Legal

Privacy Policy

Your privacy is important to us. This policy explains how we collect, use, share, and protect your information across our web and mobile applications.

Last updated: August 19, 2026

Introduction

Game Set Engage LLC ("GSE," "we," "us," or "our") operates a sports club engagement platform that connects clubs with their fans and partner venues. This Privacy Policy describes how we collect, use, disclose, and protect personal information when you use our website, mobile applications, and related services (collectively, the "Service").

This policy applies to all users of our Service, including fans, club owners, club team members, partner venues, and administrators. By using our Service, you acknowledge that you have read and understood this Privacy Policy. For information specific to EU/UK data protection, please also review our GDPR Compliance page. For details on cookies and tracking technologies, see our Cookie Policy.

Information We Collect

We collect information you provide directly, information generated through your use of the Service, and information from third-party sources.

Account and Profile Information

  • Name, email address, and contact information
  • Account credentials (passwords are hashed and never stored in plain text)
  • Club affiliation, user role (fan, club owner, club team member, partner venue, etc.), and biographical information
  • Profile pictures and avatar uploads (including via mobile app camera access)
  • Payment and billing information (processed securely through Stripe; we do not store full card numbers)

Location and Geolocation Data

Our Service collects location data to power campaign check-ins and determine engagement point multipliers. Specifically:

  • Precise geolocation: When you participate in a check-in campaign, we collect your precise GPS coordinates to verify your location (e.g., at a stadium, partner venue, or at home)
  • Location-based point multipliers: Your check-in location determines your engagement point multiplier — 5x at the stadium/event, 3x at a partner venue, or 1x at home
  • Location history: Check-in locations are stored in your campaign participation records
  • Geocoding data: We use the Google Places API to geocode club and venue addresses

You can control location sharing through your device settings. Disabling location access will prevent you from participating in location-based campaigns.

Mobile Application Data

When you use our mobile application, we may additionally collect:

  • Device identifiers (device type, operating system, unique device ID)
  • Push notification tokens (if you opt in to notifications)
  • Camera and photo library data (when you upload profile pictures or avatars)
  • App usage data, crash reports, and performance metrics
  • JWT authentication tokens stored securely on your device

Usage and Technical Information

  • Log data, IP addresses, browser type, and device information
  • Pages visited, features used, and time spent on our platform
  • Campaign participation records, engagement points earned, and interaction history
  • Event attendance, @mentions in event notes, and calendar interactions
  • Real-time connection data (via WebSocket/Action Cable for live updates)

How We Use Your Information

We use the information we collect for the following purposes:

Service Delivery

  • Provide, maintain, and improve our platform and features
  • Process campaign check-ins and calculate engagement points
  • Match fans with nearby clubs and partner venues
  • Process subscription payments and manage billing
  • Deliver real-time notifications and updates via Action Cable

Communication

  • Send transactional emails (account confirmations, password resets, receipts)
  • Send technical notices, security alerts, and support messages
  • Notify you of @mentions in event notes
  • Marketing communications (with your consent where required; you can opt out at any time)

Analytics and Improvement

  • Monitor and analyze trends, usage patterns, and platform performance
  • Personalize your experience and recommend relevant clubs and campaigns
  • Detect and prevent fraud, including location spoofing during check-ins
  • Conduct A/B testing and platform optimization

How We Share Your Information

We do not sell your personal information. We share information in the following circumstances:

Between Clubs, Fans, and Partner Venues

Our platform creates a three-way engagement model. Here is what each party can see:

  • Clubs can see: fan names and profiles of subscribers, the email addresses of fans subscribed to their club (including in fan-list exports such as segment exports), aggregated campaign participation data, check-in statistics (how many fans checked in at each location type), and individual fan engagement scores

When a club exports subscriber data (for example, a fan segment list), the club is responsible for using it in line with applicable data-protection and electronic-marketing laws — including honoring opt-out and unsubscribe requests for any communication it sends outside our platform. - Partner Venues can see: aggregated check-in counts at their venue, campaign performance metrics for campaigns they've partnered with, and general fan demographic data (not individual profiles, unless the fan checks in at their venue) - Fans can see: club information, campaign details, venue offers and incentives, and their own engagement history and points

Service Providers (Sub-Processors)

We share data with third-party companies that help us operate our Service:

  • Supabase — Database hosting and management (PostgreSQL)
  • Amazon Web Services (AWS) — File storage (S3) for uploads and avatars
  • Stripe — Payment processing and subscription billing
  • SendGrid — Transactional and marketing email delivery
  • Google Places API — Address geocoding and location services
  • Redis — Caching and real-time notification delivery

Each sub-processor is bound by data processing agreements that restrict their use of your data to the purposes of providing their services to us.

Legal and Safety

  • Legal requirements: When required by law, regulation, legal process, or governmental request
  • Rights protection: To enforce our Terms of Service, protect our rights or property, or investigate potential violations
  • Safety: To protect the safety of our users, the public, or GSE
  • Business transfers: In connection with a merger, acquisition, reorganization, or sale of assets, your information may be transferred to the acquiring entity

Legal Basis for Processing

We process your personal information based on the following legal grounds:

  • Contract performance: Account creation, service delivery, payment processing, customer support
  • Consent: Marketing communications, non-essential cookies, location data collection during check-ins, push notifications
  • Legitimate interests: Platform security, fraud prevention, analytics, product improvement, marketing to existing customers
  • Legal obligation: Tax record retention, regulatory compliance, responding to legal requests

Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes described in this policy:

  • Account data: Retained while your account is active. When you delete your account, the personal details on it are erased straight away — deletion takes effect immediately and cannot be undone
  • Billing and payment data: 7 years from the transaction date for tax and accounting purposes
  • Campaign participation and check-in data: Retained for the life of your account; anonymized upon account deletion
  • Marketing consent records: Until consent is withdrawn, or after 3 years of account inactivity
  • Analytics data: 26 months from the date of collection
  • Server logs: 90 days

Data Security

We implement appropriate technical and organizational measures to protect your personal information:

  • Encryption of data in transit (TLS/SSL) and at rest
  • Hashed password storage using industry-standard algorithms
  • Role-based access controls with seven distinct permission levels
  • Regular security assessments and vulnerability scanning
  • Automated backup and disaster recovery systems
  • Employee training on data protection best practices

Your Rights

Depending on your location, you may have some or all of the following rights regarding your personal information:

  • Access: Request a copy of the personal information we hold about you
  • Correction: Request that we correct inaccurate or incomplete information
  • Deletion: Request that we delete your personal information
  • Restriction: Request that we restrict how we process your information
  • Portability: Receive your data in a structured, commonly used, machine-readable format
  • Objection: Object to processing based on legitimate interests
  • Withdraw consent: Withdraw consent for processing that relies on consent (without affecting the lawfulness of processing before withdrawal)

To exercise any of these rights, contact us at privacy@gamesetengage.com or use the privacy controls in your account settings. We will respond within 30 days (or sooner if required by applicable law).

Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

Categories of Personal Information We Collect

  • Identifiers: Name, email address, device identifiers, IP address
  • Commercial information: Subscription plans, payment history, transaction records
  • Internet or electronic network activity: Browsing history, search queries, interaction data
  • Geolocation data: Precise GPS coordinates during campaign check-ins
  • Audio, electronic, or visual information: Profile pictures, avatars
  • Inferences: Engagement scores, campaign participation patterns, fan preferences

Your CCPA/CPRA Rights

  • Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected
  • Right to Delete: Request deletion of personal information we have collected
  • Right to Correct: Request correction of inaccurate personal information
  • Right to Opt-Out of Sale/Sharing: We do not sell personal information. We do not share personal information for cross-context behavioral advertising
  • Right to Limit Use of Sensitive Personal Information: You may limit our use of sensitive PI (including precise geolocation) to what is necessary for the Service
  • Right to Non-Discrimination: We will not discriminate against you for exercising any of these rights

To exercise your California privacy rights, email privacy@gamesetengage.com with the subject line "California Privacy Request." We will verify your identity and respond within 45 calendar days.

Do Not Track Signals

Our Service does not currently respond to "Do Not Track" browser signals. However, you can manage tracking preferences through our cookie consent settings and the opt-out links in our Cookie Policy.

International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States where our servers are located. When we transfer data outside your jurisdiction, we use appropriate safeguards including:

  • Standard Contractual Clauses (SCCs) approved by the European Commission
  • UK International Data Transfer Addendum where applicable
  • Adequacy decisions for countries recognized as providing adequate data protection
  • Additional technical and organizational safeguards where necessary

Children's Privacy

Our Service is designed for sports fans and is not directed to children. We apply the following age restrictions based on jurisdiction:

  • United States: We do not knowingly collect personal information from children under 13, in compliance with COPPA
  • European Union: We do not knowingly collect personal information from children under 16, in compliance with GDPR Article 8
  • United Kingdom: We do not knowingly collect personal information from children under 13, in compliance with UK GDPR

If we become aware that we have collected personal information from a child below the applicable age threshold, we will take steps to delete it promptly. If you believe a child has provided us with personal information, please contact us at privacy@gamesetengage.com.

Data Breach Notification

In the event of a data breach that compromises your personal information, we will:

  • Notify affected users without undue delay and, where feasible, within 72 hours of becoming aware of the breach
  • Notify relevant regulatory authorities as required by applicable law
  • Provide clear information about the nature of the breach, data affected, and steps we are taking
  • Offer guidance on steps you can take to protect yourself

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page, updating the "Last updated" date, and sending an email notification to registered users. We encourage you to review this policy periodically. Continued use of the Service after changes constitutes acceptance of the updated policy.

Contact Us

If you have questions about this Privacy Policy, our data practices, or wish to exercise your privacy rights, please contact us:

Game Set Engage LLC Email: privacy@gamesetengage.com Data Protection Officer: dpo@gamesetengage.com Subject: Privacy Policy Inquiry

For EU/UK-specific data protection matters, please see our GDPR Compliance page.