Privacy
Policy
Effective 14 April 2026 · Version 1.0
1. Who We Are
GG Anvil is a competitive gaming tournament management platform operated by Good Game Anvil. We provide tournament organisation, automated score verification, bracket management, and a player portal for competitive gaming.
Information Officer: Luke
Contact: privacy@goodgameanvil.com
This Privacy Policy explains how we collect, use, store, and protect your personal information in compliance with the Protection of Personal Information Act, 2013 (POPIA) of South Africa.
2. What Information We Collect
2.1 Information from Discord
When you authenticate via our Discord bot, we collect your Discord User ID, display name, avatar reference, and account flags.
2.2 Information You Provide
- Gamertag — your in-game username, used to link you to match results
- Contact form submissions — messages and your preferred reply method
- Billing email — if you administer an organisation
2.3 Information Generated Through Use
- Match screenshots submitted as evidence
- Scores extracted from screenshots via AI (OCR)
- Activity logs of administrative actions
- Match history, standings, and player statistics
- Clan and organisation memberships
2.4 Third-Party Sources
We may enrich your profile with publicly available Discord account information. Payment providers (Stripe, Paystack) process payments — we store transaction references but never card details.
3. Why We Process Your Information
| Purpose | Legal Basis |
|---|---|
| Authenticating you via Discord | Consent (POPIA s11(1)(a)) |
| Running tournaments and recording results | Legitimate interest (s11(1)(f)) |
| Verifying scores via AI OCR | Legitimate interest (s11(1)(f)) |
| Processing payments and billing | Contract (s11(1)(b)) |
| Sending match notifications | Legitimate interest (s11(1)(f)) |
| Audit logs for dispute resolution | Legitimate interest (s11(1)(f)) |
| Responding to contact enquiries | Consent (s11(1)(a)) |
| Displaying leaderboards and stats | Legitimate interest (s11(1)(f)) |
4. Who Can See Your Information
| Recipient | What They See |
|---|---|
| Platform Founders | All data (for administration and support) |
| Organisation Admins | Members, billing, competitions within their org |
| Competition Admins | Match data, rosters, submissions within their comp |
| Clan Leaders | Their clan roster, gamertags, match results |
| Other Players | Your gamertag, match results, standings |
We do not sell, rent, or trade your personal information to any third party.
5. Third-Party Services
| Service | Purpose | Location |
|---|---|---|
| Discord | Authentication, notifications | USA |
| Amazon Web Services | Hosting, database, storage | EU (Stockholm) |
| AI Vision Services | Score extraction from screenshots | USA/EU |
| Stripe | International payments | USA/EU |
| Paystack | South African payments | South Africa |
6. Cross-Border Transfers
Your personal information is primarily stored on AWS servers in Stockholm, Sweden (EU). The European Union provides an adequate level of data protection recognised under POPIA Section 72.
Some data is processed by services in the United States (Discord, AI providers, Stripe). These transfers are necessary for the functioning of the platform.
7. How Long We Keep Your Information
| Data | Retention |
|---|---|
| User profiles | Until you request deletion |
| Match screenshots | 7 days (auto-deleted) |
| Match results and scores | 2 years from competition close |
| Activity and audit logs | 1 year |
| Billing and payment records | 5 years (legal requirement) |
| Contact form submissions | 6 months |
| Consent records | Indefinitely (legal requirement) |
8. Your Rights Under POPIA
You have the following rights regarding your personal information:
- Access (Section 23) — request a copy of your data via the portal's Data Export feature or by emailing us
- Correction (Section 24) — request correction of inaccurate information
- Deletion (Section 24) — request deletion of your data where it is no longer needed or you withdraw consent
- Objection (Section 11(3)) — object to processing on reasonable grounds
- Portability — request your data in a structured, machine-readable format (JSON)
How to exercise your rights: Use the Data Export and Deletion Request features in the portal, or email privacy@goodgameanvil.com. We will respond within 30 days.
9. Security
We implement appropriate technical and organisational measures including encrypted data transmission (HTTPS/TLS), AWS-managed encryption at rest, role-based access controls, short-lived authentication tokens, and audit logging of all administrative actions.
10. Cookies and Local Storage
GG Anvil does not use tracking cookies. We use JWT tokens passed via URL for authentication and localStorage for UI preferences only (sidebar state, selected competition). No third-party tracking, analytics, or advertising cookies are used.
11. Children
GG Anvil is not intended for persons under 13. We do not knowingly collect personal information from children. If discovered, such information will be deleted promptly.
12. Data Breach Notification
In the event of a breach, we will notify the Information Regulator within 72 hours and notify affected individuals as soon as reasonably possible via Discord DM and/or email.
13. Changes to This Policy
Material changes will be communicated via a notice in the portal. Continued use after changes constitutes acceptance.
14. Complaints
Contact us at privacy@goodgameanvil.com, or lodge a complaint with the Information Regulator of South Africa:
- Email: enquiries@inforegulator.org.za
- Website: inforegulator.org.za
- Tel: +27 (0)10 023 5207
15. Contact
Email: privacy@goodgameanvil.com
Information Officer: Luke
Website: goodgameanvil.com