Privacy Policy — MatchPoint
Last updated: 31 May 2026
This Privacy Policy explains how MatchPoint ("we", "us", "our"), operated by Gracile Pereira, a sole trader in the United Kingdom, collects and uses personal data. We are the data controller for the personal data described below, except where stated otherwise. For data protection questions, contact [email protected].
1. What data we collect
Account data (organisers): your name, email address, and a hashed password when you register. We never store your password in readable form.
Payment data: when you pay, our payment processor Stripe handles your card details directly. We do not receive or store your full card number. We store a record of your plan/subscription status and payment status, and Stripe holds the billing information under its own privacy policy.
Participant data (entered by organisers): organisers may enter participants' names and, optionally, club affiliation or email, in order to run a tournament. This data is displayed within the tournament and on the public results page (names and results only — not emails).
Technical data: basic information such as your IP address, browser type, and log data, used to operate and secure the Service. If we use anti-spam tools (such as reCAPTCHA) or analytics, those are described in our Cookie notice.
2. How we use data (and our lawful basis)
- To provide the Service and your account — performance of a contract.
- To process payments and manage subscriptions — performance of a contract.
- To secure the Service, prevent abuse, and fix problems — legitimate interests.
- To respond to your enquiries (e.g. the contact form) — legitimate interests.
- To comply with legal and tax obligations — legal obligation.
3. Participant data — roles and responsibilities
Organisers enter participant information. The organiser is responsible for having a lawful basis to provide that information and for informing participants as required. We process this data on the basis of providing the Service and our legitimate interest in operating it. We only display participant names and results publicly (via the shareable tournament code); we do not publish participant email addresses. If you are a participant and want your data corrected or removed, contact the organiser of your tournament, or contact us at [email protected] and we will assist.
4. Sharing data
We do not sell your data. We share data only with:
- Stripe (payment processing),
- Our hosting provider (Hostinger) which stores the application and database,
- Email/anti-spam providers if used (e.g. for sending receipts or preventing spam), and where required by law. These providers process data on our behalf under appropriate safeguards.
5. The public tournament page
Each tournament has a shareable code linking to a public, read-only page showing the schedule, standings, bracket, and results. It displays participant display names and scores only. It does not show organiser or participant email addresses, payment information, or account details.
6. Data retention
We keep account and tournament data while your account is active and as needed to provide the Service. We keep payment records as required for tax and accounting purposes (typically several years under UK law). You may request deletion of your account; we will delete or anonymise personal data that we are not legally required to keep.
7. Your rights (UK GDPR)
You have the right to access, correct, delete, or restrict processing of your personal data, to object to processing, and to data portability. To exercise these, email [email protected]. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.
8. Security
We use reasonable technical and organisational measures to protect personal data, including encrypted connections (HTTPS) and hashed passwords. No system is perfectly secure, but we take protecting your data seriously.
9. International transfers
Our providers (such as Stripe) may process data outside the UK. Where they do, they rely on appropriate safeguards (such as standard contractual clauses) to protect your data.
10. Children
The Service is intended for organisers aged 18 or over. We do not knowingly collect account data from children. Participant names entered by organisers may include minors (e.g. junior tournaments); organisers are responsible for the lawful basis for entering such data.
11. Changes
We may update this policy; we will change the "Last updated" date and, for material changes, take reasonable steps to notify you.