Privacy

Matchely Privacy Policy

Version 2.2.0 — effective 23 July 2026. Replaces version 2.1.0, also of 23 July 2026.

This is a translation of the Portuguese original. In case of conflict, the Portuguese version prevails.

1. Who controls your data

MATCHELY SPORTS LTDA, registered under Brazilian company number (CNPJ) 46.264.043/0001-07 ("Matchely", "we"), is the controller of the personal data processed on the Matchely platform.

Privacy contact and channel for exercising your rights: [e-mail]

This Policy explains what personal data we collect, why we collect it, who we share it with, and what your rights are, under Brazilian Law 13.709/2018 (LGPD).

2. Data we collect

2.1 Data you provide

Account and profile: name, display name, username, email, phone number, date of birth, gender, bio, profile photo and cover image, language.

Location: country, state, city, neighbourhood, formatted address and geographic coordinates (latitude and longitude) of where you play. You may register more than one location.

Sports data: sports you play, rating and confidence level, years of practice, monthly frequency, competitive level, preferred court side, and peer evaluations you give and receive.

Self-declared physical data: height, weight, wingspan, dominant hand and foot. These are sport-related figures you declare yourself, not clinical or health data. Matchely does not collect health data and has no integration with health apps or wearable devices.

Apparel: shirt type and size, when you join competitions that provide uniforms. This is shared with the competition organizer.

Payment data: for paid subscriptions in Brazil we collect CPF (Brazilian taxpayer number), name, email and phone, as required by payment providers and by Central Bank regulations for automatic Pix. We do not store credit card data — it is collected directly by the payment processors.

Content you create: chat messages, match photos and videos, YouTube links, competition names and images, and content reports.

Social links: website, Facebook, Instagram and X/Twitter, if you choose to provide them.

2.2 Data collected automatically

Technical data: IP address, browser type and version, operating system, app version, device identifiers, pages visited, date and time of access and last access.

Notification token: the device identifier used to deliver push notifications, along with the platform (iOS, Android or web).

Acceptance record: when you accept these documents we record the version accepted, the date and time, the IP address and the device user agent. This record is kept immutably as evidence of acceptance.

Approximate location from IP: when you do not grant location permission, we estimate your country from your IP address.

2.3 Data from third parties

If you sign in with Google, Apple or Facebook, we receive your name, email and photo from that provider, according to the permissions you grant it.

2.4 Phone contacts

If you allow access to your phone's address book to find people you know, the app reads the numbers locally and sends our servers only cryptographic digests (SHA-256 hashes) of those numbers. Names and phone numbers from your address book are never sent to or stored by us. Contacts without a match remain only in your device's memory.

3. Why we use it, and on what legal basis

Purpose	Legal basis (LGPD)
Create and maintain your account, authenticate access	Performance of contract (art. 7, V)
Operate competitions, matches, rankings and ratings	Performance of contract (art. 7, V)
Find opponents and suggest connections	Legitimate interest (art. 7, IX)
Process subscriptions and entry fees	Performance of contract (art. 7, V)
Meet tax and regulatory obligations	Legal obligation (art. 7, II)
Send notifications and emails about your activity	Performance of contract (art. 7, V)
Send promotional messages	Consent (art. 7, I)
Security, fraud and abuse prevention	Legitimate interest (art. 7, IX)
Usage metrics and product improvement	Legitimate interest (art. 7, IX)
Record of terms acceptance (IP and user agent)	Exercise of rights (art. 7, VI)

4. How visible your data is on the platform

This section describes how things actually work today. Please read it carefully.

Profiles are visible to authenticated users. Anyone with a Matchely account can access your profile information, including email, phone number and date of birth. The app offers visibility settings for these fields, but they control how the information is displayed in the interface and do not technically prevent access by other authenticated users. We are working to make these controls effective at the data access level; until then, do not enter data on the platform that you would not want other users to be able to access.

In addition, when you sign up by phone, the visibility of your number is set to public by default.

Public profile page. If you enable the public profile, we create a page accessible without login and indexable by search engines at https://matchely.com/p/{username}, showing your name, username, bio, photo, cover image, sports, city, state, country and join date. That page does not show your phone, email, date of birth or physical data. The public profile is off by default for users without recent competitive activity. For users who have played validated matches in the last 12 months (except those under 18), the public profile and the display in public city/sport rankings (name, username, photo and points, on indexable pages) may be enabled automatically, with at least 7 days' prior notice and the option to turn it off at any time in Edit Profile. Legal basis: legitimate interest (art. 7, IX, LGPD), with the right to object.

Competitions and matches are public by default, unless the organizer makes the competition private. Match results belong to all participants.

Search. To make athlete search possible, we sync to our search index: name, username, photo, sports, city, country, gender, age derived from date of birth and geographic coordinates. We do not send email, phone, CPF or the date of birth itself. Only users active within the last two and a half years are indexed.

5. Who we share with

We do not sell your data. We share it with providers that perform functions necessary to operate the service:

Third party	Purpose	What it receives
Google / Firebase	Authentication, database, storage, functions, notifications, remote configuration, reCAPTCHA	All platform data
Google Maps / Places	Address search and normalisation	Address text you type
Google Analytics	Usage metrics	Your account identifier, navigation events, IP
Google Vertex AI (Gemini)	AI-assisted match import	The images and spreadsheets you upload, from which player names, dates and locations are extracted
Our search index (own server in São Paulo)	Athlete and competition search	See section 4
ZeptoMail (Zoho)	Transactional emails and sign-in codes	Email, name and message content
Mercado Pago	Competition entries and card subscriptions	Email (subscriptions). For entries, your payment data is collected directly by them
Asaas	Annual PRO subscription via automatic Pix	Name, CPF, email, phone
EFI Pay	Previously contracted PRO subscriptions	Name and CPF
RevenueCat	In-app purchases	Your account identifier and the store receipt
Apple and Google (App Store / Play)	Purchase processing and notification delivery	Transaction data and device identifiers
Meta (Facebook)	Facebook sign-in	Sign-in data. The Meta component embedded in the Android app may collect device identifiers
ImageKit	Delivery of match images and videos	Uploaded media and the IP of whoever views it

We may also share data to comply with a court order or legal obligation, or to investigate fraud, abuse or risks to people's safety.

6. International transfers

Part of the processing happens outside Brazil, mainly in the United States: our server functions and the artificial intelligence service run in the us-central1 region. Payment, email and analytics providers may also process data abroad. These transfers rely on the grounds set out in art. 33 of the LGPD, in particular necessity for performance of the contract and the contractual safeguards agreed with our providers.

7. How long we keep it

We keep your data for as long as your account exists and for as long as needed for the purposes in this Policy or for legal obligations.

Some records are permanent by nature and are not deleted even on request, because they form part of the shared sporting history and serve as evidence:

• match and competition results, which belong to all participants;

• evaluations recorded in matches, which also belong to those who took part;

• result edit logs;

• the terms acceptance record.

After account deletion, these records remain associated with your name (without photos, contact details or location), analogous to result records kept by sports federations, based on the legitimate interest of the other participants in the integrity of their own histories (LGPD art. 7, IX).

8. Your rights

At any time you may request: confirmation that processing exists; access to your data; correction of incomplete or outdated data; anonymisation, blocking or deletion of unnecessary data or data processed unlawfully; portability; information about sharing; information about your right to refuse consent; and withdrawal of consent.

How to exercise them: data access and account deletion are self-service in the app, under My Account → Data Usage. For all other requests, write to [e-mail]. We respond within 15 days.

A copy of your data (access and portability): under "Request My Information", you receive by email a secure, single-use link, valid for 24 hours, that generates a file with all the data we hold about you.

About account deletion: under "Delete My Information", you receive by email a confirmation link, single-use and valid for 24 hours. Upon confirmation, we permanently delete: your photos, contact details (email and phone), location, connections and followers, preferences, rating data and statistics, and your access to the platform. Your profile ceases to exist and leaves search. Your name and your match and competition records are not deleted: they are shared records that also belong to your opponents, partners and fellow participants (see section 7).

9. Security

We use encryption in transit, access control, managed authentication and database access rules. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please also read section 4, which describes current limitations of the visibility controls.

10. Children and adolescents

The minimum age to use Matchely is 7 years old.

Registering a child under 12 requires specific, prominent consent from at least one parent or legal guardian, under art. 14, §1 of the LGPD. By registering a child, the guardian confirms they have authority to do so and takes responsibility for the child's use of the platform.

We recommend that guardians keep the public profile disabled for minors and review the information provided, bearing in mind section 4 on visibility.

If we identify an account for a child under 12 without valid consent, we may suspend it until the situation is resolved. To request deletion of a child's data, write to [e-mail].

11. Cookies

We use cookies and equivalent technologies to keep you signed in, remember preferences and measure usage. Session cookies are necessary for the platform to work. On our marketing website, analytics cookies are only loaded after you accept the cookie notice.

12. Changes

We may update this Policy. Material changes will be announced on the platform and will require a new acceptance. The version and effective date appear at the top of this document.

13. Contact

MATCHELY SPORTS LTDA — CNPJ 46.264.043/0001-07 [e-mail]

You may also file a complaint with the Brazilian Data Protection Authority (ANPD).