Parlay Tourney

Privacy Policy

Last Updated: July 2026

1. Introduction

Parlay Tourney ("Company," "we," "us," or "our") is committed to protecting your privacy and personal information. This Privacy Policy ("Policy") explains in detail how we collect, use, disclose, transfer, store, and protect your information when you visit our website, use our mobile application, or otherwise interact with our platform (collectively, the "Platform"). This Policy applies to all users of the Platform, including registered members, visitors, and anyone else who accesses or uses our services.

BY ACCESSING OR USING THE PLATFORM, YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREE TO THE TERMS OF THIS PRIVACY POLICY. If you do not agree with our policies and practices, you must not use the Platform. This Policy is incorporated into and is subject to our Terms of Service.

We are the data controller of your personal information for purposes of applicable data protection laws. This means we determine the purposes and means of processing your personal data.

2. Information We Collect

We collect several categories of information from and about users of our Platform. The types of information we collect depend on how you interact with us.

Personal Information You Provide Directly

We collect personal information that you voluntarily provide when you register, use our services, or communicate with us:

IDENTITY AND CONTACT DATA: Full name, username, email address, phone number, date of birth, residential address, city, state/province, postal/ZIP code, country of residence, and government-issued identification numbers.
ACCOUNT DATA: Username, password (hashed and encrypted), account preferences, profile picture/avatar, nickname, and account settings.
FINANCIAL DATA: Cryptocurrency wallet addresses, transaction history, deposit and withdrawal records, payment-provider metadata, and, where supported or required, limited payment method, bank, or tax information. Payment card or bank details, if offered, are processed by payment providers; we do not store full card numbers.
KYC/VERIFICATION DATA: Government-issued photo identification (passport, driver's license, national ID card), selfie photograph with ID, proof of address documents (utility bills, bank statements), social security number or equivalent (for US users as required), and any other identity verification documents.
COMMUNICATION DATA: Records of your correspondence with us, including customer support inquiries, emails, chat messages, dispute correspondence, and any other communications.
USER-GENERATED CONTENT: Profile pictures, profile descriptions, chat messages sent to other users, and any other content you create or share on the Platform.

Information Collected Automatically

When you access or use the Platform, we automatically collect certain information through cookies, web beacons, log files, and similar technologies:

DEVICE AND TECHNICAL DATA: IP address, device type and model, operating system and version, browser type and version, device identifiers (including advertising IDs), mobile network information, screen resolution, language settings, and time zone.
USAGE AND ACTIVITY DATA: Pages visited, features used, time spent on pages, links clicked, tournament entries and picks submitted, transactions initiated, search queries, referring/exit URLs, scroll depth, mouse movements, and interaction patterns.
LOCATION DATA: Precise geolocation data (with your permission), IP-based approximate location, and GPS coordinates (for mobile app users who enable location services). We use location data for geofencing compliance and regional service availability.
COOKIES AND TRACKING DATA: Session cookies, persistent cookies, authentication tokens, and analytics identifiers. See Section 10 for our detailed Cookie Policy.
SERVER LOG DATA: Timestamp of access, pages requested, HTTP status codes, data transfer volumes, and error logs. These are automatically collected by our web servers and cloud infrastructure.

Information from Third-Party Sources

We may receive information about you from other sources:

Identity verification services and KYC providers we use to verify your identity and comply with legal requirements
Payment processors and financial institutions for transaction verification and fraud prevention
Sports data providers whose APIs we consume to provide tournament results
Analytics and marketing partners that provide aggregated demographic and interest data
Government sanctions lists, politically exposed persons (PEP) databases, and adverse media checks for compliance screening

3. Legal Basis for Processing

We process your personal information based on the following legal grounds, depending on the nature of the processing and your jurisdiction:

CONTRACTUAL NECESSITY: Processing is necessary for the performance of our contract with you (the Terms of Service), including providing account services, processing tournament entries, distributing prizes, and facilitating deposits and withdrawals.
LEGAL OBLIGATION: Processing is necessary to comply with our legal obligations, including KYC/AML regulations, tax reporting requirements, law enforcement requests, court orders, and data retention mandates.
LEGITIMATE INTERESTS: Processing is based on our legitimate business interests, which include: fraud prevention and detection, network and information security, platform improvement and optimization, marketing our services to existing users, understanding usage patterns, enforcing our Terms of Service, and defending against legal claims. We balance these interests against your rights and freedoms.
CONSENT: Where required by applicable law, we obtain your explicit consent before processing certain categories of data (e.g., precise geolocation, marketing communications to non-customers, or sensitive personal data). You may withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
VITAL INTERESTS: Processing necessary to protect your vital interests or those of another natural person, such as in emergency situations.
PUBLIC INTEREST: Processing necessary for tasks carried out in the public interest, such as reporting criminal activity to law enforcement.

4. How We Use Your Information

We use the information we collect for the following specific purposes:

ACCOUNT MANAGEMENT: Creating, maintaining, and securing your account; authenticating your identity at login; processing account updates and preferences; managing account verification and recovery.
TOURNAMENT OPERATIONS: Processing your tournament entries; recording and displaying your picks; calculating and verifying scores; determining winners and rankings; distributing prizes; displaying leaderboards and statistics.
FINANCIAL PROCESSING: Processing deposits and withdrawals; maintaining transaction histories; reconciling accounts; calculating fees, rake, and jackpot contributions; generating financial reports; facilitating cryptocurrency transactions.
IDENTITY VERIFICATION: Conducting KYC checks; verifying age (18+ requirement); validating identity documents; screening against sanctions and PEP lists; preventing multi-accounting; ensuring compliance with AML regulations.
COMMUNICATIONS: Sending account-related notifications (password resets, transaction confirmations, prize notifications); providing customer support and responding to inquiries; sending service announcements and updates; requesting feedback through surveys.
MARKETING AND PROMOTIONS: Sending promotional emails and notifications about new tournaments, features, and offers (with opt-out capability); displaying targeted advertisements (based on anonymized data); running promotional campaigns and bonuses; measuring marketing campaign effectiveness.
PLATFORM IMPROVEMENT: Analyzing usage patterns to improve user experience; developing new features and services; testing and debugging; optimizing platform performance; conducting research and analytics.
SECURITY AND FRAUD PREVENTION: Detecting and preventing fraudulent activity; monitoring for suspicious transactions and multi-accounting; enforcing Terms of Service; protecting against unauthorized access; maintaining platform integrity; conducting security audits and investigations.
LEGAL COMPLIANCE: Complying with applicable laws and regulations; responding to legal process and law enforcement requests; filing required reports with regulatory authorities; maintaining records for tax and audit purposes.
PERSONALIZATION: Customizing your experience based on preferences and activity; displaying relevant tournament recommendations; remembering language and display preferences; tailoring content delivery.

5. Information Sharing and Disclosure

We do not sell your personal information to third parties for monetary consideration. We may share your information in the following circumstances:

Categories of Recipients

SERVICE PROVIDERS: Companies that perform services on our behalf, including: cloud hosting (Supabase, Vercel), payment processing providers such as NOWPayments and any card or fiat providers we enable, identity verification, email delivery, SMS notifications, customer support platforms, and analytics providers. These providers are contractually bound to process data only as instructed by us.
PAYMENT PROCESSORS: Financial institutions and payment service providers that process your deposits and withdrawals. We share only the information necessary to complete transactions.
LEGAL AND REGULATORY AUTHORITIES: When required by law, court order, subpoena, or governmental regulation. We may also share information to report suspicious activity to financial intelligence units, law enforcement, or regulatory bodies as part of our AML/KYC obligations.
PROTECTION OF RIGHTS: When we believe disclosure is necessary to: (a) protect our rights, property, or safety; (b) protect the safety of our users or the public; (c) investigate and defend against legal claims; (d) enforce our Terms of Service; or (e) detect, prevent, or address fraud, security, or technical issues.
BUSINESS TRANSFERS: In connection with a merger, acquisition, reorganization, sale of assets, financing, or bankruptcy. If such a transaction occurs, we will notify you before your information is transferred and becomes subject to a different privacy policy.
AFFILIATES AND SUBSIDIARIES: Within our corporate group for internal administrative purposes, provided they adhere to equivalent data protection standards.
WITH YOUR CONSENT: To any other third party when you have provided explicit consent for such sharing.

We do not and will not sell your personal information. "Sale" means the exchange of personal information for monetary or other valuable consideration. We do not share personal information with third parties for their own direct marketing purposes without your consent.

6. Subprocessors and Infrastructure Providers

We rely on the following types of third-party subprocessors to deliver our services. All subprocessors are contractually obligated to implement appropriate technical and organizational security measures:

CLOUD HOSTING AND DATABASE: Supabase (database, authentication, storage), Vercel (web hosting and edge functions). These providers host and process data on infrastructure located in the United States and globally.
PAYMENT INFRASTRUCTURE: NOWPayments for cryptocurrency payments and any additional card, fiat, or payout providers we enable. Payment card or bank data, if supported, is processed directly by those providers; we do not store full card numbers.
IDENTITY VERIFICATION: Third-party KYC/AML service providers that verify identity documents against government databases and sanctions lists.
SPORTS DATA: ESPN APIs and The Odds API provide sports statistics, scores, and game data used for tournament scoring.
COMMUNICATIONS: Email service providers for transactional and marketing emails; SMS providers for text notifications.
Analytics and error tracking: Google Analytics (usage analytics, via Google Tag Manager) and Sentry (application error monitoring). These providers process technical data such as device information, pages visited, and error reports on our behalf.

7. International Data Transfers

Your personal information may be transferred to, stored in, and processed in countries other than the country in which you reside, including the United States, where our primary infrastructure is located. These countries may have data protection laws that differ from those in your jurisdiction.

When we transfer personal data across borders, we implement appropriate safeguards to ensure your data remains protected, including: (a) relying on adequacy decisions by relevant regulatory authorities; (b) implementing Standard Contractual Clauses (SCCs) approved by the European Commission; (c) ensuring recipients maintain adequate security measures; and (d) where required, obtaining your explicit consent for the transfer.

By using the Platform, you acknowledge and consent to the transfer, storage, and processing of your information in countries outside your country of residence, subject to the protections described in this Policy.

8. Data Security

We implement and maintain commercially reasonable administrative, technical, and physical security measures designed to protect your personal information against unauthorized access, disclosure, alteration, and destruction. Our security measures include:

ENCRYPTION: All data transmitted between your browser and our servers is encrypted using TLS 1.3. Sensitive data at rest is encrypted using AES-256 encryption. Passwords are hashed using bcrypt with unique salts.
ACCESS CONTROLS: Role-based access controls ensure that only authorized personnel with a legitimate business need can access personal information. Multi-factor authentication is required for administrative access.
INFRASTRUCTURE SECURITY: Our infrastructure is hosted on SOC 2 Type II compliant cloud providers. We employ firewalls, intrusion detection systems, DDoS protection, and continuous security monitoring.
SECURE DEVELOPMENT: We follow secure software development practices including regular security testing, vulnerability scanning, code reviews, and dependency audits.
INCIDENT RESPONSE: We maintain a documented incident response plan for data breaches and security incidents.
EMPLOYEE TRAINING: All employees and contractors with access to personal data receive privacy and security training and are bound by confidentiality obligations.

DATA BREACH PROCEDURES: In the event of a data breach involving your personal information, we will: (a) promptly investigate and contain the breach; (b) notify affected users and relevant regulatory authorities as required by applicable law within the legally mandated timeframe; (c) provide information about the nature of the breach, the categories of data affected, and the measures you can take to protect yourself; and (d) take steps to prevent recurrence.

DISCLAIMER: While we strive to protect your personal information, no security system is impenetrable. We cannot guarantee the absolute security of your data transmitted to or stored on our Platform. Any transmission is at your own risk. We encourage you to use strong, unique passwords and enable any available security features.

9. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements.

Our retention periods are based on the following criteria:

ACCOUNT DATA: Retained for the duration of your account plus seven (7) years after account closure to comply with tax, anti-money laundering, and other legal requirements.
KYC DOCUMENTS: Identity verification documents are retained for five (5) years after account closure or the last transaction, whichever is later, as required by AML regulations.
FINANCIAL RECORDS: Transaction records, deposit/withdrawal histories, and payment information are retained for seven (7) years to comply with tax and financial reporting laws.
COMMUNICATIONS: Customer support communications and dispute records are retained for three (3) years after resolution.
USAGE DATA: Anonymized usage and analytics data may be retained indefinitely for research and statistical purposes.
COOKIES: Cookie data retention periods vary by cookie type. Session cookies expire when you close your browser. Persistent cookies expire according to their set expiration dates (typically 30 days to 2 years).

When we no longer need your personal information, we securely delete, destroy, or anonymize it in accordance with industry standards. You may request earlier deletion as described in Section 11 (Your Rights).

10. Cookies and Tracking Technologies

We use cookies, web beacons, pixels, and similar technologies (collectively, "Cookies") to provide, improve, and analyze our Platform:

WHAT ARE COOKIES: Cookies are small text files placed on your device when you visit a website. They are widely used to make websites work efficiently and provide information to site owners.

TYPES OF COOKIES WE USE

ESSENTIAL COOKIES: Required for the Platform to function. These enable core features like secure login, account authentication, and transaction processing. The Platform cannot operate properly without these cookies. Legal basis: contractual necessity.
FUNCTIONAL COOKIES: Allow us to remember your preferences and choices (language, display settings, region) to enhance your experience. Legal basis: legitimate interest.
ANALYTICS COOKIES: Help us understand how users interact with the Platform by collecting information about pages visited, time spent, and features used. We use analytics data to improve our services. Legal basis: legitimate interest or consent (where required).
MARKETING COOKIES: Used to deliver advertisements relevant to your interests and measure campaign effectiveness. These may be set by us or third-party advertising partners. Legal basis: consent.
SECURITY COOKIES: Help us detect and prevent fraud, unauthorized access, and security threats by monitoring login patterns and detecting unusual activity. Legal basis: legitimate interest.

THIRD-PARTY COOKIES: Some cookies are placed by third-party services that appear on our pages. We do not control these cookies. Please review the privacy policies of these third parties for information about their cookie practices.

YOUR CHOICES: You can control and manage cookies through: (a) your browser settings (most browsers allow you to refuse or delete cookies); (b) our cookie consent banner (where applicable, you can accept or reject non-essential cookies); (c) opt-out tools provided by advertising networks (NAI, DAA, EDAA). Disabling essential cookies may prevent the Platform from functioning properly.

DO NOT TRACK SIGNALS: Some browsers have a "Do Not Track" (DNT) feature. Currently, our Platform does not respond to DNT signals because there is no consistent industry standard for how to interpret them. We continue to monitor developments in this area.

11. Your Data Protection Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information. We will respond to verified requests in accordance with applicable law:

RIGHT TO ACCESS: You may request a copy of the personal information we hold about you and information about how we process it. Your first copy in any 12-month period is free; we may charge a reasonable fee for additional copies.
RIGHT TO RECTIFICATION: You may request that we correct inaccurate or incomplete personal information we hold about you. You can update most account information directly through your profile settings.
RIGHT TO ERASURE ("RIGHT TO BE FORGOTTEN"): You may request deletion of your personal information, subject to legal retention requirements. We may retain certain information as required by law (e.g., KYC records, financial transactions) even after account deletion.
RIGHT TO RESTRICTION: You may request that we restrict processing of your personal information in certain circumstances, such as when you contest the accuracy of the data or object to processing.
RIGHT TO DATA PORTABILITY: Where processing is based on consent or contract and carried out by automated means, you may request to receive your personal information in a structured, commonly used, machine-readable format and have it transmitted to another controller.
RIGHT TO OBJECT: You may object to processing based on legitimate interests, including profiling. You have an absolute right to object to processing for direct marketing purposes at any time.
RIGHTS RELATED TO AUTOMATED DECISION-MAKING: We do not currently use automated decision-making or profiling that produces legal effects concerning you. If this changes, we will update this Policy and provide opt-out mechanisms.
RIGHT TO WITHDRAW CONSENT: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
RIGHT TO COMPLAIN: You have the right to lodge a complaint with a supervisory authority in your country of residence if you believe our processing violates applicable data protection law.
NON-DISCRIMINATION: We will not discriminate against you for exercising any of your privacy rights, including denying services, charging different prices, or providing a different quality of service.

CALIFORNIA RESIDENTS: If you are a California resident, the California Consumer Privacy Act (CCPA/CPRA) provides additional rights, including: knowing what categories of personal information we collect and share, knowing specific pieces of personal information we hold, opting out of the sale or sharing of personal information (we do not sell data), limiting use of sensitive personal information, and the right to non-discrimination. To exercise CCPA rights, contact us at support@parlaytourney.com with the subject line "CCPA Request."

EEA/UK RESIDENTS: If you are located in the European Economic Area (EEA) or the United Kingdom, the General Data Protection Regulation (GDPR) provides the rights outlined above. We process your data as described in Section 3 (Legal Basis for Processing). Our lead supervisory authority is the data protection authority of our EU establishment. You may contact our EU Representative at support@parlaytourney.com.

TO EXERCISE YOUR RIGHTS: Submit a verifiable request to support@parlaytourney.com. We will respond within the timeframe required by applicable law (typically 30 days, extendable in complex cases). We may need to verify your identity before processing your request. You may designate an authorized agent to submit requests on your behalf.

12. Marketing Communications

We may send you marketing communications about new tournaments, promotions, features, and offers through email, push notifications, SMS, and in-platform messages. You will only receive marketing communications if you: (a) have opted in where required by law; or (b) are an existing customer and have not opted out.

Every marketing email we send includes an unsubscribe link at the bottom. You may also opt out by updating your communication preferences in account settings or by contacting us. Opt-out requests are processed promptly, typically within 5-10 business days. Opting out of marketing does not affect our ability to send you essential service-related communications (transaction confirmations, security alerts, Terms updates).

We do not share your contact information with third parties for their own marketing purposes without your explicit consent. If you receive marketing communications purporting to be from us that seem suspicious, please forward them to support@parlaytourney.com.

13. Third-Party Links and Services

The Platform may contain links to third-party websites, applications, or services that are not owned or controlled by Parlay Tourney. This Privacy Policy does not apply to those third parties. We are not responsible for the privacy practices, content, or security of third-party services. We encourage you to review the privacy policies of any third-party services you interact with. The inclusion of a link does not imply our endorsement of the linked site or service.

14. Children's Privacy

The Platform is NOT intended for individuals under eighteen (18) years of age. We do not knowingly collect, use, or disclose personal information from anyone under 18. If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us immediately at support@parlaytourney.com.

If we discover that we have inadvertently collected personal information from an individual under 18, we will: (a) immediately cease processing such data; (b) take steps to delete the information from our systems as quickly as possible; and (c) terminate any associated account. We may retain a record of the deletion request for compliance purposes.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. The "Last Updated" date at the top of this Policy indicates when it was most recently revised.

For material changes, we will provide notice through one or more of the following methods: (a) email to the address associated with your account at least fourteen (14) days before the changes become effective; (b) a prominent notice on the Platform; (c) a pop-up notification requiring acknowledgment upon login. Your continued use of the Platform after the effective date of changes constitutes acceptance of the updated Policy.

We encourage you to review this Privacy Policy periodically to stay informed about our privacy practices. If you do not agree with the updated Policy, you must stop using the Platform and may request account deletion.

16. Contact Us

If you have questions, concerns, or would like to exercise your data protection rights, please contact us:

PRIVACY INQUIRIES: support@parlaytourney.com

GENERAL SUPPORT: support@parlaytourney.com

LEGAL NOTICES: support@parlaytourney.com

DATA PROTECTION OFFICER: Our Data Protection Officer can be reached at support@parlaytourney.com

We will acknowledge receipt of your inquiry within five (5) business days and provide a substantive response within the timeframe required by applicable law. Please include sufficient detail to allow us to properly address your request.

If you believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with the data protection supervisory authority in your jurisdiction.