Effective date: 2026-10-02
This is a translation of the Korean original. If the two differ, the Korean version prevails.
Stoveleagues ("Stoveleagues") complies with the Korean Personal Information Protection Act and other relevant laws, as well as the EU General Data Protection Regulation (GDPR), and processes users' personal data as follows.
1. Personal data we process and why
| Category | Items | Purpose |
|---|---|---|
| Sign-up (required) | Email, password (stored encrypted), name (the name shown on screen), member type, confirmation of being 14 or older, consent records | Identifying and managing members, providing the Service, answering inquiries, preventing misuse |
| Business members (required) | Business type, company or organization name | Verifying business members, information about services for businesses |
| Optional | Country of residence, consent to receive newsletter emails | Information suited to your country, emails about new tournaments and services |
| Child records (when registered by a parent or legal guardian member) | Tournament history abroad (tournament, year, category, position), stories from tournaments abroad (text of up to 4 lines, badges), club link | Recording and sharing the child's experience at tournaments abroad (only what the parent or legal guardian chooses is made public) |
| Clubs (club and academy business members) | Club name, city, country, description, website, logo | Publishing the club page, confirming player links |
| Brackets (the member who creates them) | Tournament name, date, venue, notes, team names and logos, match scores. We do not collect player names. | Creating brackets and showing them at their share link (visible only to people who have the link) |
| Club invitation email (when a bracket creator enters it) | The club's (team's) email address — after one notice email is sent the address itself is discarded; we keep only an encrypted value (hash) and a masked form (ab***@…) to prevent repeat sending and honour unsubscribes | Sending one bracket notice, not sending again to the same address, honouring unsubscribes |
| Child profile (when registered by a parent or legal guardian member) | Display name (part of the name or a nickname is recommended instead of the full name), year of birth, gender, position and country (optional), parent or legal guardian consent records. We do not collect the child's contact details. | Managing records of the child's experience at tournaments abroad |
| Information generated automatically | Access logs (IP address, browser information, access time), login records | Security, troubleshooting, preventing misuse |
Information needed to keep you logged in is stored in your browser's storage (localStorage). We do not use advertising or tracking cookies. Visitor statistics are collected without cookies.
2. Children under 14
- Persons under 14 cannot sign up as members. A child's information is registered and managed only by a parent or legal guardian member under that member's own account.
- When creating a child profile, the parent or legal guardian gives consent as the child's legal representative, and we keep a record of that consent (date and document version). The parent or legal guardian is a member who has completed email verification.
- Child profiles are not visible to other members or visitors by default.
- If the parent or legal guardian separately consents to publication (the consent record is kept), only the following is made public: display name, position, country, tournament history the parent or legal guardian has marked "public", stories whose facts Stoveleagues has checked, and club links confirmed by the club. Year of birth, gender, parent or legal guardian information and contact details are not made public. A story may show the child's age (at the time of the tournament).
- Public player pages and story lists are set so that they are not listed by search engines. There is no feature (messages or comments) that lets others contact anyone through the published content.
- When a link to a club is requested, the club's business member can see only the child's display name and position.
- The parent or legal guardian can withdraw publication at any time, and the content disappears from public pages immediately.
- The parent or legal guardian can edit or delete a child profile at any time, and child profiles are deleted together with the member's account when the member leaves.
3. Retention and deletion
- Member information, child profiles and consent records: deleted immediately when the member closes their account. If only a child profile is deleted, that profile is deleted immediately.
- Access logs: kept for security purposes for up to 1 year and then deleted (according to each provider's retention period).
- If information arises that must be retained by law (for example, transaction records for paid services), it is kept separately for the period set by that law.
- Method of deletion: electronic files are deleted in a way that cannot be recovered.
4. Provision to third parties
Stoveleagues does not provide users' personal data to other companies or organizations, except where required by law.
5. Processors and transfers abroad
To operate the Service, we entrust the processing of personal data to the providers below. Because these providers are US companies, personal data may be transferred abroad. Transfers take place over the internet whenever the Service is used.
| Provider (country) | Work entrusted | Place of storage and processing | Retention period |
|---|---|---|---|
| Supabase Inc. (USA) | Storing and managing the member information and login database, backups | Seoul, Republic of Korea (Amazon Web Services Seoul region servers). Remote access from the US headquarters for technical support and system administration may occur | Until the member closes their account or the processing contract ends |
| Netlify, Inc. (USA) | Website operation (hosting), processing of access logs | Netlify servers (USA and other locations) | Within the provider's retention period |
| Cloudflare, Inc. (USA) | Visitor statistics (no cookies; aggregated in a form that cannot identify individuals) | Cloudflare servers (USA and other locations) | Within the provider's retention period |
| Resend, Inc. (USA · sending servers in Ireland) | Sending sign-up confirmation and password reset emails | Resend, Inc. servers | Within the provider's retention period after the email is sent |
Items transferred: among the items in section 1, those each provider needs for the work entrusted to it. If you do not want your data transferred, you can stop the processing by closing your account (because the transfer is essential to using the Service, it cannot be refused by any means other than closing your account).
6. Your rights
You may at any time request to see, correct or delete your personal data, or to stop its processing, and you may withdraw your consent. You can make corrections or close your account yourself in My Space (DEN); for other requests, contact us at the address below and we will handle them without delay.
7. Security measures
- Passwords are stored encrypted, and even Stoveleagues cannot know them.
- All communication is encrypted (HTTPS).
- Access to the database is restricted so that members can see only their own information, and operating permissions are given to as few people as possible.
8. Users in the European Union (EU) and European Economic Area
- Legal basis: sign-up and provision of the Service are based on the performance of a contract (GDPR Article 6(1)(b)), newsletter emails on consent (a), and security and prevention of misuse on legitimate interests (f).
- Rights: you may request access, rectification, erasure, restriction of processing, portability (receiving your data) and objection, and withdraw consent. You may also lodge a complaint with the data protection authority of your country of residence (in Spain, the AEPD).
- Transfers abroad: the Republic of Korea has received an adequacy decision from the European Commission, and storage on servers in Seoul relies on this decision. Transfers to US providers are subject to safeguards such as the Standard Contractual Clauses (SCCs) offered by each provider.
9. Data protection officer
Officer: Yeontec Jeong · Email: hello@stoveleagues.com
10. Changes to this Policy
When this Policy is changed, the changes will be announced on the Service from 7 days before they take effect (30 days for important changes).