Privacy Policy

Account information: your display name and the email address or phone number you use to sign in; your Google identifier and link time if you choose Google sign-in.

Tournament content you create: tournament names, venues, team and player lists, schedules, scores, and any logo or cover images you upload.

If you apply to a tournament through its organizer portal: entrant/team name, contact name, email, optional phone number, notes, and an IP address used for anti-spam controls.

Technical data needed to operate and secure the service: IP address, browser/device type, request identifier, access time, response status, session information, and error reports with identifying context restricted.

Payment and reconciliation data when you purchase a plan: transaction reference, amount, status, transfer description, related account number, and responses returned by the payment provider. Matchup does not ask you for a bank PIN, banking OTP, or banking password.

To provide and operate the service: creating tournaments, generating brackets and schedules, showing standings, and rendering public tournament pages.

To secure accounts, prevent fraud, and troubleshoot technical issues.

To process and reconcile payments, support customers, and meet legal obligations.

To improve the product using aggregate or de-identified data where possible. Registration forms store a random browser identifier to count unique opens for each tournament; it contains no name, email address, IP address, or device details.

Matchup processes data only as needed to carry out your request, provide the service under the Terms, protect accounts and systems, comply with legal duties, or protect the lawful rights and interests of the parties.

If Matchup later wants to use data for direct marketing, disclose it for an independent purpose, or pursue a new purpose requiring consent, we will provide specific information and a separate choice; consent controls will not be pre-selected.

We do not sell your personal information.

Content in a tournament set to public — including team names, schedule, scores, and standings — can be viewed or shared by anyone with the link. You control whether a tournament is public.

Contact details in a tournament application are shared with the organizer of that tournament for review; they do not appear on the public tournament page unless the organizer separately adds part of the submission to public content.

We disclose only the data needed by providers that operate the service, including hosting/database infrastructure, Cloudflare R2, Resend or Twilio, Google, Goong, Sentry, OpenAI, and SePay; or when lawfully required by a competent authority.

Each provider receives only the data category needed for its function. The provider, role, and processing location may vary with deployment configuration; Matchup will update this notice when a material change occurs.

When you use the Matchup assistant, your question, current page context, the conversation history needed to answer, and relevant tournament or draft data read by requested tools are sent to OpenAI to generate a response. Do not enter passwords, verification codes, payment information, or other sensitive data in chat.

AI conversations are retained for up to 15 days so you can revisit them and so Matchup can operate and troubleshoot the service. You can delete individual conversations in the assistant; an aggregate cost ledger containing usage and token counts but no chat content or account identity may be kept longer.

Tournament avatars, covers, and logos are stored in Cloudflare R2 under hard-to-guess paths for fast delivery. If an image belongs to a public tournament, anyone viewing that page can see and share it.

Do not upload identity documents, images containing sensitive data, or another person's image unless you are authorized to use and publish it. Replaced or deleted images enter a cleanup queue for removal from storage.

Account and tournament data is retained while the account or content remains active, then deleted, hidden, or de-identified following a valid request and backup cycles. Transaction, fraud-prevention, dispute, and audit records may be retained longer where needed for accounting, legal duties, or the protection of lawful interests.

AI conversations are retained for no more than 15 days. Server application logs rotate after 14 days by default; the actual period may be shorter or extended on a limited basis during an incident investigation or where law requires it.

An OTP is valid for 10 minutes and exists in the database only as a one-way hash; Matchup does not retain a readable copy of the OTP.

Some cloud and software providers listed above may process data on infrastructure outside Vietnam. Matchup will identify the actual data flow, minimize what is sent, apply appropriate agreements and safeguards, and complete any cross-border transfer records or procedures required by law.

We use encrypted connections, one-way password and OTP hashing, HttpOnly/Secure session cookies, rate limits, administrative access controls, audit records, and data filtering before error reports are sent. Replaced or removed images have a storage cleanup mechanism.

Operational access must follow job need and least privilege. However, no system is completely secure, so we cannot guarantee 100% security.

You should keep your login credentials safe and not share them with others.

Depending on the circumstances and applicable law, you may ask to be informed; access or receive a copy; correct; delete; restrict or object to processing; withdraw consent; complain; and seek protection of your rights.

Send a request to support@matchup.io.vn with your account email, the request type, and information needed to verify that you are the data subject. Do not email a password, OTP, or identity document unless we have directed you to a secure channel.

Matchup will acknowledge and handle the request within the applicable legal period. Withdrawing consent does not affect processing completed lawfully before withdrawal. Some data may not be immediately erasable because of legal duties, fraud prevention, disputes, or backup cycles; if so, we will explain the scope and reason.

We may update this notice over time. The current version and revision date will appear here; if a change creates a new purpose requiring consent, Matchup will ask again rather than treating continued use as acceptance.

The Matchup operator receives requests concerning personal data handled by the platform. For a question, rights request, or data-incident report, email support@matchup.io.vn with the subject “Personal data”. The Help & contact page lists technical details to include with a bug report.