Privacy Policy

Remonter Solutions Inc. ("Leagzr", "we", "us") operates the Leagzr sports league management platform. This Privacy Policy explains how we process personal data when you create a platform account, manage a league, or visit a league's public site hosted on Leagzr.

Under the GDPR and UK GDPR, the party that determines why and how personal data is processed is the data controller. A processor processes personal data on the controller's instructions.

• Leagzr acts as the data controller for platform account data: league owner and admin registration, billing contact details, authentication identifiers, support correspondence, and platform usage logs tied to your account.
• Each league organization (the "League") acts as the data controller for player and participant data it collects through its league site, registrations, waivers, schedules, and communications— including names, contact details, waiver signatures, and game statistics published at the League's direction.
• Leagzr acts as a data processor when storing and processing player and league operational data on behalf of a League, as described in our Data Processing Agreement (DPA).

If you are a player or participant, contact your League first for access, correction, or deletion requests relating to league-specific data. Contact us at [email protected] for platform account matters or if you need help reaching the correct controller.

• Account data: email address, display name, password hash, optional profile image, OAuth identifiers when you use Google sign-in.
• League data: league name, subdomain, sport type, branding, schedules, teams, game results, and content you publish on your league site.
• Player data (on behalf of Leagues): registration details, waiver acceptance records, payment status metadata, and statistics you or League admins enter.
• Photos: profile headshots and, when a League enables game-day albums, photos uploaded by league admins. Face embeddings are created only after separate biometric consent (see Face tagging).
• Billing data: subscription plan, Stripe customer and payment method tokens (card details are held by Stripe, not Leagzr), billing address, and optional tax IDs collected for tax calculation and receipts.
• Technical data: IP address, browser user agent, session cookies, diagnostic logs needed to operate and secure the service, and advertising measurement data collected by the Google Ads tag.

• Provide, maintain, and improve the platform and league sites.
• Authenticate users and enforce account security.
• Process subscriptions and, where enabled, league registration payments via Stripe, including calculating applicable tax.
• Send transactional emails (verification, password reset, league notifications).
• When a League enables game-day photos and a player consents: suggest player tags on league-admin albums. Unreviewed suggestions stay admin-only. League admins may publish an album so signed-in members of that league can view the photos and confirmed player names.
• Comply with legal obligations and respond to lawful requests.
• Detect abuse, fraud, and security incidents.
• Measure advertising performance and conversions via the Google Ads tag.

Where the GDPR applies, we rely on: (a) contract — to provide the service you signed up for; (b) legitimate interests — security, product improvement, and fraud prevention, balanced against your rights; (c) consent — where required (e.g. non-essential cookies, marketing when offered, and biometric face tagging); and (d) legal obligation — where we must retain or disclose data by law.

We use the following subprocessors to run the platform. Leagues should review this list as part of their own accountability obligations when using Leagzr as a processor:

• Self-hosted PostgreSQL — Primary application database (accounts, league data, audit logs, and optional face-matching embeddings); data may be processed in Leagzr-operated VPS (region configured per deployment).
• Stripe — Leagzr subscription billing and league payment processing (Stripe Connect); data may be processed in United States / global.
• Resend — Transactional email (verification, password reset, league notifications); data may be processed in United States.
• Cloudflare R2 — Object storage for uploaded media (logos, player photos, game-day albums, documents); data may be processed in Global (edge locations).
• Google OAuth (optional) — Optional social sign-in for league admin accounts; data may be processed in United States / global.
• Google Ads — Advertising measurement and conversion tracking (gtag.js on every page); data may be processed in United States / global.

We will update this list when subprocessors change materially. Enterprise customers may request prior notice where contractually agreed.

Some Pro leagues may enable game-day photo albums. If a player turns on face tagging, Leagzr uses internal image tagging technology to compare that player's designated headshot with photos a league admin uploaded. Matching data is stored on infrastructure we operate. The technology produces suggested tags only. League admins must confirm or reject each suggestion in Leagzr. Unreviewed suggestions are not product truth and are not published on public league sites. League admins may publish an album to logged-in members of that league. Published photos may include confirmed player names as tags. Publishing is a league-controller choice; the feature remains off until a platform operator enables it for the league.

• Separate consent: uploading or storing a profile photo is not permission to identify the player in other photos. Only the player (the data subject) can grant biometric consent for that league. Admins may turn matching off but cannot turn it on for someone else.
• Purpose limitation: tagging league-admin game-day albums. We do not use face matching for attendance, access control, live-stream tracking, or public facial search. We do not sell biometric data. We do not send images or embeddings to a third-party face-matching vendor.
• What is stored: original JPEGs stay in Cloudflare R2 and count toward the league's storage quota. Face embeddings, matching data, and confirmed player tags live in our PostgreSQL database.
• Youth: if a waiver records the player as a minor, automatic matching stays off until counsel says otherwise. Admins can still tag photos by hand. A minor who was tagged manually can appear in a published league-member gallery and in their own Photos of me.
• Quebec (Law 25): the feature is off per league until a platform operator enables it. Leagues that process biometric data of Quebec residents may need CAI notice before enablement.
• Withdrawal and deletion: turning matching off, deleting the enrolled headshot, removing the player from the league, or deleting the league removes that player's stored face-matching data. Account erasure also clears that player's suggested and confirmed tag identities in the league's albums. Album or photo delete removes R2 objects, face rows, and quota.

We retain personal data only as long as needed for the purposes above, to comply with law, or to resolve disputes. League operational data is retained while the League's subscription is active and for a limited period afterward unless the League requests earlier deletion, subject to legal holds (e.g. signed waivers where retention is required). Detailed retention schedules are documented in our internal records of processing and will be published in a future update.

Depending on your location, you may have rights to access, rectify, erase, restrict, or port your personal data, and to object to certain processing. You may also lodge a complaint with your supervisory authority. Platform account requests: [email protected]. League player data requests: contact your League controller first.

We and our subprocessors may process data in the United States and other countries. Where required, we use appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms.

Remonter Solutions Inc. · Leagzr · [email protected]