Privacy Policy

1. Introduction

Welcome to Brakto ("Company," "we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our tournament management platform at www.brakto.com (the "Service").

Brakto is a tournament management platform for creating and running tournaments, leagues, and voting contests — from online registration and payments to brackets, live scoring, and published results.

By using our Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our policies and practices, please do not use our Service. Brakto is operated by Filantus LLC.

2. Information We Collect

2.1 Information You Provide

We collect information that you voluntarily provide when you:

• Create an Account: Name, email address, Google profile information (when using Google OAuth authentication)
• Create Tournaments: Tournament name, sport, dates, venue information, division details
• Register for Tournaments: Player/team names, skill levels, contact information (phone number for SMS notifications)
• Process Payments: Billing information processed securely through Stripe (we do not store credit card numbers)
• Contact Us: Name, email, message content when you use our support or contact forms
• Provide Feedback: Survey responses, feature requests, bug reports

2.2 Information Collected Automatically

When you access our Service, we automatically collect:

• Device Information: IP address, browser type, device type, operating system
• Usage Data: Pages visited, time spent on pages, navigation paths, click data
• Performance Data: Page load times, errors, API response times
• Location Data: General location based on IP address (not precise geolocation)

2.3 Information from Third Parties

We may receive information about you from third-party services:

• Google OAuth: Profile information (name, email, profile picture) when you sign in with Google
• Stripe: Payment status, transaction details, billing information
• Analytics Services: Aggregated usage statistics from Google Analytics

2.4 Google User Data and Google API Services

When you sign in with Google, we access limited Google user data through Google's OAuth 2.0 APIs. We request only the information needed to create and secure your account.

• Data we access: Your basic Google profile — name, email address, profile picture, and Google account ID.
• How we use it: Solely to authenticate you, create and manage your Brakto account, display your name and avatar, and send account-related emails. We do not use Google user data for advertising, and we do not use it to train generalized artificial intelligence or machine learning models.
• How we share it: We do not sell Google user data and we do not share it with third parties except our service providers (such as authentication, hosting, and email delivery) acting on our behalf, or when required by law. See Section 4 for details.
• Storage and security: Google user data is stored on encrypted infrastructure and protected by the access controls described in Section 6.
• Revoking access: You can revoke Brakto's access to your Google account at any time from your Google Account permissions page at myaccount.google.com/permissions. You may also request deletion of your Brakto account and associated data by emailing privacy@brakto.com.

Brakto's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Service Delivery

• Create and manage your user account
• Process tournament registrations and payments
• Generate and manage tournament brackets
• Assign court numbers and match schedules
• Send match notifications via email and SMS
• Manage waitlists and notify users of availability
• Track scores and update live brackets

3.2 Communication

• Send transactional emails (registration confirmations, receipts, match schedules)
• Send SMS notifications for match times and court assignments
• Respond to your inquiries and support requests
• Send important Service updates and security alerts
• Send marketing emails about new features (you can opt out)

3.3 Improvement and Analytics

• Analyze usage patterns to improve the Service
• Monitor performance and fix technical issues
• Develop new features based on user feedback
• Conduct internal research and analytics
• Detect and prevent fraud or abuse

3.4 Legal Compliance

• Comply with legal obligations and regulations
• Enforce our Terms of Service
• Protect our rights, property, and safety
• Respond to legal requests and prevent illegal activity

4. Third-Party Services and Data Sharing

We use the following third-party services to operate our platform:

4.1 When We Share Your Information

We may share your information in the following circumstances:

• With Service Providers: Third-party vendors who perform services on our behalf (payment processing, email delivery, analytics)
• With Tournament Organizers: When you register for a tournament, your registration information is shared with the tournament organizer
• With Other Participants: Tournament brackets and match schedules are publicly visible to all tournament participants
• For Legal Reasons: When required by law, court order, or governmental request
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• With Your Consent: When you explicitly authorize us to share your information

4.2 What We Don't Share

5. Data Retention

We retain your personal information for as long as necessary to provide the Service and fulfill the purposes outlined in this Privacy Policy:

• Account Information: Retained while your account is active and for 2 years after account closure
• Tournament Data: Retained for 5 years after tournament completion for historical records
• Payment Records: Retained for 7 years to comply with tax and accounting regulations
• Communication Logs: Retained for 2 years for customer support purposes
• Analytics Data: Aggregated and anonymized data may be retained indefinitely

You may request deletion of your personal information at any time by contacting us. We will comply with deletion requests subject to legal retention requirements.

6. Data Security

We implement industry-standard security measures to protect your personal information:

• Encryption: All data transmitted between your browser and our servers is encrypted using TLS/SSL
• Database Security: Our database is hosted on Supabase with encryption at rest
• Access Controls: Access to personal information is restricted to authorized personnel only
• Payment Security: We use Stripe for PCI-compliant payment processing; we never store credit card numbers
• Rate Limiting: We implement rate limiting to prevent abuse and unauthorized access
• Security Monitoring: We monitor our systems for suspicious activity and security threats
• Regular Backups: We maintain regular backups of your data to prevent data loss

7. Your Privacy Rights

7.1 General Rights

You have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information (subject to legal requirements)
• Portability: Request a copy of your data in a machine-readable format
• Restriction: Request restriction of processing your personal information
• Objection: Object to our processing of your personal information
• Withdraw Consent: Withdraw consent for processing where we rely on consent

7.2 GDPR Rights (European Users)

If you are located in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR):

• The right to lodge a complaint with your local data protection authority
• The right to be informed about how your data is being processed
• The right to have your data erased under certain circumstances ("right to be forgotten")
• The right to data portability in a structured, commonly used format

7.3 CCPA Rights (California Users)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA):

• Right to Know: Request information about the categories and specific pieces of personal information we collect
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Opt out of the sale of your personal information (note: we do not sell personal information)
• Right to Non-Discrimination: You will not be discriminated against for exercising your privacy rights

7.4 Exercising Your Rights

To exercise any of your privacy rights, please contact us at privacy@brakto.com. We will respond to your request within 30 days. You may need to verify your identity before we can process your request.

8. Cookies and Tracking Technologies

8.1 What Are Cookies?

Cookies are small text files stored on your device that help us provide and improve the Service. We use both session cookies (deleted when you close your browser) and persistent cookies (remain on your device until deleted).

8.2 Types of Cookies We Use

• Essential Cookies: Required for authentication, security, and basic Service functionality (cannot be disabled)
• Analytics Cookies: Help us understand how users interact with the Service (Google Analytics)
• Preference Cookies: Remember your settings and preferences
• Authentication Cookies: Keep you logged in between sessions (Clerk)

8.3 Managing Cookies

You can control cookies through your browser settings. Most browsers allow you to refuse cookies or delete existing cookies. However, disabling essential cookies may prevent you from using certain features of the Service.

To opt out of Google Analytics tracking, visit: Google Analytics Opt-out Browser Add-on

9. Children's Privacy

Our Service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you are under 13, please do not provide any information on our Service.

If we learn that we have collected personal information from a child under 13 without parental consent, we will delete that information immediately. If you believe we have collected information from a child under 13, please contact us at privacy@brakto.com.

For users between 13 and 18 years old, we recommend obtaining parental permission before creating an account or providing personal information.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that differ from the laws of your country.

We use the following safeguards for international data transfers:

• Our service providers (Google, Clerk, Stripe, AWS, Supabase, Twilio) comply with international data protection frameworks
• Data is encrypted during transit and at rest
• We use Standard Contractual Clauses (SCCs) where applicable
• We conduct due diligence on third-party processors

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will notify you of material changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last Updated" date at the top of this page
• Sending an email notification to your registered email address (for significant changes)
• Displaying a prominent notice on our Service

Your continued use of the Service after we post modifications constitutes your acceptance of the updated Privacy Policy. We encourage you to review this Privacy Policy periodically.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: