Privacy Policy
Version 2.5.0 — effective 26 October 2026. Replaces version 2.4.0, of 17 October 2026.
This is a translation of the Portuguese original. In case of conflict, the Portuguese version prevails.
1. Who controls your data
MATCHELY SPORTS LTDA, registered under Brazilian company number (CNPJ) 46.264.043/0001-07 (“Matchely”, “we”), is the controller of the personal data processed on the Matchely platform.
Privacy contact and channel for exercising your rights: socialmedia@matchely.com
This Policy explains what personal data we collect, why we collect it, who we share it with, and what your rights are, under Brazilian Law 13.709/2018 (LGPD).
2. Data we collect
2.1 Data you provide
Account and profile: name, display name, username, email, phone number, date of birth, gender, bio, profile photo and cover image, language.
Location: country, state, city, neighbourhood, formatted address and geographic coordinates (latitude and longitude) of where you play. You may register more than one location.
Sports data: sports you play, rating and confidence level, years of practice, monthly frequency, competitive level, preferred court side, and peer evaluations you give and receive.
Self-declared physical data: height, weight, wingspan, dominant hand and foot. These are sport-related figures you declare yourself, not clinical or health data. Matchely does not collect health data and has no integration with health apps or wearable devices.
Apparel: shirt type and size, when you join competitions that provide uniforms. This is shared with the competition organizer.
Payment data: for paid subscriptions in Brazil we collect CPF (Brazilian taxpayer number), name, email and phone, as required by payment providers and by Central Bank regulations for automatic Pix. We do not store credit card data — it is collected directly by the payment processors.
CPF or CNPJ for entries and bookings: when a competition organizer or a venue requires it, we collect your CPF or CNPJ (and, for a CNPJ, the company name) and share it with that organizer or venue, so they can issue an invoice or receipt. The data is kept in your profile, accessible only to you, until you change it or delete your account. The copy already delivered to the organizer or venue stays with them, as a fiscal record of that entry or booking. When payment goes through Mercado Pago, the CPF entered at checkout may be used for the same purpose.
Content you create: chat messages, match photos and videos, YouTube links, competition names and images, and content reports.
Social links: website, Facebook, Instagram and X/Twitter, if you choose to provide them.
2.2 Data collected automatically
Technical data: IP address, browser type and version, operating system, app version, device identifiers, pages visited, date and time of access and last access.
Notification token: the device identifier used to deliver push notifications, along with the platform (iOS, Android or web).
Acceptance record: when you accept these documents we record the version accepted, the date and time, the IP address and the device user agent. This record is kept immutably as evidence of acceptance.
Approximate location from IP: when you do not grant location permission, we estimate your country from your IP address.
2.3 Data from third parties
If you sign in with Google, Apple or Facebook, we receive your name, email and photo from that provider, according to the permissions you grant it.
2.4 Phone contacts
If you allow access to your phone’s address book to find people you know, the app reads the numbers locally and sends our servers only cryptographic digests (SHA-256 hashes) of those numbers. Names and phone numbers from your address book are never sent to or stored by us. Contacts without a match remain only in your device’s memory.
3. Why we use it, and on what legal basis
| Purpose | Legal basis (LGPD) |
|---|---|
| Create and maintain your account, authenticate access | Performance of contract (art. 7, V) |
| Operate competitions, matches, rankings and ratings | Performance of contract (art. 7, V) |
| Find opponents and suggest connections | Legitimate interest (art. 7, IX) |
| Process subscriptions and entry fees | Performance of contract (art. 7, V) |
| Meet tax and regulatory obligations | Legal obligation (art. 7, II) |
| Messages about your account and your activity: notices about matches, invitations, results, competitions, payments, security and changes to the service | Performance of contract (art. 7, V) |
| Support and relationship: welcome messages, help getting started, reaching out when you seem to have run into a difficulty, replies to your requests and surveys about your experience | Legitimate interest (art. 7, IX), and you may object at any time |
| Promotional messages: offers, plans and news | Consent (art. 7, I) |
| Security, fraud and abuse prevention | Legitimate interest (art. 7, IX) |
| Usage metrics and product improvement | Legitimate interest (art. 7, IX) |
| Record of terms acceptance (IP and user agent) | Exercise of rights (art. 7, VI) |
These messages may reach you in the app, as device notifications, by email, by SMS or through messaging apps such as WhatsApp, using the contact details you gave us. Support and relationship messages may be sent by a person on our team or automatically. You can ask to stop receiving support and relationship messages on any channel by replying to the message itself or writing to socialmedia@matchely.com; messages about your account continue, because they are part of the service.
4. How visible your data is on the platform
Profile. Anyone with a Matchely account can see your name, username, photo, cover image, bio, sports, levels, city, and the matches and competitions you take part in.
Contact details. Your email, phone number and date of birth are stored separately from your profile, in an area that only you and Matchely can access. Other people only receive this data through our servers, which apply your choices:
- Email: never shown to other athletes. The organizer of a competition you have registered for sees your email, to handle your registration and payment.
- Phone (WhatsApp): you choose between Public, People you’ve played with and Organizers only. The organizer of a competition you have registered for always sees your number. Other people allowed by your choice only see the number if they are Matchely PRO subscribers. “People you’ve played with” means anyone who played a match against or with you whose result was validated. When you add your phone, the initial option is People you’ve played with.
- Date of birth: the same three options; the initial option is Organizers only.
- If you block someone, or are blocked by them, that person receives none of your contact details.
Find friends from your contacts. If your phone is set to Public or People you’ve played with, someone who has your number in their address book and uses “Find friends” will find your profile (without seeing the number). With Organizers only, they won’t.
Public profile page. If you enable the public profile, we create a page
accessible without login and indexable by search engines at https://matchely.com/p/{username},
showing your name, username, bio, photo, cover image, sports, city, state, country
and join date. That page does not show your phone, email, date of birth or
physical data. The public profile
is off by default for users without recent competitive activity. For users who have played validated matches in the last 12 months (except those
under 18), the public profile and the display in public city/sport rankings
(name, username, photo and points, on indexable pages) may be enabled
automatically, with at least 7 days’ prior notice and the option to turn it off
at any time in Edit Profile. Legal basis: legitimate interest (art. 7, IX,
LGPD), with the right to object.
Competitions and matches are public by default, unless the organizer makes the competition private. Match results belong to all participants.
Search. To make athlete search possible, we sync to our search index: name, username, photo, sports, city, country, gender and geographic coordinates. We do not send email, phone, CPF, date of birth or age. Only users active within the last two and a half years are indexed.
5. Who we share with
We do not sell your data. We share it with providers that perform functions necessary to operate the service:
| Third party | Purpose | What it receives |
|---|---|---|
| Google / Firebase | Authentication, database, storage, functions, notifications, remote configuration, reCAPTCHA | All platform data |
| Google Maps / Places | Address search and normalisation | Address text you type |
| Google Analytics | Usage metrics | Your account identifier, navigation events, IP |
| Google Vertex AI (Gemini) | AI-assisted match import | The images and spreadsheets you upload, from which player names, dates and locations are extracted |
| Our search index (own server in São Paulo) | Athlete and competition search | See section 4 |
| ZeptoMail (Zoho) | Transactional emails and sign-in codes | Email, name and message content |
| Mercado Pago | Competition entries and card subscriptions | Email (subscriptions). For entries, your payment data is collected directly by them |
| Asaas | Annual PRO subscription via automatic Pix | Name, CPF, email, phone |
| EFI Pay | Previously contracted PRO subscriptions | Name and CPF |
| RevenueCat | In-app purchases | Your account identifier and the store receipt |
| Apple and Google (App Store / Play) | Purchase processing and notification delivery | Transaction data and device identifiers |
| Meta (WhatsApp) | Sending support, relationship and service messages | Name, phone number and message content |
| Meta (Facebook) | Facebook sign-in | Sign-in data. The Meta component embedded in the Android app may collect device identifiers |
| ImageKit | Delivery of match images and videos | Uploaded media and the IP of whoever views it |
| Organizers and venues | Invoices and receipts for paid entries and bookings | Name, CPF or CNPJ and company name, when they require it |
We may also share data to comply with a court order or legal obligation, or to investigate fraud, abuse or risks to people’s safety.
6. International transfers
Part of the processing happens outside Brazil, mainly in the United States:
our server functions and the artificial intelligence service run in the
us-central1 region. Payment, email and analytics providers may also process data
abroad. These transfers rely on the grounds set out in art. 33 of the LGPD, in
particular necessity for performance of the contract and the contractual
safeguards agreed with our providers.
7. How long we keep it
We keep your data for as long as your account exists and for as long as needed for the purposes in this Policy or for legal obligations.
Some records are permanent by nature and are not deleted even on request, because they form part of the shared sporting history and serve as evidence:
- match and competition results, which belong to all participants;
- evaluations recorded in matches, which also belong to those who took part;
- result edit logs;
- the terms acceptance record.
After account deletion, these records remain associated with your name (without photos, contact details or location), analogous to result records kept by sports federations, based on the legitimate interest of the other participants in the integrity of their own histories (LGPD art. 7, IX).
8. Your rights
At any time you may request: confirmation that processing exists; access to your data; correction of incomplete or outdated data; anonymisation, blocking or deletion of unnecessary data or data processed unlawfully; portability; information about sharing; information about your right to refuse consent; and withdrawal of consent.
How to exercise them: data access and account deletion are self-service in the app, under My Account → Data Usage. For all other requests, write to socialmedia@matchely.com. We respond within 15 days.
A copy of your data (access and portability): under “Request My Information”, you receive by email a secure, single-use link, valid for 24 hours, that generates a file with all the data we hold about you.
About account deletion: under “Delete My Information”, you receive by email a confirmation link, single-use and valid for 24 hours. Upon confirmation, we permanently delete: your photos, contact details (email and phone), location, connections and followers, preferences, rating data and statistics, and your access to the platform. Your profile ceases to exist and leaves search. Your name and your match and competition records are not deleted: they are shared records that also belong to your opponents, partners and fellow participants (see section 7).
9. Security
We use encryption in transit, access control, managed authentication and database access rules. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Section 4 describes how your contact details are protected and who can receive them.
10. Children and adolescents
The minimum age to use Matchely is 7 years old.
Registering a child under 12 requires specific, prominent consent from at least one parent or legal guardian, under art. 14, §1 of the LGPD. By registering a child, the guardian confirms they have authority to do so and takes responsibility for the child’s use of the platform.
We recommend that guardians keep the public profile disabled for minors and review the information provided, bearing in mind section 4 on visibility.
If we identify an account for a child under 12 without valid consent, we may suspend it until the situation is resolved. To request deletion of a child’s data, write to socialmedia@matchely.com.
11. Cookies
We use cookies and equivalent technologies to keep you signed in, remember preferences and measure usage. Session cookies are necessary for the platform to work. On our marketing website, analytics cookies are only loaded after you accept the cookie notice.
12. Changes
We may update this Policy. Material changes will be announced on the platform and will require a new acceptance. The version and effective date appear at the top of this document.
13. Contact
MATCHELY SPORTS LTDA — CNPJ 46.264.043/0001-07 socialmedia@matchely.com
You may also file a complaint with the Brazilian Data Protection Authority (ANPD).