Privacy Policy

Stratara is an esports scouting, discovery, messaging, tryout, and recruiting workflow platform for players and organizations.

During the closed beta, Stratara is operated by Jefferson Cavalcanti, an individual based in Portugal. For data protection purposes, Jefferson Cavalcanti is the controller of personal data processed through Stratara unless otherwise stated.

During beta, privacy requests may be submitted through the official Stratara Discord support channels or another official support channel designated by Stratara. Users should not submit sensitive personal data through public Discord channels.

This Privacy Policy explains how Stratara collects, uses, stores, shares, protects, exports, and deletes personal data during the closed beta.

It applies to account holders, invited beta users, players, organization users, and users who interact with Stratara features such as profiles, messages, applications, tryouts, reports, saved items, and support channels.

We collect account data such as email address, Supabase authentication identifiers, account type, account status, timestamps, and authentication-related metadata.

We use this data to create and manage accounts, authenticate users, route users by account type, protect access, prevent abuse, and provide account-related support.

Authentication is provided through Supabase Auth. Supabase may process authentication data as a service provider.

We collect profile data such as display name, handle, location, preferred language, bio, avatar, banner, availability, game, role, rank, champion pool, clips, VOD links, player information, and organization information.

We collect recruiting workflow data such as vacancies, applications, tryouts, messages, saved players, saved vacancies, private organization notes, tryout notes, public or player-visible outcomes, notifications, follows, posts, comments, reactions, shares, and audit events.

Player profiles may function as recruiting CVs. Public profile information may be visible to other Stratara users and, where profile sharing is supported, may be shared by the player outside Stratara with limited visible information.

Rank or game-related information may be entered manually during beta until Riot ID verification or related integrations are available.

Stratara does not allow users under 16. We collect date of birth to verify eligibility, apply safety restrictions, and prevent underage access.

If a user provides a date of birth indicating that they are under 16, registration may be blocked. If we later discover or reasonably suspect that a user is under 16 or provided false age information, we may restrict, suspend, or delete the account.

We may process safety-related information in reports, moderation records, audit events, and support requests where necessary to protect users, investigate abuse, or enforce the Terms of Service.

If Riot-related verification or features are used, we may process Riot identifiers and game-related data such as Riot ID, PUUID, game name, tag line, rank, role, champions, champion pool, and related profile or gameplay information.

Specifically, Stratara may call Riot APIs including account-v1 (account lookup), summoner-v4 (League of Legends summoner profile), league-v4 (ranked tier and division), and match-v5 (recent match history). Data is fetched at signup and refreshed periodically only for active users. We cache aggressively to minimize API calls and respect Riot's rate limits.

Riot-related data may be used for account verification, profile accuracy, recruiting features, rank display, champion display, and platform integrity.

Some game or rank data may be provided manually by users during beta. Manual data may be unverified until Riot-related verification is available and approved.

Riot-related features may depend on Riot APIs, Riot approval, user authorization, and third-party availability.

Stratara processes private messages between users, including player-to-organization communications, where messaging features are used.

Private messages are not used for advertising or marketing and are not intended to be monitored proactively. However, we may access, review, preserve, disclose, or use message content where reasonably necessary to provide support, investigate reports, enforce the Terms of Service, protect users, maintain security, comply with law, or defend legal claims.

Organizations may create private notes and tryout notes. Private organization notes are intended to be visible only to the organization account that created or controls them, subject to technical access controls and lawful operational needs.

Users and organizations should not place unlawful, discriminatory, defamatory, excessive, irrelevant, or highly sensitive personal data in messages, private notes, tryout notes, reports, or other free-text fields.

If reporting tools are used, we may collect report data such as reporter account, reported account or content, report category, description, evidence, screenshots, timestamps, moderation decisions, appeal information, and related audit records.

We use report and moderation data to investigate suspected violations, illegal content, abuse, harassment, impersonation, unsafe conduct, fake organizations, spam, scams, malicious links, and other platform integrity or safety issues.

Reports may be reviewed by the Stratara operator or authorized support/moderation personnel. Evidence submitted through Discord may also be processed by Discord under Discord's own terms and privacy policy.

Stratara uses technical cookies required for authentication and security, including Supabase authentication cookies. Stratara may also use temporary cookies for security flows such as Riot OAuth state validation.

We do not currently use analytics, advertising, or marketing cookies.

We may process technical logs, rate limit data, request metadata, error information, audit events, and security events to operate the service, troubleshoot issues, protect accounts, prevent abuse, and improve reliability.

Structured logs are designed to redact sensitive fields such as passwords, tokens, cookies, authorization headers, service role keys, email-like values, dates of birth, Riot PUUIDs, redirects, URLs, and metadata where applicable.

We use personal data to provide the platform, authenticate users, create and display profiles, support discovery, process applications, organize tryouts, provide messaging, manage saved items, send notifications, handle reports, provide support, and maintain platform security.

We use profile and recruiting data to show discovery results, connect players and organizations, support team-management workflows, display public profile information, and maintain player or organization history where appropriate.

We use operational data, logs, rate limits, audit events, and moderation data to prevent abuse, investigate errors, enforce the Terms of Service, protect users, and defend legal claims.

We do not sell personal data and do not use personal data for third-party behavioral advertising.

Where the GDPR or similar data protection law applies, we rely on different legal bases depending on the purpose of processing.

We process account, authentication, profile, messaging, applications, tryouts, saved items, and core service data where necessary to provide the service and perform our agreement with you.

We process security logs, audit events, moderation records, rate limits, abuse prevention data, and platform integrity data based on our legitimate interests in operating, securing, improving, and protecting Stratara and its users.

We may process certain Riot-related data, optional profile fields, external links, clips, and similar optional data based on your action, consent, or request, depending on the feature.

We may process and retain certain data where necessary to comply with legal obligations or to establish, exercise, or defend legal claims.

Public profile and vacancy information can be visible to other Stratara users. This may include display name, handle, avatar, banner, location, bio, game, role, rank, champion pool, clips, posts, organization information, vacancies, availability, verification status, and related recruiting information.

Applications, tryouts, private notes, saved items, notifications, reports, and messages are restricted to the relevant participants, account owner, organization account, or authorized operational access where necessary.

Private organization notes are intended to be hidden from players. Player-visible outcomes or public notes may be visible according to the relevant platform feature.

We use service providers to operate Stratara. These may include Vercel for hosting and deployment, Supabase for authentication, database, storage, and related infrastructure, Discord for support and beta community communication, and Riot Games or Riot APIs where Riot-related features are used.

These providers may process personal data only as needed to provide their services, subject to their own terms, privacy policies, data processing terms, and applicable law.

If we later add analytics, error tracking, observability, email delivery, payment processing, or similar providers, this Privacy Policy should be updated before or when those services are introduced.

Stratara is operated from Portugal, but service providers such as Vercel, Supabase, Discord, Riot Games, or future infrastructure providers may process data in other countries, including outside the European Economic Area.

Where required, we rely on appropriate safeguards such as contractual protections, data processing terms, standard contractual clauses, adequacy decisions, or other lawful transfer mechanisms provided by the relevant service providers.

Account, profile, and recruiting workflow data is generally retained while your account remains active, unless deletion is requested or a shorter period is required.

Operational logs are generally retained for a short operational period depending on the hosting or log provider, typically around 30 to 90 days where configurable.

Audit events, security records, moderation records, reports, and abuse-prevention records may be retained for longer periods, typically up to 12 to 24 months, or longer where necessary for safety, legal compliance, dispute resolution, or defense of legal claims.

Messages, applications, tryouts, notes, and shared workflow records may be deleted, anonymized, or retained with deleted-account placeholders where another participant has a legitimate interest, where the record is needed for security, or where legal reasons require retention.

Authenticated users can export account data through the application settings or by accessing /api/privacy/export while authenticated. The export is provided as a JSON file and may include account, profile, recruiting workflow, messages, posts, saved items, notifications, and related records associated with the account.

Users can request or perform account deletion through the settings area where available.

Account deletion is designed to remove Supabase Auth access, remove profile and post media from Supabase Storage, clear or anonymize personal profile fields, delete or anonymize personal content where appropriate, remove notifications and saved/follow relationships, and replace shared workflow records with deleted-account placeholders where needed.

Some records may be retained, anonymized, or preserved where necessary for security, abuse prevention, legal compliance, dispute resolution, audit logs, or defense of legal claims.

Depending on applicable law, you may have rights to access, correct, delete, restrict, object to processing, and receive a portable copy of your personal data.

You may exercise privacy rights through the available in-app controls, including data export and account deletion where available, or through the official Stratara Discord support channels during beta.

We will respond to valid privacy requests within the period required by applicable law, generally within one month under the GDPR, subject to permitted extensions for complex or numerous requests.

You also have the right to lodge a complaint with a data protection authority. In Portugal, this is the Comissao Nacional de Protecao de Dados, also known as CNPD.

Stratara uses technical and organizational measures intended to protect personal data, including Supabase Auth, row level security, server-side permission checks, rate limits, structured logs with sensitive-field redaction, and access controls.

No security control is perfect. Beta users should avoid entering sensitive personal data into free-text fields unless strictly necessary.

If we become aware of a security incident affecting personal data, we will assess the incident and take steps required by applicable law.

Stratara is not intended for users under 16. We do not knowingly allow users under 16 to create accounts.

If you believe that a user under 16 has created an account or submitted personal data, please report it through the official support channel so that we can review and take appropriate action.

We may update this Privacy Policy from time to time as Stratara changes, as beta features evolve, or as legal or operational requirements change.

If changes are material, we may notify users through the platform, Discord, or another reasonable communication channel. The updated date at the top of this page indicates when this Privacy Policy was last changed.

Stratara is not endorsed by Riot Games and does not reflect the views or opinions of Riot Games or anyone officially involved in producing or managing Riot Games properties. Riot Games, and all associated properties, are trademarks or registered trademarks of Riot Games, Inc.

Stratara uses the Riot Games API in accordance with the Riot Games Developer Policy. Use of Riot data through Stratara does not imply any affiliation with, sponsorship by, or endorsement from Riot Games.

During the closed beta, privacy, safety, support, and moderation requests may be submitted through the official Stratara Discord support channels.

Do not submit sensitive personal data in public Discord channels. Use the designated private support or moderation channel where available.