Privacy Policy

1. Introduction

Welcome to FragDraft ("we," "us," or "our"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our free-to-play esports prediction and progression platform.

2. Information We Collect

2.1 Information You Provide

• Account Information: Username, email address, password, date of birth
• Steam Integration (optional): Steam ID, display name, avatar URL
• Draft Data: Roster compositions, player selections, booster deployments, tournament participation
• Subscription & Purchase Data: If you subscribe to FragDraft Pro or purchase a Season Pass, we retain a record of your purchase (SKU, date, amount, status). Full payment-card details are processed by our payment provider and never stored by us
• Referral Data: Your unique referral code, referral relationships (which accounts were referred by you or referred you), referral activation status, monthly referral leaderboard rankings, and milestone claim history

2.2 Automatically Collected Information

• Usage Data: Pages visited, time spent, features used
• Device Information: Browser type, IP address, device identifiers
• Geolocation: Country and region (state/province) derived from your IP address, used to enforce regional restrictions required for compliance. IP addresses are hashed for storage
• Cookies: See our Cookie Policy for details

3. How We Use Your Information

• Provide and maintain our esports prediction platform
• Process drafts and calculate scores based on real tournament outcomes
• Send notifications about tournaments, leaderboard updates, and account activity
• Process subscription payments and Season Pass purchases, manage renewals and refunds
• Operate the referral program: generate referral codes, track referral relationships, calculate leaderboard rankings, and process milestone and monthly rewards
• Enforce regional restrictions and age limits required for legal compliance
• Improve our services and user experience
• Prevent fraud, chargeback abuse, and ensure platform security
• Comply with legal, tax, and accounting obligations

4. Legal Basis for Processing (GDPR)

Under the General Data Protection Regulation (GDPR), we process your personal data based on the following legal grounds:

• Consent: We collect consent for optional cookies (analytics, advertising, functional) and marketing communications. You can withdraw consent at any time through cookie settings.
• Contractual Necessity: We process account information, draft data, subscription data, and purchase records to provide our Service and fulfil paid transactions. This processing is necessary to fulfil our contract with you.
• Legitimate Interests: We process usage data, device information, geolocation, and security logs to prevent fraud, ensure platform security, enforce regional restrictions, and improve our services. These interests do not override your fundamental rights and freedoms.
• Legal Obligations: We may process data to comply with legal requirements, including tax and accounting law, responses to lawful requests from authorities, and audit-log retention for compliance (including payment-processor underwriting and chargeback disputes).

5. Cookie Policy & Consent

We use cookies and similar tracking technologies to improve your experience. You can manage your cookie preferences at any time.

For detailed information about cookies, see our Cookie Policy.

6. Data Sharing

We do not sell your personal information. We share data only with processors who act on our instructions under binding data-processing agreements:

• Tournament Data Provider: PandaScore (CS2 tournament and player data)
• Payment Processor: Our payment provider receives the information required to process subscription and Season Pass purchases, handle refunds, and comply with payment-card industry regulations. The processor's own privacy terms apply to payment-card data
• Geolocation Provider: IP-based geolocation for regional-restriction enforcement
• Email Delivery: For transactional and notification emails
• Analytics: Google Analytics (only with explicit consent)
• Steam: Only if you link your Steam account, limited to identifiers required for the referral reward program
• Legal Authorities: When required by law or to protect rights

7. Your Privacy Rights

Depending on your location, you may have the following rights:

EU/EEA Residents (GDPR)

• Right of access to your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to data portability
• Right to object to processing
• Right to lodge a complaint with a supervisory authority

California Residents (CCPA)

• Right to know what personal information is collected
• Right to know if your information is sold or shared
• Right to opt-out of sale of personal information
• Right to request deletion
• Right to non-discrimination for exercising your rights

How to Exercise Your Rights

To exercise any of the above rights, please email us at [email protected] with your request. We will respond within 30 days.

• Data Access/Export (Portability): Request a copy of your personal data in a machine-readable format (JSON). We will provide your account information, draft history, tournament participation, purchase history, and consent logs.
• Data Correction: Request corrections to inaccurate or incomplete data in your account settings or via email.
• Data Deletion: Request account deletion. Note that some data must be retained for legal compliance. In particular, subscription and purchase records are retained for the statutory accounting-retention period (typically 7 to 10 years depending on jurisdiction), and consent logs are retained as required by GDPR Article 7.
• Consent Withdrawal: Revoke consent for cookies or marketing at any time through your cookie settings or account preferences.
• Object to Processing: Object to processing based on legitimate interests. We will honor your request unless we have compelling legitimate grounds.

8. Data Retention

• Account Data: Retained until account deletion
• Draft History: Retained for historical records and leaderboards
• Purchase & Subscription Records: Retained for the statutory accounting-retention period required in our jurisdiction (typically 7–10 years)
• Cookie Consent: Re-requested after 12 months
• Security Logs: Retained for 90 days
• Hashed IP addresses: Retained for up to 24 hours in cache for geolocation lookup

9. International Data Transfers

Our infrastructure is hosted in the European Union. Where we use processors outside the EU/EEA (such as our tournament-data providers or our payment processor), transfers are protected by Standard Contractual Clauses (SCCs) or an equivalent lawful transfer mechanism as required by GDPR.

10. Children's Privacy

Our Service is not directed to individuals under 18. We do not knowingly collect personal information from anyone under 18. If we learn we have collected data from a user under 18, we will delete it promptly.

11. Contact Us

For questions about this Privacy Policy or to exercise your rights:

• Email: [email protected]

EU Representative (GDPR Article 27)

For EU/EEA residents with privacy concerns, you may contact our data protection team at the email above. If you have unresolved concerns, you have the right to lodge a complaint with your local data protection authority.

12. Updates to This Policy

We may update this Privacy Policy periodically. Changes will be posted on this page with an updated "Last updated" date. Material changes will be notified by email. Continued use of our Service after changes constitutes acceptance of the updated policy.