Privacy Policy
Effective: [EFFECTIVE DATE]
Version 1.0
This policy explains what personal data MyLoLCoach collects, why, who sees it, and your rights. We collect what we need to run the service. We don't sell your data and we don't use advertising cookies. You must be 18 or over, and we check your date of birth once and don't store it.
1. Who is responsible for your data
[COMPANY LEGAL NAME], company number [COMPANY NUMBER], registered office [REGISTERED ADDRESS], is the controller of your personal data. Contact us at [email protected].
We follow the UK GDPR and the EU GDPR. Our EU representative under Article 27 GDPR: [to be appointed before launch]
2. What we collect
| Data | Examples | Source |
|---|---|---|
| Account | Email, display name, Discord ID if you log in with Discord, Riot ID, time zone, language | You |
| Age check | Confirmation that you are 18+. Your date of birth is checked once and not stored | You |
| Bookings and sessions | Coach, time, status, notes, plans and replay links you or your coach add | You, coaches |
| Chat | Messages exchanged after a booking | You, coaches |
| Payments | Amounts, refunds, invoices, last four card digits and card brand. Stripe holds the full card details | You, Stripe |
| Coach onboarding | Photo, rank, profile text, tax and identity details (encrypted), payout details, audition recording (with consent) | Coaches |
| Legal acceptances | Document version, time, IP address and browser, kept as evidence of what you agreed | Automatic |
| Reports and support | What you tell us in a report or email | You |
| Technical | Error logs, security and abuse-prevention data, cookie-free page statistics | Automatic |
| Free review requests | Email, Riot ID, goals, what you tell us | You |
3. Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Create and run your account, bookings, sessions and chat | Contract |
| Take payment, issue refunds, run coach payouts | Contract |
| Keep accounting and tax records, report seller income to HMRC | Legal obligation |
| Keep records of what you accepted | Legal obligation and legitimate interests (proving our terms) |
| Flag off-platform payment talk for review by a person, handle reports, moderate content | Legitimate interests (protecting students and the service) |
| Prevent fraud, abuse and bot sign-ups | Legitimate interests |
| Fix errors and measure site use without cookies | Legitimate interests |
| Email you about bookings, refunds and changes | Contract |
| Marketing email | Consent, which you can withdraw at any time |
| Check age at signup | Legal obligation and legitimate interests |
| Assess and record coach auditions | Consent |
4. Chat and monitoring
A keyword check flags messages that look like off-platform payment talk. It never blocks a message and never punishes anyone automatically. A person reviews each flag. Staff read only flagged or reported conversations, and every read is logged. Chat exists only after a booking. Voice happens on Discord.
5. Who we share it with
Your coach sees what they need to deliver your sessions: your display name, Riot ID, Discord tag, goals and chat. We don't sell your data. Our service providers are:
| Provider | Role | What for |
|---|---|---|
| Supabase | Processor | Hosting, database and login, in the EU |
| Vercel | Processor | Website hosting |
| Stripe | Independent controller | Payments, fraud prevention and coach payouts |
| Resend | Processor | Sending email |
| Sentry | Processor | Error tracking |
| Plausible | Processor | Cookie-free analytics |
| Cloudflare Turnstile | Processor | Bot checks on forms |
| Discord | Independent controller | Voice sessions and Discord login |
We may share data with tax authorities, regulators, courts and law enforcement where the law requires it, and with professional advisers under confidentiality.
6. International transfers
Some providers or their staff are outside the UK and EEA, for example in the United States. We transfer data only where there is an adequacy decision or the provider has signed standard contractual clauses, with extra safeguards where needed. Ask [email protected] for details.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account data | 12 months after you close your account |
| Payment and tax records | 7 years |
| Records of legal acceptances | 7 years |
| Free review requests that never turned into an account | 12 months |
| Messages | While your account is open |
| Audition recordings | 12 months after our decision |
We then delete or anonymise the data. Where we must keep records for the law, that overrides deletion.
8. Your rights
You can ask us to access, correct, delete, restrict or move your data, and to object to processing based on legitimate interests. You can withdraw consent at any time. You can export your data and delete your account yourself in your settings. Or email [email protected]. We answer within 30 days. We may keep records we're legally required to keep.
You can complain to the UK Information Commissioner's Office (ico.org.uk) or to the data protection authority in the EU country where you live. We'd like the chance to help first.
9. Security and breaches
We encrypt tax and payout details, restrict staff access, log sensitive reads, and keep backups. If a breach puts your rights at risk, we tell the regulator within 72 hours and tell you without undue delay where the law requires.
10. Cookies and advertising
We use essential cookies only and no advertising or tracking cookies. See our Cookie Notice.
11. Children
MyLoLCoach is for people aged 18 or over. If we learn that someone under 18 has an account, we close it and refund unused purchases. Tell us at [email protected] if you think this has happened.
12. Changes
If we change this policy in a way that matters, we email you before it takes effect. Old versions stay in the legal centre. See also our Terms of Service.