Privacy Policy

1. General Information

This Privacy Policy describes how livecup.app (hereinafter "LiveCup", "we", "us", or "our"), operated by harbor9, collects, uses, stores, and protects personal data of users of our platform (hereinafter "User", "you", or "your").

LiveCup is a web application for organizing and managing sports tournaments, esports competitions, and other tournament events. By using our services, you agree to the processing of your data as described in this policy.

2. Data Controller

The data controller is harbor9, the operator of livecup.app. Contact information:

• Email: [email protected]
• Website: https://livecup.app
• For data protection inquiries, please contact us at: [email protected]

3. Data We Collect

We collect and process the following categories of personal data:

• Account data: email address, name (optional), password (stored in encrypted/hashed form)
• Payment data: subscription type, payment history, Stripe customer identifier (full payment card data is processed exclusively by Stripe and is never stored on our servers)
• Tournament data: tournament names, team names, team colors, match scores, and other tournament-related content you create
• Technical data: IP address, browser type, device type, operating system — collected automatically during use of our services
• Attribution data: when you arrive from an ad or a link with campaign parameters, we record the source, medium, campaign name, click identifier (e.g. gclid), and the first page you visited

4. Purposes of Data Processing

We process your personal data for the following purposes:

• Providing our services — creating an account, managing tournaments, displaying results
• Processing payments — handling subscriptions and one-time purchases via Stripe
• Customer support — handling inquiries and support tickets
• Platform improvement — analyzing usage to improve the quality of our services
• Marketing measurement — measuring the effectiveness of our advertising campaigns (e.g. Google Ads) and understanding which campaigns bring users to LiveCup; only with your consent

5. Legal Basis for Processing

We process your personal data on the following legal grounds:

• Contract performance — processing is necessary to provide the services you requested (Art. 6(1)(b) GDPR)
• Consent — when you voluntarily create an account and agree to these terms (Art. 6(1)(a) GDPR)
• Legitimate interests — for security, fraud prevention, and service improvement (Art. 6(1)(f) GDPR)
• Legal obligations — when required by applicable law (Art. 6(1)(c) GDPR)
• You can withdraw your consent at any time — cookie consent via the "Cookie settings" option in the page footer, and account-related consent by deleting your account or contacting us at [email protected]

6. Data Sharing

We may share your personal data with the following categories of recipients:

• Stripe, Inc. — for payment processing (Stripe acts as an independent data controller for payment data)
• DigitalOcean, Inc. — for file storage (team logos, sponsor images)
• Other tournament participants — your team name and tournament results are visible to other participants in the same tournament
• Law enforcement — when required by applicable law or valid legal process
• Google Ireland Ltd. / Google LLC — for web analytics (Google Analytics 4) and advertising measurement (Google Ads), only when you consent to analytics or marketing cookies

7. Your Rights

Under GDPR and applicable data protection regulations, you have the following rights:

• Right of access — you can request information about the personal data we hold about you
• Right to rectification — you can correct inaccurate data through your account settings or by contacting us
• Right to erasure — you can request deletion of your account and all associated data
• Right to data portability — you can request a copy of your data in a machine-readable format

8. Cookies and Tracking Technologies

LiveCup uses cookies and similar technologies in three categories: essential cookies required for the service to function (signing in, security, language, storing your consent choices), analytics cookies (Google Analytics 4) that help us understand how the platform is used, and marketing cookies (Google Ads) used to measure the effectiveness of our advertising campaigns.

Analytics and marketing cookies are only set after you give consent through the cookie banner (Google Consent Mode v2). If you decline, Google tags operate without cookies and may send only anonymous, aggregated signals that are not linked to you.

When you arrive at LiveCup from an ad or a campaign link, we store a first-party attribution cookie (lc_attr) containing the campaign parameters and the click identifier. It is used solely to attribute sign-ups and purchases to the campaign that brought you here. If you decline marketing cookies, this cookie is deleted.

You can change or withdraw your cookie choices at any time:

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Passwords are hashed using the bcrypt algorithm and are never stored in plain text
• All communication with livecup.app is encrypted via HTTPS/TLS
• Access to the database is restricted and secured
• Payment data is processed by Stripe, a PCI DSS Level 1 certified payment processor
• Uploaded files are stored on secure, encrypted cloud storage
• We conduct regular security reviews of our infrastructure

10. Data Retention

We keep your personal data for as long as your account is active. Once you request deletion, the account is deactivated immediately and you can restore it within 30 days by signing in. After that period we permanently erase your personal data: email address, name, password, photo, phone number, IP address and attribution data, as well as the team manager contact details collected in your tournaments.

Accounting documents — invoices and payment transaction records — are retained for the period required by tax and accounting law (Art. 17(3)(b) GDPR). Published tournament results, including team names and rosters, remain available because they concern the participants rather than the organiser, and were provided for publication.

11. Children's Privacy

LiveCup is not directed at children under 16 years of age. We do not knowingly collect personal data from children under 16. If you are under 16, you may use LiveCup only with the involvement and consent of a parent or legal guardian. If we become aware that we have inadvertently collected data from a child under 16 without appropriate consent, we will take steps to delete such data promptly.

12. International Data Transfers

Your data may be processed in countries outside the European Economic Area (EEA), particularly in the United States (Stripe, DigitalOcean, Google). In such cases, we ensure appropriate safeguards are in place, including the EU–U.S. Data Privacy Framework and Standard Contractual Clauses (SCCs) approved by the European Commission, to protect your data in accordance with GDPR requirements.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "last updated" date. We encourage you to review this policy periodically. Continued use of LiveCup after changes constitutes your acceptance of the updated policy. For significant changes, we will endeavor to notify you through the platform or via email.