organizers wishing to terminate their account should also refer to the termination provisions in the EloSeed License Agreement.

7. Cookies and Tracking

The Services use browser cookies primarily to maintain authenticated sessions (managed by Supabase Auth’s SSR library). We do not use third-party advertising cookies or behavioral tracking cookies. The anonymous analytics beacon (/api/track) does not set cookies.

8. Children’s Privacy

The Services are not directed to individuals under the age of 13 (or 16 in certain jurisdictions). We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us and we will take steps to delete it.

9. International Data Transfers

EloSeed is operated from the United States. If you access the Services from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers maintain facilities. By using the Services, you consent to such transfers to the extent permitted by applicable law.

10. Third-Party Links and Services

The Services may contain links to third-party websites, including Discord channels linked via the “Report a problem” feature in the public Rulebook tab, or Start.gg registration pages. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you access.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify organizers of material changes by email (to the address on file) or by posting a notice within the platform. The “Effective Date” at the top of this Policy indicates when it was last revised. Continued use of the Services after the effective date of a revised Policy constitutes your acceptance of the changes.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our privacy practices, please contact us at:

L8TENCY, LLC (operating as EloSeed)
Email: support@eloseed.gg
Website: https://eloseed.gg