Privacy Policy

1. Overview

Scrimlog, owned by Mathias Rumler, operates the scrimlog.com website and platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website or use our services, in accordance with the EU General Data Protection Regulation (GDPR) and the Austria Federal Data Protection Act (BDSG).

2. Data Controller

The data controller responsible for processing your personal data is:

Scrimlog Owner / Inhaber: Mathias Rumler Sole proprietorship / Einzelunternehmen Wr. Neustädter Straße 107 2601 Sollenau Austria

For additional provider information, see our Imprint. For data protection inquiries, please contact us at support@scrimlog.com.

3. Data We Collect

We collect the following categories of personal data:

• Account data: name, email address, password (hashed), profile information, login history, and linked account information
• Team data: team name, roster information, champion pools, coaching notes, availability, schedules, scrims, compositions, match statistics, and team settings
• Connected account data: provider name, provider user ID, provider email, display name, avatar URL, verification status, provider metadata, and when the linked account was last used
• Riot account and game data: Riot ID, region, PUUID, summoner ID, rank snapshots, sync status, imported match data, and statistics derived from Riot data or files you upload
• Optional analytics and advertising data, only with the relevant consent: visits to permitted pages, selected interactions, browser and device context, cookie identifiers, and sanitized page and referrer information
• Technical data: IP address, browser type, device information, operating system, log data, error reports, and security events
• Billing data: billing email, Stripe customer and subscription IDs, selected plan, subscription status, billing interval, invoices, and related accounting records. Card numbers and payment method details are handled by Stripe
• Communication data: support requests, feedback, and correspondence, including messages sent through email or Discord support channels

4. Legal Basis for Processing

We process your personal data based on the following legal grounds under Art. 6 GDPR:

• Contract performance (Art. 6(1)(b)): Processing necessary to provide our services, manage your account, and fulfill our contractual obligations.
• Legitimate interest (Art. 6(1)(f)): Necessary error monitoring, abuse prevention, security, and keeping the platform reliable. This does not authorize optional Google Analytics or Google Ads tracking.
• Consent (Art. 6(1)(a)): Optional Google Analytics measurement, Google Ads advertising, and their associated cookies and similar technologies. You can accept or decline all optional cookies and withdraw consent at any time. Other optional activities use consent where that is the appropriate legal basis.
• Legal obligation (Art. 6(1)(c)): Tax and accounting requirements, legal proceedings, and regulatory compliance.

5. Cookies & Tracking

Necessary cookies and browser storage support authentication, session management, security, language, appearance, and your privacy choices. Necessary service and security processing operates independently of optional analytics and advertising.

If you accept all optional cookies, Google Analytics 4 measures visits and selected interactions to help us understand and improve Scrimlog, and Google Ads supports advertising measurement and personalized advertising. The Google library and the relevant destinations load only after opt-in and only on permitted pages.

Our measurement uses sanitized page information and a limited event schema. Password-reset, OAuth callback, invitation, and public-match capability pages are excluded. We do not intentionally send account names, email addresses, Steam identifiers, private match or team identifiers, or URL tokens to Google as event parameters.

When signed in, open Settings and use Privacy choices to accept all or decline all optional cookies. When signed out, use the Privacy choices control on any page. Closing the dialog without choosing does not grant permission. Your choice is stored locally in this browser in the versioned scrimlog.consent.v1 preference record; it does not synchronize to your account or other devices. Missing, invalid, incompatible, or unavailable storage does not enable optional tracking.

You can withdraw permission through Privacy choices at any time. We stop the affected application measurement, clear applicable first-party tracking cookies, and reload the page if needed to remove an active Google library. Withdrawal does not undo data already processed. Clearing browser storage also removes your saved preference and prompts a new choice.

6. Data Sharing & Third Parties

We may share your data with the following categories of recipients:

• Payment processing: Stripe processes checkout, billing portal, subscription, invoice, payment, tax, and fraud prevention data. We store Stripe identifiers and subscription status so we can manage plans and billing access.
• Login providers: Google and Steam may be used to sign in or link an account. When you use them, we receive the identity data needed for that login flow, such as your provider user ID, email address, name, avatar, and verification status.
• Steam Games data: When you save a Steam account or import match data, we use Steam account identifiers and match data to sync ranks, parse games, and show statistics for your team.
• Optional measurement and advertising: With the relevant consent, Google receives the measurement and advertising data described above to provide Google Analytics and Google Ads. Google entities and their service providers may process data outside the EU/EEA, including in the United States.
• Hosting & infrastructure: Our servers and cloud infrastructure providers process data to deliver our services.
• Error monitoring: Sentry helps us find and fix errors. Error reports may include stack traces, browser and device details, URLs, release and environment information, and related technical context. We configure browser error tracking not to send default personal information automatically.
• Bot protection: Cloudflare Turnstile protects our registration form from automated sign-ups. It runs in the background and processes signals such as your IP address, TLS fingerprint, user agent, and the page you use it on to tell humans from bots. Cloudflare also uses these signals to improve Turnstile. See the Cloudflare Turnstile Privacy Addendum.

We do not sell your personal data. The applicable provider agreements and transfer arrangements govern processing outside the EU/EEA. Contact us for information about the recipients and transfer safeguards that apply to your data.

For more information about Google processing, see the Google Privacy Policy.

7. Data Retention

Google Analytics user-level and event-level data retention is initially set to two months. This setting does not remove standard aggregated reports after two months. Advertising data follows the applicable Google Ads retention rules. Your browser-local privacy choice remains until you change it, clear browser storage, or a new preference version requires a fresh choice. Google Analytics first-party cookies are configured with a 60-day lifetime without renewal on each interaction. Tracking-cookie lifetime is separate from Analytics report-data retention.

We retain your personal data only as long as necessary for the purposes stated in this policy, or as required by law. Account data is retained for the duration of your account and is deleted or anonymized within 30 days after account deletion unless we need to keep it for security, billing, legal, or abuse prevention reasons. Connected account records are kept while the account is linked. Team data is kept while the team workspace exists, subject to deletion requests and legal retention duties. Financial records are retained for 10 years in accordance with Austria tax law.

8. Your Rights (GDPR)

Under the GDPR, you have the following rights:

• Right of access (Art. 15): Request a copy of your personal data.
• Right to rectification (Art. 16): Request correction of inaccurate data.
• Right to erasure (Art. 17): Request deletion of your data ("right to be forgotten").
• Right to restriction (Art. 18): Request restricted processing of your data.
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interests.
• Right to withdraw consent (Art. 7(3)): Withdraw consent at any time without affecting prior processing.

To exercise your rights, email us at support@scrimlog.com. You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement.

9. Data Security

We implement appropriate technical and organizational measures to protect your data, including encrypted connections (TLS/SSL), hashed passwords, access controls, and regular security reviews. Despite our efforts, no method of transmission over the internet is 100% secure.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "last updated" date. Continued use of the platform after changes constitutes acceptance of the revised policy.

11. Contact

For privacy-related inquiries, contact us at support@scrimlog.com.