1. Who we are
Sportsplex Inc. (“Sportsplex”, “we”, “us”) is a Kavod Technologies company, founded in 2021. We operate sportsplex.app and the related mobile and white-label deployments. The data controller for this service is Sportsplex Inc.; reach us at privacy@sportsplex.app.
2. Data we collect
You give us
- Account info — email, username, display name, password hash, country, timezone.
- Profile info — bio, avatar, country, role tags.
- Posts, comments, reactions, follow graph, match-room messages.
- Payment info — billing details handled by Stripe, Paystack or Flutterwave; we never see card numbers.
- Support tickets and any messages you send us.
We collect automatically
- Device + browser info (user agent, language, viewport).
- IP address and approximate location, used for fraud and abuse detection and for region-aware payments.
- Usage telemetry — pages visited, features used, performance metrics. Aggregated where possible.
- Cookies and similar storage. See our Cookie Policy.
From third parties
- Sign-in providers you use (Google) — email, name, avatar.
- Sports data partners — fixtures, scores, team metadata. We don't mix this with your account.
- Payment processors — settlement and refund status.
3. How we use it
- Run the service. Authenticate, render your feed, run match rooms, route payouts.
- Improve the service. Aggregate usage analytics so we know what to build next. We do not sell behavioural data.
- Keep it safe. Detect and stop fraud, account takeover, abuse, and platform manipulation.
- Comply with law. Tax, AML/KYC for marketplace payouts above thresholds, lawful requests.
- Talk to you. Service updates, security alerts, optional product news. You can opt out of marketing email at any time.
4. Lawful bases (UK/EU)
Where UK GDPR or EU GDPR apply, we rely on:
- Contract — to provide the service you signed up for.
- Legitimate interests — fraud prevention, product analytics, business operations, weighed against your rights.
- Consent — for marketing email and non-essential cookies. Withdraw at any time.
- Legal obligation — tax records, statutory retention, regulator requests.
5. Who we share it with
We share only what's necessary, only with vetted parties:
- Service providers — hosting (Neon Postgres, MongoDB Atlas, Upstash, Backblaze B2, BunnyCDN, Cloudflare), email (Resend), error monitoring (Sentry), logs (Better Stack), analytics.
- Payment processors — Stripe (US/EU), Paystack (Nigeria, Ghana, Kenya, South Africa), Flutterwave (rest of Africa).
- White-label tenants — if you sign up through a club or federation deployment, that organisation receives your account-level data as a joint controller.
- Law enforcement — in response to a valid legal request. We publish a transparency note annually.
- Acquirers — if Sportsplex is acquired, your data moves with the service. We'll notify you in advance.
We do not sell your personal data.
6. Where we store it
Primary databases are in the EU (Frankfurt) and Africa (Lagos). Encrypted backups are held in two additional regions. Some sub-processors operate outside the UK/EU; transfers rely on Standard Contractual Clauses with technical safeguards.
7. How long we keep it
| Data | Retention |
|---|---|
| Account record | Lifetime of the account, then 30 days in soft-delete before hard-delete. |
| Posts, comments, reactions | Retained while the account is active. Deletable at any time. |
| Payment records | 7 years (statutory tax requirement). |
| Audit logs | 13 months. |
| Marketing email opt-ins | Until you withdraw consent. |
8. Your rights
Depending on where you live, you can request access, correction, deletion, portability, restriction, or objection. Exercise any of these by emailing privacy@sportsplex.app from the email on your account. We respond within 30 days.
UK / EU residents can complain to their local data protection authority. California residents have additional rights under CCPA/CPRA, including the right to know, delete, correct, and opt out of sale or sharing.
9. Children
Sportsplex is not intended for children under 13. If we learn we've collected data from a child under 13 without parental consent, we'll delete it.
10. Security
We encrypt data in transit (TLS 1.3) and at rest. Passwords are hashed with bcrypt. Access is RBAC-gated and audit-logged. We run regular penetration tests and a private bug bounty — see Security.
11. Changes
Material changes will be announced by email and a banner on the platform at least 14 days before they take effect. Minor edits (typos, clarifications) are versioned at the bottom of this page.
12. Contact
Questions or complaints? privacy@sportsplex.app. Postal address: Sportsplex Inc., c/o Kavod Technologies, Lagos, Nigeria.