> For the complete documentation index, see [llms.txt](https://legal.matchely.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://legal.matchely.com/en/privacy.md). # Privacy **Version 2.2.0 — effective 23 July 2026.** Replaces version 2.1.0, also of 23 July 2026. *This is a translation of the Portuguese original. In case of conflict, the Portuguese version prevails.* #### 1. Who controls your data **MATCHELY SPORTS LTDA**, registered under Brazilian company number (CNPJ) 46.264.043/0001-07 ("Matchely", "we"), is the controller of the personal data processed on the Matchely platform. Privacy contact and channel for exercising your rights: **** This Policy explains what personal data we collect, why we collect it, who we share it with, and what your rights are, under Brazilian Law 13.709/2018 (LGPD). #### 2. Data we collect **2.1 Data you provide** **Account and profile:** name, display name, username, email, phone number, date of birth, gender, bio, profile photo and cover image, language. **Location:** country, state, city, neighbourhood, formatted address and **geographic coordinates (latitude and longitude)** of where you play. You may register more than one location. **Sports data:** sports you play, rating and confidence level, years of practice, monthly frequency, competitive level, preferred court side, and peer evaluations you give and receive. **Self-declared physical data:** height, weight, wingspan, dominant hand and foot. These are sport-related figures you declare yourself, not clinical or health data. Matchely does **not** collect health data and has no integration with health apps or wearable devices. **Apparel:** shirt type and size, when you join competitions that provide uniforms. This is shared with the competition organizer. **Payment data:** for paid subscriptions in Brazil we collect **CPF** (Brazilian taxpayer number), name, email and phone, as required by payment providers and by Central Bank regulations for automatic Pix. **We do not store credit card data** — it is collected directly by the payment processors. **Content you create:** chat messages, match photos and videos, YouTube links, competition names and images, and content reports. **Social links:** website, Facebook, Instagram and X/Twitter, if you choose to provide them. **2.2 Data collected automatically** **Technical data:** IP address, browser type and version, operating system, app version, device identifiers, pages visited, date and time of access and last access. **Notification token:** the device identifier used to deliver push notifications, along with the platform (iOS, Android or web). **Acceptance record:** when you accept these documents we record the version accepted, the date and time, the **IP address** and the device **user agent**. This record is kept immutably as evidence of acceptance. **Approximate location from IP:** when you do not grant location permission, we estimate your country from your IP address. **2.3 Data from third parties** If you sign in with Google, Apple or Facebook, we receive your name, email and photo from that provider, according to the permissions you grant it. **2.4 Phone contacts** If you allow access to your phone's address book to find people you know, the app reads the numbers locally and sends our servers **only cryptographic digests (SHA-256 hashes)** of those numbers. **Names and phone numbers from your address book are never sent to or stored by us.** Contacts without a match remain only in your device's memory. #### 3. Why we use it, and on what legal basis | Purpose | Legal basis (LGPD) | | ----------------------------------------------------- | ----------------------------------- | | Create and maintain your account, authenticate access | Performance of contract (art. 7, V) | | Operate competitions, matches, rankings and ratings | Performance of contract (art. 7, V) | | Find opponents and suggest connections | Legitimate interest (art. 7, IX) | | Process subscriptions and entry fees | Performance of contract (art. 7, V) | | Meet tax and regulatory obligations | Legal obligation (art. 7, II) | | Send notifications and emails about your activity | Performance of contract (art. 7, V) | | Send promotional messages | Consent (art. 7, I) | | Security, fraud and abuse prevention | Legitimate interest (art. 7, IX) | | Usage metrics and product improvement | Legitimate interest (art. 7, IX) | | Record of terms acceptance (IP and user agent) | Exercise of rights (art. 7, VI) | #### 4. How visible your data is on the platform This section describes how things actually work today. Please read it carefully. **Profiles are visible to authenticated users.** Anyone with a Matchely account can access your profile information, **including email, phone number and date of birth**. The app offers visibility settings for these fields, but they control **how the information is displayed in the interface** and do not technically prevent access by other authenticated users. We are working to make these controls effective at the data access level; until then, **do not enter data on the platform that you would not want other users to be able to access**. In addition, when you sign up by phone, the visibility of your number is set to public by default. **Public profile page.** If you enable the public profile, we create a page accessible **without login and indexable by search engines** at `/p/{username}`, showing your name, username, bio, photo, cover image, sports, city, state, country and join date. That page does **not** show your phone, email, date of birth or physical data. The public profile is **off by default** for users without recent competitive activity. For users who have played validated matches in the last 12 months (except those under 18), the public profile and the display in **public city/sport rankings** (name, username, photo and points, on indexable pages) may be enabled automatically, with at least 7 days' prior notice and the option to turn it off at any time in Edit Profile. Legal basis: legitimate interest (art. 7, IX, LGPD), with the right to object. **Competitions and matches are public by default**, unless the organizer makes the competition private. Match results belong to all participants. **Search.** To make athlete search possible, we sync to our search index: name, username, photo, sports, city, country, gender, **age derived from date of birth** and **geographic coordinates**. We do not send email, phone, CPF or the date of birth itself. Only users active within the last two and a half years are indexed. #### 5. Who we share with We do not sell your data. We share it with providers that perform functions necessary to operate the service: | Third party | Purpose | What it receives | | ---------------------------------------------- | -------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ | | **Google / Firebase** | Authentication, database, storage, functions, notifications, remote configuration, reCAPTCHA | All platform data | | **Google Maps / Places** | Address search and normalisation | Address text you type | | **Google Analytics** | Usage metrics | Your account identifier, navigation events, IP | | **Google Vertex AI (Gemini)** | AI-assisted match import | **The images and spreadsheets you upload**, from which player names, dates and locations are extracted | | **Our search index** (own server in São Paulo) | Athlete and competition search | See section 4 | | **ZeptoMail (Zoho)** | Transactional emails and sign-in codes | Email, name and message content | | **Mercado Pago** | Competition entries and card subscriptions | Email (subscriptions). For entries, your payment data is collected directly by them | | **Asaas** | Annual PRO subscription via automatic Pix | Name, **CPF**, email, phone | | **EFI Pay** | Previously contracted PRO subscriptions | Name and **CPF** | | **RevenueCat** | In-app purchases | Your account identifier and the store receipt | | **Apple and Google (App Store / Play)** | Purchase processing and notification delivery | Transaction data and device identifiers | | **Meta (Facebook)** | Facebook sign-in | Sign-in data. The Meta component embedded in the Android app may collect device identifiers | | **ImageKit** | Delivery of match images and videos | Uploaded media and the IP of whoever views it | We may also share data to comply with a court order or legal obligation, or to investigate fraud, abuse or risks to people's safety. #### 6. International transfers Part of the processing happens **outside Brazil**, mainly in the United States: our server functions and the artificial intelligence service run in the `us-central1` region. Payment, email and analytics providers may also process data abroad. These transfers rely on the grounds set out in art. 33 of the LGPD, in particular necessity for performance of the contract and the contractual safeguards agreed with our providers. #### 7. How long we keep it We keep your data for as long as your account exists and for as long as needed for the purposes in this Policy or for legal obligations. Some records are **permanent by nature** and are not deleted even on request, because they form part of the shared sporting history and serve as evidence: * match and competition results, which belong to all participants; * evaluations recorded in matches, which also belong to those who took part; * result edit logs; * the terms acceptance record. After account deletion, these records remain associated with your **name** (without photos, contact details or location), analogous to result records kept by sports federations, based on the legitimate interest of the other participants in the integrity of their own histories (LGPD art. 7, IX). #### 8. Your rights At any time you may request: confirmation that processing exists; access to your data; correction of incomplete or outdated data; anonymisation, blocking or deletion of unnecessary data or data processed unlawfully; portability; information about sharing; information about your right to refuse consent; and withdrawal of consent. **How to exercise them:** data access and account deletion are self-service in the app, under **My Account → Data Usage**. For all other requests, write to ****. We respond within 15 days. **A copy of your data (access and portability):** under "Request My Information", you receive by email a secure, single-use link, valid for 24 hours, that generates a file with all the data we hold about you. **About account deletion:** under "Delete My Information", you receive by email a confirmation link, single-use and valid for 24 hours. Upon confirmation, we permanently delete: your photos, contact details (email and phone), location, connections and followers, preferences, rating data and statistics, and your access to the platform. Your profile ceases to exist and leaves search. **Your name and your match and competition records are not deleted**: they are shared records that also belong to your opponents, partners and fellow participants (see section 7). #### 9. Security We use encryption in transit, access control, managed authentication and database access rules. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please also read section 4, which describes current limitations of the visibility controls. #### 10. Children and adolescents The minimum age to use Matchely is **7 years old**. Registering a child **under 12** requires specific, prominent consent from at least one parent or legal guardian, under art. 14, §1 of the LGPD. By registering a child, the guardian confirms they have authority to do so and takes responsibility for the child's use of the platform. We recommend that guardians **keep the public profile disabled** for minors and review the information provided, bearing in mind section 4 on visibility. If we identify an account for a child under 12 without valid consent, we may suspend it until the situation is resolved. To request deletion of a child's data, write to ****. #### 11. Cookies We use cookies and equivalent technologies to keep you signed in, remember preferences and measure usage. Session cookies are necessary for the platform to work. On our marketing website, analytics cookies are only loaded after you accept the cookie notice. #### 12. Changes We may update this Policy. Material changes will be announced on the platform and will require a new acceptance. The version and effective date appear at the top of this document. #### 13. Contact **MATCHELY SPORTS LTDA** — CNPJ 46.264.043/0001-07 **** You may also file a complaint with the Brazilian Data Protection Authority (ANPD).