PRIVACY POLICY

MatchSport® helps adults discover people nearby who share sports interests, match, chat, and organize pickup games through PlayNow! and Game Room (private group rooms with group chat).

This Policy covers the MatchSport® mobile app, informational web pages at matchsport.app (including /join, /privacy, /terms, /delete-account), and all registered users and website visitors.

The website does not allow joining Game Rooms or creating accounts - registration happens only in the app.

Where consent is required (including biometric verification, Section 3.4), you may withdraw it in Settings or by contacting us. Withdrawal does not affect prior lawful processing. Withdrawing biometric consent stops new verification captures; an existing Verified badge may remain until you delete your account or contact support@matchsport.app.

3.1 Account and profile

• Phone number (primary authentication)
• Optional email address
• First name / display name
• Date of birth (18+ verification)
• Gender
• Profile photos
• Favourite sports
• Optional room name and sports preferences for Play Now
• Approximate location (city / area label)

3.2 Authentication and security

• Account credentials managed by our authentication provider
• Google Sign-In and Apple Sign-In identifiers (if you choose them)
• SMS one-time codes for phone verification
• Device type, OS version, app version
• Push notification token
• Security logs (e.g. IP address, timestamps, failed logins)
• App integrity / anti-abuse signals (when enabled)

3.3 Location

When you grant location permission, we use it to show nearby users, games, and public sports events. We never collect or store your exact coordinates. We process and store only approximate location (city/area). Other users do not see coordinates; they may see a city or area, and in discovery an approximate distance in km. Approximate location may also be sent to the Norwegian Meteorological Institute (MET Norway) to show Home weather and Athlete Lens. You may disable location in device settings; some features will not work without it.

3.4 Identity verification (short-lived biometrics / face liveness)

We offer identity verification with short-lived biometric processing (face liveness) because MatchSport® is built for in-person sports: meeting other people to train or play. The purpose is to help reduce fake or impersonated profiles, improve safety and trust before face-to-face meetups, and show others a clear Verified / Not verified signal. It is a brief check that a real person is present for the capture, not advertising profiling, and not building a biometric matching database.

You can use the app without completing identity verification, including Home, browsing profiles within a limited daily allowance, liking, and chat. Unverified accounts show a Not verified badge. Higher in-person trust features (e.g. Play Now) may require verification. Verifying increases how many profiles you can see.

Before verification starts: separate explicit consent (Art. 9(2)(a) GDPR, not mixed with Terms/Policy). If you don't consent, you keep using the app with the Not verified badge and the limited profile allowance.

During verification, Amazon Web Services (AWS), including AWS Rekognition, performs face liveness and related image checks under our instructions as our processor. We use optional identity verification to improve safety before in-person sports meetups — not for advertising and not to build a face-matching database for marketing.

3.4.1 Face detection vs face comparison

Face detection on profile photo uploads checks that a face is present and meets basic position/size rules so photos work in the app. This is not biometric identification under GDPR Art. 4(14) and does not establish your identity.

Face comparison runs only after your separate explicit consent to biometric verification, for users who are or become Verified, when you change profile photos — to help keep the Verified badge meaningful. We retain only the match / no-match outcome needed for that check, not a reusable face print for unrelated purposes.

3.4.2 Face data — collection, use, sharing, retention, and deletion

This section describes how we handle face data for optional identity verification and related profile checks. We do not sell face data and we do not use face data for advertising.

What face data we collect

• Live camera capture during optional identity verification (face liveness).
• Registration and verification selfies stored in private storage associated with your account for verification and audit of the Verified badge.
• Profile photos you choose to publish: analyzed with face detection (position and size only, not identity); for Verified users who change photos, face comparison as described in Section 3.4.1.

Why we use it

• Reduce fake or impersonated profiles and improve safety before in-person sports meetups.
• Show a clear Verified / Not verified badge to other users.
• Not for advertising, profiling for ads, or building a marketing face database.

What we do NOT retain from the provider

MatchSport® does not keep AWS Rekognition biometric templates, liveness scores, or provider-retained face prints after processing. We keep the Verified / Not verified outcome on your account and, where applicable, match / no-match results from comparison checks — not a marketing biometric database.

Who we share face data with

Amazon Web Services (AWS) acts as our processor for face liveness and related image checks (including AWS Rekognition), under our instructions and data processing terms. We do not sell face data to third parties.

Third-party protection

AWS processes face data only on our instructions and must protect it under contract at least to the standard described in this Policy (GDPR Art. 28 and equivalent safeguards).

Retention

• Liveness processing is short-lived at AWS; we do not store provider templates or scores.
• We keep the verification outcome (Verified / Not verified) on your account while it exists.
• Verification selfies and related proof — see deletion below and Section 5.1.
• Public profile photos follow general photo retention while your account is active (other users may see photos you publish).

Deletion & revoking consent

• Before verifying: decline on the separate in-app consent screen — no biometric capture occurs.
• After verifying: withdraw biometric consent in Settings or email support@matchsport.app — this stops new biometric captures; your Verified badge may remain until account deletion or until you ask support to remove it.
• Delete account (Settings → Delete account, or see /delete-account): your account is hidden immediately; verification selfies and related proof are deleted immediately (not after the 7-day restore window). If you restore within 7 days, you must complete verification again to regain Verified status.
• Immediate erasure without waiting 7 days: email support@matchsport.app with subject [Data Subject Request].

3.5 Matching, chat, and social interaction

Discovery activity, match history, one-to-one chat, Game Room group chat, game invites, Play Now invites, blocks and reports.

3.6 PlayNow! and Game Room

Sport, skill level, scheduled time, venue information for the game, room membership, private invite links, post-game check-in, ratings, and reputation scores shown in the app.

3.7 Stories

Optional short-lived photo/video stories visible to mutual matches. Media is checked with automated moderation tools. Approved stories expire after a short period as shown in the app.

3.8 Payments and Premium

Premium subscription status and payment metadata from our payment processors - Stripe (Android and web checkout) and Apple (In-App Purchase on iOS). We do not store full card numbers. Price as shown in the app or at checkout.

3.9 Safety, moderation, and technical data

User reports, moderation notes, message text submitted to automated moderation tools when enabled (not used for advertising), aggregated usage metrics and crash data where enabled.

3.11 What other users can see vs what stays private

Other users may see (on profiles, discovery, or when you match / share a room): display name, public profile/gallery photos, favourite sports, city or area, approximate distance in km (discovery), verified badge, and product social signals you choose to share (e.g. stories visible to mutual matches, Game Room membership when you join).

Other users do not see (private to you and/or our servers under access controls): phone number, email, push tokens, internal location data used only for proximity, private registration selfie used for verification, payment card details (Stripe or Apple), blocks/reports internals, security logs, one-to-one or room chats (except participants), and moderation notes (restricted admin access).

Core service (account, matching, chat, Game Rooms, Play Now, push notifications); Premium billing via our payment provider; safety and integrity (reports, fraud prevention, identity verification where you choose it); aggregated service improvement; legal compliance.

5.1 Deleting your account: 7-day restore window

When you delete your account in the app, your profile is hidden immediately and you have a 7-day window to restore the account before permanent deletion of most personal data.

Face-related data: verification selfies, liveness-related proof files we store, and similar verification material are deleted immediately when you delete your account — not after the 7-day restore period. If you restore within 7 days, your account may return but you must complete identity verification again to regain a Verified badge.

Other categories (for example chat and profile fields) follow the retention periods in the table above. Payment records may be kept longer where required by law.

For erasure without using the in-app flow, email support@matchsport.app with subject [Data Subject Request] or Account Deletion Request.

When you delete your account, remaining personal data is erased within 30 days after permanent deletion (or sooner where stated above), except where law requires longer retention.

Olvexis App SL (operating the MatchSport® brand) is the data controller. The providers below act as processors under data processing agreements (GDPR Art. 28 where applicable), unless we state otherwise:

We do not sell, rent, or trade your personal information.

Some providers may process data outside your country, including in the United States. Where required, we rely on appropriate safeguards for international transfers (for example standard contractual clauses and provider commitments). Primary application data is hosted in the European Union where configured; verification may occur in the EU (Ireland).

You have the right to access, rectification, erasure, restriction, data portability, objection, withdraw consent (including biometric consent), and not be subject solely to automated decisions with legal or similarly significant effects.

You may withdraw consent to biometric processing and request deletion of face-related data as described in Section 3.4.2 and Section 5.1.

Contact: support@matchsport.app, subject [Data Subject Request] or Account Deletion Request. Response time: 30 days (extendable to 60 for complex requests).

Supervisory authority (Spain): Agencia Española de Protección de Datos (AEPD) - www.aepd.es

Delete your account in-app: Settings → Delete account, or see /delete-account.

Encryption in transit; access controls; server-side controls for sensitive actions; Stripe or Apple handle payment credentials. MatchSport® never stores full card numbers; rate limiting; breach notification as required by law.

MatchSport® is 18+ only. Accounts suspected of belonging to minors are suspended and deleted if confirmed.

Private invite links let people you choose open a join flow in the app. Only registered users can join after validation. The website page explains how to download and register; it does not grant room access by itself. Share links only with people you trust.

The mobile app does not use browser cookies. The website uses only essential cookies required for operation (if any). We do not use third-party advertising cookies on matchsport.app.

Matching and Play Now suggestions use some preferences you set (for example age range, distance, and shared sports). This is not credit scoring or employment screening. These suggestions do not produce legal effects or similarly significant effects under GDPR Art. 22. For significant account decisions (for example a suspension after safety reports), you may contact us to request a human review.

Spanish users retain rights under LOPDGDD. Identity verification and face data are described in Sections 3.4 and 3.4.2.

Material changes will be notified in-app and/or by email with 30 days' notice where required.

MatchSport® | Data Protection
Olvexis App SL · MatchSport®
Tax ID (CIF) B05644828 · Paseo de la Castellana 40, 8ª planta, 28046, Madrid, Spain
Email: support@matchsport.app

MatchSport® does not sell personal information or share it for cross-context behavioural advertising. California and other US state privacy rights: email support@matchsport.app with subject US Privacy Request. Response within 45 days where applicable.

Biometric / face data: see Sections 3.4 and 3.4.2. Approximate location only, we never store precise location. You may disable location in device settings (some features will not work).

MatchSport® is not directed to children under 13. Service restricted to users 18+.

By using MatchSport®, you acknowledge this Privacy Policy and confirm you are at least 18 years old. Identity-verification consent, where required, is collected separately in the app (Sections 3.4 and 3.4.2).

End of Privacy Policy, Version 2.3.5