Privacy policy

The data controller is Killian Paulic, an individual established in France, who publishes Staq.

For any question about your data, one address: contact@staq.gg.

For payments, Creem (Armitage Labs OÜ, Estonia), the seller of our paid plans, is a separate controller of the data you give it at checkout: its privacy notice applies.

• Account: display name, email address, avatar, technical identifier and sign-in tokens sent by Discord or Google when you sign in, Discord user ID, chosen language, creation and last sign-in dates. If you link a Discord account from your Account page: its ID, username and avatar.
• Email notifications: your contact email if you add one (only used for notifications, never to sign in), your notification preferences, the history of emails sent (address, type of email, date, delivery status) and, if an address rejects our emails or reports them as spam, that address and the reason.
• Game profile: your Riot ID, if you choose to add it. Staq doesn't connect to your Riot account and fetches no data from Riot Games.
• Team life: teams and roles, availability, planned sessions and RSVPs, results, notes, strategies and lineups, images you upload (team logo, images on a strategy), VOD reviews (link to the video and timestamped notes), opponent pages, the team's activity log.
• Player files (coach tools): the notes, reviews (ratings and comments), goals and roster history (arrivals, departures, role and status changes, past attendance) your team's staff keep about you, and your replies to reviews.
• Scoreboard screenshots: the image you upload, the AI's raw reading of it and the stats extracted for your team's players. The image and the raw reading also show the opposing players' names: that's personal data, kept for a short time only (see below).
• Discord: your server's webhook address (encrypted in the database) or, with the bot, the server and channel IDs and the channel's name; the history of messages sent; the Discord user ID of whoever uses a /staq command or a button.
• Subscription: the team's plan, status and dates of the subscription or pass, amount paid, customer and subscription IDs at Creem, promo code used, and the adult confirmation of an organization's owner. To prefill checkout, Staq sends Creem your account's email address and technical IDs (team, account). Your card details are entered at Creem: Staq never sees them.
• Where your visit came from: if you arrive through a campaign link (utm, ref or promo code parameters, from Facem for example), the source, campaign, code, first page seen and date. This is attached to your account when you sign up.
• Technical data: IP address, browser type, requested pages and errors, in the server logs.

We collect no sensitive data within the meaning of the GDPR and we don't ask for your date of birth.

Purpose

Create your account and sign you in

Data

Account

Legal basis

Performance of the contract (the terms of use)

Purpose

Run the team: roster, availability, planning, RSVPs, content

Data

Account, game profile, team life

Legal basis

Performance of the contract

Purpose

Send Discord reminders, answer the bot's commands and buttons, generate the calendar feed

Data

Team life, Discord

Legal basis

Performance of the contract

Purpose

Let the staff follow each player's progress (notes, reviews, goals)

Data

Player files, team life

Legal basis

Performance of the contract

Purpose

Send you the email notifications you kept on (sessions, reminders, availability, role, trial and pass end) and confirm your contact address

Data

Account, email notifications, team life

Legal basis

Performance of the contract. You choose which ones on your Account page, and every email has an unsubscribe link

Purpose

Stop writing to an address that rejects our emails or reports us as spam

Data

Email notifications

Legal basis

Legitimate interest: not insisting with a mailbox that refuses, and keeping our emails deliverable

Purpose

Read scoreboards and compute your team's stats

Data

Screenshots, stats

Legal basis

Performance of the contract

Purpose

Read the opposing names shown on a screenshot, and keep them only until the image is deleted

Data

Opposing names (short-lived)

Legal basis

Legitimate interest: analyzing a match your team played in, with minimal impact on the opposing players

Purpose

Sell and manage paid plans, the trial and promo codes (with Creem)

Data

Subscription, visit origin

Legal basis

Performance of the contract

Purpose

Know which campaigns bring teams (a Facem campaign, for example)

Data

Visit origin

Legal basis

Legitimate interest: understanding what works, without ad profiling

Purpose

Secure the service, prevent abuse, fix bugs

Data

Technical data

Legal basis

Legitimate interest: service security

Purpose

Answer your messages and requests

Data

What you write to us

Legal basis

Legitimate interest, or legal obligation when you exercise your rights

Purpose

Keep proof of payments and meet our legal obligations

Data

Subscription, technical data

Legal basis

Legal obligation, and legitimate interest (proof)

When you upload a scoreboard screenshot, the image is stored on our server and sent to Anthropic, our AI provider, which reads the stats table.

Only the rows of your team's players are kept for good. From the opposing team, only the agents played are kept (no names).

The image and the AI's raw reading, which shows all ten names, are deleted automatically 30 days after upload. Until then they're never public: only your team's members can see the image.

Anthropic acts as our processor. Under its commercial terms, it doesn't use this data to train its models.

If you appear on a screenshot uploaded by another team and want to exercise your rights, email us at contact@staq.gg.

• Your team's members see your name, avatar, Riot ID if you've added it, your availability and RSVPs. They also see the stats taken from scoreboards.
• People with a share link (for a strategy, for example) see the shared content, not your account data.
• Your teams' staff (owner, managers, coaches) see your contact email and whether your Discord account is linked, to check reminders reach you. Other players don't see your email.
• The Discord channel set up by your team receives reminders, which may mention you if your Discord account is linked.
• Creem, for payments, as described above.
• Our providers, listed below, only for what their job requires.
• Authorities, when the law requires it.

We don't sell, rent or trade any data. There are no ads on Staq.

Your team's staff (owner, managers, coaches) can keep a file on each player: notes, reviews and goals. Each note and goal is either staff only or shared with you. A review reaches you once the staff shares it.

You see everything shared with you on your player page, and you can reply to reviews. Other players never see your file.

Staff-only notes are about you too: like any personal data, you can ask us for them at contact@staq.gg.

Staff are asked to write as if you could read them one day, and must never record health or other sensitive data. Many players are minors.

When you leave a team, your file stays with its staff for 12 months, then it's deleted automatically. If you come back before that, your history continues.

When you delete your account, every file about you is deleted. If you were staff, your staff-only notes and unshared review drafts go too; what a player already received stays in their file, signed as former staff.

Nothing from a player file is ever sent to Discord or by email.

Provider

Hostinger International Ltd (Cyprus)

What for

Hosting of the website, database and uploaded files (virtual private server)

Data

All the data described on this page

Location

Germany (EU)

Provider

Cloudflare, Inc.

What for

Off-server copy of the database backups (R2 storage)

Data

Database backups

Location

United States

Provider

Anthropic, PBC

What for

AI reading of scoreboard screenshots

Data

The screenshot (players' names and stats)

Location

United States

Provider

Resend, Inc.

What for

Sending notification emails

Data

Contact email address, email content, delivery status

Location

European Union (Ireland)

Provider

Discord Inc.

What for

Sign-in with Discord, reminders through webhooks and the Staq bot

Data

Discord ID and profile, content of reminders (session names, mentioned players)

Location

United States

Provider

Google (Google Ireland Limited)

What for

Sign-in with Google

Data

Name, email address, avatar

Location

Ireland and United States

Creem isn't our processor: as merchant of record, it's a separate controller for payment data (see above).

Anthropic, Cloudflare, Discord, Google and Resend are, or belong to, US companies. For transfers to the United States, we rely on the EU-US Data Privacy Framework when the provider is certified, and otherwise on the European Commission's standard contractual clauses.

Discord and Google are also responsible for their own processing when you use their services: their privacy policies apply.

Staq uses no audience measurement or advertising tool.

Data

Account and profile

Duration

As long as your account exists. Erased (the account is anonymized) when you delete it.

Data

A team's content

Duration

As long as the team exists. Erased with the team.

Data

Player file of a current member (notes, reviews, goals, history)

Duration

As long as the team and the account exist

Data

Player file of someone who left the team

Duration

12 months after they left, then automatic deletion

Data

Scoreboard screenshots and the AI's raw reading

Duration

30 days after upload, then automatic deletion

Data

Your team's stats extracted from screenshots

Duration

As long as the team exists

Data

Discord webhook addresses, linked channels and message history

Duration

Until you remove them, or until the team is deleted

Data

Contact email and notification preferences

Duration

As long as your account exists. Erased when you delete your account.

Data

Address confirmation link

Duration

24 hours, then it stops working

Data

History of emails sent

Duration

60 days

Data

Address that rejected our emails or reported us as spam

Duration

Until its owner confirms it again from their Account page

Data

Visit origin

Duration

30 days in your browser (acq cookie); if you sign up, as long as your account exists

Data

Subscription data

Duration

During the subscription, then 5 years (proof and legal obligations). Creem keeps its own records as the seller.

Data

Server technical logs

Duration

Deleted by automatic rotation, after 12 months at most

Data

Backups

Duration

30 days at most: erased data also disappears from backups within that time

Data

Support conversations

Duration

3 years after the last message

Staq sets no advertising cookie and no third-party tracker, and uses no audience measurement tool. The cookies below are first-party: they keep the service working or remember a choice you made.

Cookie

authjs.session-token

What it does

Keeps you signed in (prefixed __Secure- over HTTPS)

Duration

30 days, extended when you use Staq

Cookie

authjs.csrf-token, authjs.callback-url, authjs.pkce.code_verifier, authjs.state

What it does

Secure sign-in

Duration

During sign-in, or until the browser closes

Cookie

NEXT_LOCALE

What it does

Remembers your language

Duration

1 year

Cookie

active_team

What it does

Remembers the team on screen

Duration

1 year

Cookie

pending_promo

What it does

Remembers the promo code of a Staq link you opened, to apply it to your team

Duration

30 days

Cookie

acq

What it does

When you arrive through a campaign link: remembers where your visit came from (source, campaign, promo code), attached to your account if you sign up

Duration

30 days

Cookie

staq_hide_payment, staq_hide_trial_ending, staq_hide_trial_ended

What it does

Remembers that you closed a banner

Duration

Until the browser closes, 1 day or 7 days

Staq also keeps a few settings in your browser's local storage, read only by Staq's pages: the team shared between your tabs (staq.activeTeam), the guided tours and tutorials already seen (staq.tour.*, staq.tutorial.editor), the availability filter (staq.heatmap.filter), the strategy board's display and last step viewed (strategy.*) and the lineups display (lineups.callouts). While a strategy edit hasn't reached the server yet (connection lost), a copy is kept in your browser (IndexedDB staq-strategy) and deleted once sent.

When you open a VOD review or a lineup with a video, the video plays in the embedded player of YouTube (youtube-nocookie.com), Twitch or Streamable, and YouTube thumbnails load from i.ytimg.com. These services then receive your IP address and may use their own cookies or storage, under their own policies.

At any time, you can:

• access your data and get a copy;
• have it corrected;
• have it erased (deleting your account from My account does it directly);
• object to processing based on our legitimate interest;
• ask for processing to be restricted;
• get the data you gave us in a machine-readable format (portability): download yours, including what your staff shared with you, from your player page (My data); for a team, the owner or a manager can also export everything from Staq directly;
• set instructions for what happens to your data after your death.

Email us at contact@staq.gg. We answer within a month. We may ask you to prove your identity, for example by writing from the address linked to your account.

If you think your rights aren't respected, you can complain to the CNIL (cnil.fr) or to your country's data protection authority.

Staq is also used by players under 18. In France, you can consent on your own to the processing of your data from 15; under 15, a parent's consent is also needed. In other EU countries, the applicable age is set by your national law.

We collect no more data about minors than about anyone else, we don't advertise and we don't profile anyone. Paid plans are bought by an adult.

A parent who wants their child's account deleted can email us at contact@staq.gg.

Encrypted connections (HTTPS), webhook addresses encrypted in the database, uploaded files never public and served only to the team's members, restricted server access and daily backups. No system is foolproof: if a data breach creates a risk, we notify the CNIL and the people concerned as the law requires.

If this policy changes significantly, we'll tell you in the app before it takes effect. The last update date is shown at the top of the page.