Privacy Policy

1. Who we are (data controller)

Osii (business registration 247-70-00655), represented by 이재원, is the controller of the personal data described here.

Registered address: S189, Bldg 603, 26-21, Dongtanjungsimsangga 2-gil, Dongtan-gu, Hwaseong-si, Gyeonggi-do, 18453, Rep. of KOREA. Contact: support@scorvo.io. For data-protection requests specifically, write to privacy@scorvo.io.

2. Whose data, and what we collect

Operators. When you create an operator account you sign in through our authentication provider. We process your email address and display name to identify your account and secure it. We do not see or store your password. When you accept an invitation into someone else's club, the address you accepted with is written into that club's invitation record, so its owner can see who joined.

Players on a roster. Operators enter the people in their club — names, and the results and statistics of matches. An operator can also attach a photo of a player and write a private note about them; neither of those two ever appears on a page shared outside the club. Most players never hold an account with us; they are records an operator keeps. We do not ask for dates of birth, or for anything else whose purpose is to record how old a person is. That is a real limit on what we hold and not a complete one: the note is free text and the photo is a face, so those two hold whatever the operator puts there.

Uploads. When an operator imports results, the uploaded photo, PDF, or spreadsheet is stored so it can be read and so each figure can point back to its source. Extraction reads the file to draft rows; nothing is published until the operator confirms.

The in-app assistant. When an operator uses the assistant, what they typed, what it answered, and which actions it proposed are kept on the account, so that a conversation carries on from one turn to the next. Separately, every change made in the product — by hand or through the assistant — is written to a change record and an activity feed, which hold the values that were entered and the name of the operator who entered them.

Assistants an operator connects. An operator can also connect an outside AI client to their club — one that speaks the same protocol we publish. That client reads the club through us: the roster, the schedule, the standings, a player's statistics, whichever the operator's request needs. It is the operator's tool rather than ours, so what it does with what it reads is governed by whoever provides it; on our side we record which clients are connected and when each was last used.

Payments. Subscriptions and credit top-ups are handled by our payment provider as merchant of record. Card details go to that provider, not to us. The rest of the transaction does reach us: the provider's customer and subscription identifiers, the plan and its billing cycle, whether the subscription is active, past due, or cancelled, when the paid period ends, and the amount of an order together with any refund against it. The provider also passes us the email address you gave it — that is the address your billing email goes to, and we keep it on the delivery record of each message we send. In the other direction, when you open a checkout we pass the provider your IP address, which is how it settles the currency to charge you in.

Why you left. If you cancel a subscription that was charged at least once, we ask you once, after the cancellation is already final, why you are going: a reason from a short list and, if you want to add one, a sentence in your own words. Both are optional; both are kept with your account. The reason you pick is also passed to our payment provider. The sentence you write is not — it stays with us. A subscription whose first payment never completed is not a departure and we do not ask.

Visits. Every page reports a page view to our analytics provider so we can see which parts of the product are used. We set no cookie for it, and that provider states the measurement is not tied to an individual. Page addresses that are themselves credentials — a share link, a club invitation, the link that stops a pending account deletion, the link that opens a receipt for a payment we returned — are rewritten to a placeholder in your browser before that page view leaves it.

3. Why we process it (legal bases)

To provide the service you asked for — running your club's competitions — which is the performance of our contract with you (GDPR Art. 6(1)(b)).

To keep the service secure, working, and improving, which is our legitimate interest (Art. 6(1)(f)), balanced against your rights.

To meet legal obligations such as tax and accounting records tied to payments (Art. 6(1)(c)).

4. Players' names on shared pages

A club's standings can be shared as a link, and two settings on that link decide what a visitor meets. The first is who may open it. A private link opens for nobody. An unlisted link and a public link behave identically — each opens for anyone holding the address — and what separates them is the operator's intention to circulate it, not anything we enforce differently. The second is how players are named — and we should be plain about its default, which is the full name the operator entered. An operator who does not want family names on that page turns that setting off, and the page then prints the given name alone. The two settings are independent: making a link unlisted does not change how players are named, and neither does making it public.

That setting has an honest limit. What it prints is the given name held separately from the full one, so it hides nothing for a player who has no separate given name on file — a roster pasted in one name to a line does not, and for those players turning the setting off changes nothing at all.

A shared page carries the tournament: its programme, its results, and the standings. There is no public page of an individual player's statistics — no such page exists outside the club's own screens. Team line-ups are the one further section an operator can open, and a link is created with them closed. Player photos and operators' notes are never on that page at all.

A player who has results is not deleted when an operator removes them from the roster; they are archived, which takes them off the club's roster screen and leaves them named where those results are already published. A player with no results at all is deleted outright.

5. Who else processes it (subprocessors)

We use a set of processors, each for a stated purpose: Clerk (account authentication), Convex (application database), Vercel (application hosting), Vercel Web Analytics (cookieless visit measurement), Cloudflare R2 (file storage — uploaded import files, player photos, and the daily database backup), OpenAI (reading uploaded files to draft import rows, and running the in-app assistant), Polar (payment processing, as merchant of record), Resend (sending the service email we send you), Sentry (error and performance diagnostics — set not to attach IP addresses or request bodies, while request headers and cookies are attached with sensitive-looking names filtered out), Google (Maps Platform for venue address search, and Workspace for the mailboxes that receive what you write to us), and GitHub (source hosting, and the scheduled job that takes the daily database backup).

Two of those are worth a sentence more. A turn with the assistant carries the context it needs in order to act on your club — the club's name and time zone, its venues, its teams, and its roster, which is to say the players' names as you entered them. And the address search reaches Google from the operator's browser rather than from our servers, so Google sees that request the way it sees any website's map search.

Some of these operate in the United States, so some processing happens outside your country. Where that is the case, transfers rely on the safeguards those providers offer, such as standard contractual clauses. We list only the processors we actually use today; if that set changes, this policy changes with it.

6. How long we keep it

We keep account and club data while the account is open. Deleting your account ends your access to Scorvo and starts a thirty-day grace period, and we ask our payment provider to cancel a subscription that is still billing on it. The pages you shared out of the clubs that go with that account stop opening at the moment we receive the request, rather than at the end of those thirty days — nothing about them is erased yet, but nobody can read them while the grace period runs. When those thirty days are up, the rest is erased automatically and without you having to ask: the clubs you owned and everything in them — the roster, the results and statistics, the shared links, the files uploaded into them, the record of what your credits were spent on — and, wherever they were held, the conversations you had with the assistant.

A club that belongs to someone else, one you were invited into, is not yours to erase and stays. Your membership of it goes, and so does anything the club holds that is about you rather than about the club — but two things remain, because they are that club's own record rather than yours: the invitation you accepted, which is how its owner can see who joined and with what address, and any file you uploaded into it, which is the provenance of results that club has published.

Erasure is the default, and what survives it is only what a law obliges us to keep. Two things do. The first is the record of money: the subscription itself, the orders, the credits an order granted, any refund against it, and the delivery record of the messages we sent you about them. The second is any formal cancellation or withdrawal you sent us — the statutory notice itself, which by its nature records who declared what, and which we therefore keep as you wrote it.

The periods are set by law rather than by us. Korean e-commerce law sets five years for records of a contract, a withdrawal, a payment, and what a payment supplied; Korean tax law sets five years from the filing deadline for the books behind them; German commercial and tax law set eight years for accounting vouchers and six for business correspondence, and ten for the accounting records those vouchers support. We keep the whole set for ten years from the erasure, because it hangs together on one record and taking part of it away early would leave the rest unfindable; ten is the longest period any of those laws puts on any part of it, and we do not hold it longer. A cancellation or withdrawal sent through the public form is not always tied to an account — a withdrawal never is, and a cancellation only when the address you give us matches one. Neither those declarations nor the confirmations we send for them have an account to hang from, so they run on their own clock instead: six years from the end of the calendar year in which they reached us, which is what German commercial law puts on a business letter we received.

From the moment we erase the rest, we take out of that record everything that identifies you and is not the record itself: the link to your sign-in becomes an internal reference, and the address and the wording on a delivery record are replaced. Two things stay as they are, and we would rather say so than let you assume otherwise. A cancellation notice keeps its declarant, because who declared what is the whole point of that document. And the payment record keeps our payment provider's own identifiers — for you, for the subscription, and for any payment we returned to you — because that is what makes it the record of a real transaction, and it means the provider, who is the merchant of record, can still connect it to you in its own books. Deleting your account here does not delete their customer record, and how long they keep it is theirs rather than ours. When our ten years are up, everything described in this section and the internal reference go with it.

Two things about the thirty days are worth being exact about. Nothing is erased while they run, so a deletion made by mistake can still be stopped by writing to privacy@scorvo.io within them, and the shared pages we closed open again if it is — though the sign-in itself is gone at that point and cannot be brought back, so returning means a new sign-in attached to the same records. And if our payment provider has still not accepted the cancellation when the thirty days end, we hold the erasure until it does, so that a charge is never left standing with no record of whose it was; we check for that state every day and raise it as a fault when it outlives the provider's own retry window.

Uploaded import files are kept as the provenance of the figures read from them, for as long as the club that holds them is kept — which is why an upload into someone else's club outlives your account. A cancellation reason is kept with the account and outlives the subscription it describes — it can only be written after that subscription has been cancelled, only while nothing else on the account is being charged, and only for a subscription that was charged at least once — and it is erased with the account, because it is a survey we asked rather than a record we must keep.

A backup snapshot of the database is taken once a day and kept for thirty days, so a record we erase leaves those backups within that window rather than at the moment we erase it. Uploaded files and player photos live in object storage, which that backup does not cover — erasing one of those erases it once.

7. Your rights

You may ask us to give you a copy of your personal data, correct it, delete it, restrict or object to its processing, or provide it in a portable form. To exercise any of these, write to privacy@scorvo.io.

Because a player is usually a record kept by an operator rather than an account holder, a player's request is normally handled through the operator who keeps that roster; we will help where we are the right party to act. To protect against disclosing data to the wrong person, we verify identity before we act on a request.

If you are in the EU or UK and believe we have not handled your data properly, you may complain to your local data-protection authority.

8. Cookies

We use only the cookies the service needs to work: the session cookies our authentication provider sets to keep you signed in, and a small preference cookie that remembers your language. Our visit measurement sets none of its own — it is the cookieless kind. We do not use advertising or cross-site tracking cookies. A few preferences and unfinished drafts are held in your browser's own storage rather than on our servers — your theme, a score sheet you have not submitted, which assistant conversation a tab is on — and none of that leaves your device by itself.

9. Changes

If we change this policy, we update the date at the top. Material changes will be made clear on this page.

10. Contact

For anything in this policy, or to exercise a right, write to privacy@scorvo.io. For everything else, support@scorvo.io.