Privacy Policy

Last updated: June 7, 2026

1. Who we are

Torneyo is a sports championship management platform operated by Torneyo Tecnologia Ltda. ("we", "our", or "Torneyo"). This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our services, website, and application.

2. Data we collect

We may collect the following types of personal data:

• Account data: full name, email, phone number, date of birth, tax ID, profile photo, and address.
• Athlete data: position, height, weight, jersey number, match history, statistics (goals, cards, assists), documents (ID, medical certificate, photo).
• Payment data: billing information and transactions processed through payment partners (Stripe). We do not store credit card numbers.
• Usage data: IP address, browser type, pages visited, session duration, platform interactions.
• Location data: approximate geolocation (city/state) for classification and local championship purposes.
• Cookies and similar technologies: we use cookies for authentication, language preferences, and usage analytics.

3. Legal basis for processing

We process your personal data based on the following legal grounds, in accordance with the GDPR (Regulation EU 2016/679), the Brazilian LGPD (Law 13.709/2018), and the California Consumer Privacy Act (CCPA):

• Contract performance: to provide the contracted platform services.
• Consent: for marketing communications and collection of sensitive data when applicable.
• Legal obligation: to comply with tax, accounting, and regulatory obligations.
• Legitimate interest: to improve our services, prevent fraud, and ensure platform security.

4. How we use your data

We use your data to:

• Create and manage your account and athlete/organizer profile.
• Operate the platform: generate brackets, scoresheets, standings, and statistics.
• Process payments and subscriptions.
• Send notifications about matches, results, and call-ups.
• Improve and personalize the user experience.
• Comply with legal and regulatory obligations.
• Prevent fraud and abuse on the platform.

5. Data sharing

We share your data with:

• Championship organizers: your athlete data (name, position, statistics) is visible to the organizer of the championship you participate in.
• Payment processors: Stripe for processing financial transactions.
• Infrastructure providers: Vercel (hosting), PostgreSQL (database), Cloudflare (CDN and security).
• Legal authorities: when required by law, court order, or valid government request.

We do not sell your personal data to third parties. For California residents, we do not sell personal information as defined by the CCPA.

6. International transfers

Your data may be processed on servers located in Brazil, the United States, and the European Union. We adopt standard contractual clauses (SCCs) and other appropriate safeguards to ensure your data receives the same level of protection required by the GDPR, LGPD, and CCPA.

7. Data retention

We retain your personal data for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required by law. Data from canceled accounts is deleted or anonymized within 90 days of closure, except when retention is required to comply with legal obligations (e.g., tax records for 5 years).

8. Your rights

You have the following rights regarding your personal data:

• Confirmation and access: know whether we process your data and access it.
• Correction: correct incomplete, inaccurate, or outdated data.
• Deletion: request deletion of your data (right to be forgotten).
• Portability: request transfer of your data to another provider.
• Withdrawal of consent: withdraw your consent at any time.
• Objection: object to processing for direct marketing purposes.
• Non-discrimination (CCPA): we will not discriminate against you for exercising your CCPA rights.

To exercise your rights, contact us at contato@torneyo.com. We will respond within 30 days (GDPR) or 15 business days (LGPD). California residents may also designate an authorized agent to submit requests on their behalf.

9. Cookies

We use essential cookies for platform operation (authentication, session, language preferences). We also use analytical cookies (Vercel Analytics) to understand site usage. You can configure your browser to reject cookies, but some features may be affected.

10. Security

We adopt technical and organizational measures to protect your data against unauthorized access, destruction, loss, or alteration, including: TLS/SSL encryption in transit, encryption at rest, role-based access controls, security monitoring, and access auditing.

11. Children's data

Torneyo may collect data from minor athletes (minimum age of 13), subject to consent from a parent or legal guardian. Data from minors is processed with additional protection and is never used for marketing purposes without explicit parental authorization. In compliance with COPPA (Children's Online Privacy Protection Act), we obtain verifiable parental consent before collecting personal information from children under 13.

12. Data Protection Officer (DPO)

For questions regarding this Privacy Policy or the processing of your data, contact our Data Protection Officer:

Email: dpo@torneyo.com
Address: Av. das Nações Unidas, 14.401, São Paulo - SP, Brazil

13. Changes to this policy

We may update this Privacy Policy periodically. We will notify users of significant changes by email or through a notice on the platform. We recommend reviewing this page regularly.

14. Governing law

This Privacy Policy is governed by the EU General Data Protection Regulation (GDPR — Regulation EU 2016/679), the California Consumer Privacy Act (CCPA), and, for users in Brazil, by the Lei Geral de Proteção de Dados (LGPD — Law 13.709/2018). For users in Mexico, the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP) applies.