1. Introduction

Welcome to Brakto ("Company," "we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our tournament management platform at www.brakto.com (the "Service").

By using our Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our policies and practices, please do not use our Service.

2. Information We Collect

2.1 Information You Provide

We collect information that you voluntarily provide when you:

• Create an Account: Name, email address, Google profile information (when using Google OAuth authentication)
• Create Tournaments: Tournament name, sport, dates, venue information, division details
• Register for Tournaments: Player/team names, skill levels, contact information (phone number for SMS notifications)
• Process Payments: Billing information processed securely through Stripe (we do not store credit card numbers)
• Contact Us: Name, email, message content when you use our support or contact forms
• Provide Feedback: Survey responses, feature requests, bug reports

2.2 Information Collected Automatically

When you access our Service, we automatically collect:

• Device Information: IP address, browser type, device type, operating system
• Usage Data: Pages visited, time spent on pages, navigation paths, click data
• Performance Data: Page load times, errors, API response times
• Location Data: General location based on IP address (not precise geolocation)

2.3 Information from Third Parties

We may receive information about you from third-party services:

• Google OAuth: Profile information (name, email, profile picture) when you sign in with Google
• Stripe: Payment status, transaction details, billing information
• Analytics Services: Aggregated usage statistics from Google Analytics

3. How We Use Your Information

We use the information we collect for the following purposes:

• Provide the Service: Create accounts, manage tournaments, process registrations, generate brackets
• Process Payments: Handle tournament registration fees and organizer subscriptions through Stripe
• Communications: Send tournament updates, match schedules, notifications, and promotional emails
• Customer Support: Respond to inquiries, troubleshoot issues, provide technical assistance
• Improve the Service: Analyze usage patterns, test new features, optimize performance
• Security: Detect fraud, prevent abuse, protect against security threats
• Legal Compliance: Comply with applicable laws, regulations, and legal processes
• Marketing: Send newsletters, feature announcements, and promotional content (with opt-out option)

4. How We Share Your Information

We may share your information in the following circumstances:

• With Tournament Organizers: When you register for a tournament, your name and contact information is shared with the organizer
• Publicly Visible: Tournament brackets, player names, scores, and match results are publicly visible
• Service Providers: We share data with trusted third parties who help us operate our Service:
  • Supabase (authentication and database hosting)
  • Stripe (payment processing)
  • AWS (hosting infrastructure)
  • Google Analytics (usage analytics)
  • Email service providers (transactional emails)
  • SMS service providers (text notifications)
• Legal Requirements: When required by law, court order, or government request
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• With Your Consent: When you explicitly agree to share your information

5. Data Security

We implement appropriate technical and organizational measures to protect your personal information:

• Encryption: HTTPS/TLS encryption for data in transit, encryption at rest for sensitive data
• Authentication: Secure Google OAuth authentication with PKCE (Proof Key for Code Exchange)
• Access Controls: Role-based access controls, limited employee access to user data
• Payment Security: PCI-DSS compliant payment processing through Stripe (we never store credit card numbers)
• Regular Audits: Security assessments, vulnerability scanning, penetration testing
• Monitoring: Real-time monitoring for suspicious activity and security incidents

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security.

6. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information (subject to legal obligations)
• Portability: Request a copy of your data in a machine-readable format
• Opt-Out: Unsubscribe from marketing emails or SMS notifications
• Restrict Processing: Request limitation of how we use your information
• Object: Object to processing based on legitimate interests

To exercise these rights, please contact us at privacy@brakto.com. We will respond to your request within 30 days.

7. Data Retention

We retain your personal information for as long as necessary to provide the Service and fulfill the purposes outlined in this Privacy Policy:

• Active Accounts: We retain your account data while your account is active
• Tournament Data: Tournament information is retained indefinitely for historical records
• Deleted Accounts: After account deletion, we retain minimal data for legal compliance (30-90 days)
• Payment Records: Financial transaction records are retained for 7 years for tax and legal purposes
• Analytics Data: Aggregated, anonymized usage data may be retained indefinitely

8. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to improve your experience:

• Essential Cookies: Required for authentication, security, and basic functionality
• Analytics Cookies: Google Analytics to understand how users interact with our Service
• Preference Cookies: Remember your settings and preferences
• Session Cookies: Maintain your login session

You can control cookies through your browser settings. However, disabling cookies may affect the functionality of our Service.

9. Third-Party Services

Our Service integrates with third-party services that have their own privacy policies:

• Google OAuth: Google Privacy Policy
• Stripe: Stripe Privacy Policy
• Supabase: Supabase Privacy Policy

We are not responsible for the privacy practices of third-party websites or services. We encourage you to review their privacy policies.

10. Children's Privacy

Our Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately. If we discover that we have collected information from a child under 13, we will delete that information promptly.

Users between 13 and 18 years old must have parental or guardian consent to use our Service.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that are different from your country's laws.

We take appropriate safeguards to ensure your personal information remains protected in accordance with this Privacy Policy. This includes using Standard Contractual Clauses approved by the European Commission for transfers from the EU/EEA.

12. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: Request disclosure of personal information collected, sources, purposes, and third parties with whom it's shared
• Right to Delete: Request deletion of personal information (subject to exceptions)
• Right to Opt-Out: Opt out of the sale of personal information (we do not sell personal information)
• Right to Non-Discrimination: Not receive discriminatory treatment for exercising your privacy rights

To exercise these rights, contact us at privacy@brakto.com. We will verify your identity before processing your request.

13. European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA) or UK, you have additional rights under the General Data Protection Regulation (GDPR):

• Legal Basis: We process your data based on consent, contractual necessity, legal obligations, or legitimate interests
• Data Protection Officer: Contact our DPO at dpo@brakto.com
• Supervisory Authority: You have the right to lodge a complaint with your local data protection authority
• Automated Decision-Making: We do not use automated decision-making or profiling that significantly affects you

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, regulatory, or operational reasons. We will notify you of material changes by:

• Posting the updated Privacy Policy on this page with a new "Last Updated" date
• Sending an email notification to your registered email address
• Displaying a prominent notice on our Service

Your continued use of the Service after the effective date of the updated Privacy Policy constitutes your acceptance of the changes.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

We will respond to your inquiry within 30 days. For urgent privacy concerns, please indicate "URGENT" in your email subject line.