Privacy Policy

1. Data Controller

The controller of your personal data is TennisRank Tecnologia, Belo Horizonte/MG, Brazil. For privacy and data protection inquiries, contact: privacy@tennisrank.io

2. Data We Collect

We collect the following categories of data:

• Account data: full name, email, password (cryptographic hash), phone (optional), and profile photo
• Game data: match scores, ranking positions, win/loss history, tournament participation
• Navigation data: IP address, browser type, device, and access logs (mandatory 6-month retention under Brazil's Internet Civil Framework)
• Organization data: organization name, logo, settings, and member list
• Payment data: processed exclusively by Stripe — we do not store credit card data
• Data processed by game intelligence: game statistics, match history, and ranking position (sent to Anthropic Claude API for simulator, form radar, rivals, and dossier features)

3. Purpose of Processing

Your data is used for: account creation and authentication, ranking calculation and display, match registration and validation, artificial intelligence features (coach, narration, predictions, matchmaking), sending notifications (in-app and email), continuous service improvement, and compliance with legal obligations.

4. Legal Basis (LGPD Art. 7)

Processing of your data is based on: Consent (Art. 7, I) — for AI data processing and marketing communications. Contract performance (Art. 7, V) — for account creation, ranking, and match registration, necessary for service delivery. Legitimate interest (Art. 7, IX) — for security, fraud prevention, and service improvement. Legal obligation (Art. 7, II) — for access log retention under Brazil's Internet Civil Framework (6 months).

5. Data Sharing

Your data may be shared with:

• Anthropic (Claude API) — game statistics for AI features. Servers in the USA. Anthropic does not use commercial API data for model training
• Stripe — payment data for subscription processing
• Supabase — database hosting (AWS region sa-east-1, Sao Paulo, Brazil)
• Vercel — application hosting
• Public pages — by joining an organization, your name, ranking, and results become publicly visible
• PostHog — product analytics for service improvement. US servers. Data collected: anonymized usage events and identification of logged-in users (with consent)
• Sentry — error monitoring and application performance. US servers. Data collected: technical error information and session context
• Resend — transactional email delivery (match notifications, reminders). Data sent: email address and notification content
• Meta (Facebook) — conversion pixel for marketing campaign measurement (with consent). Data collected: navigation and conversion events
• Cloudflare — anti-bot protection (Turnstile/CAPTCHA) on registration and login. Data collected: technical browser information for verification

We do not sell, rent, or share your data with third parties for marketing purposes.

6. International Data Transfer

Some of your data is transferred to servers in the United States (Anthropic and Stripe). This transfer is based on your informed consent (LGPD Art. 33, VIII) and is subject to each provider's data protection policies. You will be informed if there are changes to providers or storage jurisdictions.

7. Your Rights (LGPD Art. 18)

You have the right to:

• Confirm the existence of processing of your data
• Access all personal data we hold about you
• Correct incomplete, inaccurate, or outdated data
• Request anonymization, blocking, or deletion of unnecessary data
• Request portability of your data to another service
• Request deletion of data processed based on consent
• Obtain information about who your data is shared with
• Revoke consent at any time
• Object to processing based on legitimate interest

To exercise your rights, contact privacy@tennisrank.io. Response deadline: 15 business days.

8. Automated Decisions and AI (LGPD Art. 20)

TennisRank uses algorithms to calculate ranking positions (ELO, points, round-robin) and generate AI-powered recommendations. These decisions are informational and non-binding. You have the right to request an explanation of the criteria used and human review of any automated decision.

9. Retention and Deletion

Your data is retained while your account is active. After account deletion, personal data will be removed within 30 days. Exceptions: access logs are retained for 6 months (legal obligation — Brazil's Internet Civil Framework), anonymized data and aggregated statistics may be kept indefinitely for ranking integrity.

10. Security

We implement technical and organizational measures to protect your data, including: encryption in transit (HTTPS/TLS), password hashing (bcrypt via Supabase Auth), Row-Level Security (RLS) on the database, and robust authentication and access controls. In case of a security incident that may pose risk to data subjects, the Brazilian National Data Protection Authority (ANPD) and affected users will be notified within 72 hours.

11. Minors

TennisRank is intended for users aged 18 and over. We do not intentionally collect data from minors. If we identify an underage user, the account will be suspended and data removed.

12. Cookies

We use the following types of cookies and similar technologies: Essential cookies (no consent required): user authentication and session, necessary for service operation. Functional cookies (no consent required): preferences such as language and theme. Analytics cookies (with consent): PostHog, for product usage analysis and service improvement. Marketing cookies (with consent): Meta Pixel (Facebook), for advertising campaign measurement. You can manage your cookie preferences at any time through the consent banner displayed on the site. Declining optional cookies does not affect service functionality.

13. Changes to This Policy

This policy may be updated periodically. Significant changes will be communicated via email or platform notification at least 30 days in advance.

Contact

For privacy and data protection inquiries: privacy@tennisrank.io. For general inquiries: contact@tennisrank.io