Privacy
policy.

What we collect

• Account data: email, full name, phone (optional), avatar (optional).
• League data: teams, players, schedules, box scores, photos you upload.
• Usage analytics: page views, feature usage (aggregated, not tied to individuals where possible).
• Payment metadata: reference codes, amounts, payment method tag (we don't store card numbers).

Lawful basis (RA 10173)

We process personal data under one of the following lawful bases:

• Consent — account creation, optional fields (phone, avatar), marketing emails (only when explicitly opted in).
• Contract — processing required to deliver the service you signed up for (e.g. running standings, sending invitations, charging your plan).
• Legitimate interest — security logs, fraud prevention, aggregated usage analytics for product improvement, and publishing player names/stats on a public league page (consistent with the commissioner's legitimate interest in publishing their league's participation).

How we use it

• To run the service — display standings, send invitations, process upgrades.
• To improve the product — find bugs, prioritize features.
• To contact you about your account or critical service updates.

We don't sell your data. We don't use it to train AI models. We don't share it with advertisers.

Where it's stored (and cross-border transfers)

Data is stored on Supabase (Postgres + Storage) and served via Vercel. Both providers operate globally — your data may be processed in data centers located outside the Philippines (typically the United States or Singapore region). RA 10173 permits cross-border transfers when the receiving party provides an adequate level of protection. Both providers maintain SOC 2 Type II attestations and contractual data-protection commitments equivalent to RA 10173 standards.

Photos are stored in a public-read bucket — anyone with the URL can view them, by design (your league's public page shows them). If you make a league private, photo URLs are not exposed in our UI but the underlying files remain technically accessible by URL until purged on the retention schedule below.

Retention

• Active accounts: data is kept indefinitely.
• Downgraded paid leagues: photos are kept 30 days, then purged. Other data stays.
• Deleted accounts: data is removed within 7 days of your deletion request.

Your rights (RA 10173)

You have the right to:

• Be informed — this policy describes what we collect and why.
• Access your data — email us, we'll send a full export within 1 business day.
• Correct inaccurate data — edit it in the dashboard or email us.
• Erasure / blocking — email us; deletion within 7 days, confirmed by reply.
• Object to processing — let us know and we'll stop, except where processing is required for contract or legal compliance.
• Data portability — your full export comes as machine-readable CSV / JSON.
• File a complaint with the National Privacy Commission (NPC) at privacy.gov.ph if we fail to respond.

Data Protection Officer

Per RA 10173 §21, ArcStat designates a Data Protection Officer (DPO) responsible for compliance, breach response, and data-subject requests:

• Name: ArcStat DPO (acting — founder)
• Email: shoot@arcstat.app (subject line: “DPO request”)
• Response window: within 5 business days for routine requests, within 24 hours for breach-related concerns

Breach notification

In the event of a personal-data breach that is likely to give rise to a real risk of serious harm, we will:

• Notify the National Privacy Commission within 72 hours of becoming aware of the breach, per NPC Circular 16-03.
• Notify affected data subjects without undue delay, by email to the address on file, with a description of the nature of the breach, the data involved, the measures taken, and the contact details of our DPO.
• Maintain a breach register internally for at least 5 years.

Third parties

• Supabase (database + storage + auth)
• Vercel (hosting + edge functions)
• Resend (transactional email — when shipped)
• Payment processors (GCash, Maya, banks — we receive proof of payment, not card data)

NPC registration

ArcStat is registering with the National Privacy Commission as required once our processing volume crosses the threshold defined in NPC Circular 17-01 (1,000+ data subjects or sensitive personal information at scale). If you're a corporate / school / federation client and need our NPC registration number for procurement, email the DPO above.

Cookies

We use a single session cookie for authentication. No tracking cookies. No third-party advertising.

Children

ArcStat is intended for league commissioners (typically adults). Players in our system may be under 18 — their names and stats are uploaded by the commissioner who has legitimate interest in publishing their participation. Parents can request removal via the league commissioner or directly via our DPO.

Contact

Privacy questions or data requests: shoot@arcstat.app(subject: “DPO request”)