Privacy Policy

Last updated: [DATE — set when first published]

Placeholders to fill in before this goes live: legal name/entity, domain, and support email are marked like this throughout. This draft reflects the product as planned on 2026-09-11 (squad-private analysis, no cross-squad player search yet) — update it before any recruitment/ scouting feature ships, since that processes data about people who have never used Vormation and changes several sections below.

This policy explains what personal data Vormation collects, why, and what rights you have over it. It's written to comply with the UK GDPR and the Data Protection Act 2018.

1. Who we are

Vormation is operated by [Your full legal name], an individual based in the United Kingdom, trading as Vormation (vormation.com). For data protection purposes, this is the "data controller."

Contact: PLACEHOLDER-support@vormation.com

2. What we collect

Account data: the email address and password (or sign-in method) you use to create a Vormation account.
Riot match data: for each player you add to a squad, we fetch that player's Riot ID, PUUID, ranked tier, and completed-match statistics (champion, role, kills/deaths/assists, damage, gold, vision score, and similar in-match numbers) directly from Riot Games' official API. We do not read chat logs, voice, or anything from a match while it is in progress.
Billing data: if you subscribe to a paid tier, our payment processor (Stripe) handles your card details directly — we receive a subscription status and Stripe customer reference, never your full card number.
Basic technical data: IP address and standard server logs, kept only as long as needed for security and abuse prevention.

3. Tracking players who aren't the account holder

A squad is normally five people, and not everyone who's tracked will necessarily be the person who set the squad up. We only add a player to a squad's tracked roster with that player's consent — either because they created their own Vormation account and joined the squad, or because they were invited and accepted. If you're contacted about being removed from a squad you didn't agree to be tracked in, email us and we'll act on it.

4. Why we process this data

Contract: to provide the account and analysis features you've signed up for.
Consent: for tracking a squad member who isn't the account holder.
Legitimate interest: basic security, fraud prevention, and service reliability.

5. Who we share data with

We share data with the minimum necessary to run the service:

Riot Games — as the source of match data. Riot's own privacy practices govern the data it holds directly.
Stripe — if you have a paid subscription, to process payment.
Our hosting provider — to run the service. [Name hosting provider(s) once chosen].

We do not sell personal data, and we do not act as a data broker reselling Riot data to any other party — this is also prohibited under Riot's own API terms.

6. How long we keep data

Account data is kept while your account is active. Match data fetched from Riot is kept so analysis doesn't require refetching the same match repeatedly, and may be retained even after a squad stops tracking a player if the same match is shared with another squad — raw match records aren't deleted purely because one squad removes a player, since the record itself belongs to the match, not to any one squad. Analysis results computed about you personally are deleted on request (see below).

7. Your rights

Under UK GDPR, you have the right to:

access the personal data we hold about you;
have inaccurate data corrected;
request erasure of your personal data;
object to or restrict certain processing;
receive your data in a portable format;
complain to the UK Information Commissioner's Office (ICO) if you think we've mishandled your data.

To exercise any of these, email PLACEHOLDER-support@vormation.com. We also honour deletion requests that Riot forwards to us under its own API terms.

8. Children

Vormation isn't directed at children under 13, and accounts require an existing League of Legends account, which itself carries Riot's own minimum age requirements.

9. Security

We take reasonable technical and organisational measures to protect your data, including never storing your Riot API credentials on a client device — the API key used to fetch match data is held server-side only, never distributed to users or third parties. No method of storage or transmission is 100% secure, and we can't guarantee absolute security.

10. Changes to this policy

We'll update the date at the top of this page when this policy changes, and post material changes prominently before they take effect.