Privacy notice
How LigaSync handles personal data under Mexico’s LFPDPPP.
Last updated: September 7, 2026
1. Data controller
LigaSync is the controller. For rights requests or questions, email support@ligasync.app. This notice covers the web app and accounts for organizers, staff, and players.
2. Data we collect
Account: email, display name, optional photo, bio, and preferred sport. League: memberships, roles, rosters, games, scores, stats, and season fees. Operations: invites, in-app notifications, product feedback, and security logs (audit trails, coarse IP). Payments: if the league uses Stripe, the processor sees checkout data; we store payment status, not the full card number.
3. Purposes
Primary: create and authenticate your account, run the league (schedule, scoreboard, standings, rosters, invites), collect season fees when the league configures them, send transactional notices (invites, reminders, results), and provide support. Secondary (you may object): product analytics to improve the app and, if the league publishes a microsite, showing your name, photo, jersey, and stats on public pages.
4. Processors
We use vendors that process data on our instructions: Supabase (auth, database, files), Vercel (hosting), Resend (email), Stripe (card checkout, when enabled), and PostHog (analytics, when enabled). Some may sit outside Mexico. We require reasonable security and send only what the service needs.
5. Transfers
We do not sell your information. We share it with admins of leagues you join (they see that league’s rosters, dues, and game data) and, if the league is public, with visitors of its page. Competent authorities only when Mexican law requires it.
6. ARCO rights
You may access, rectify, cancel, or object to processing, and limit use or withdraw consent where it applies. In the app: Profile (rectify), download your data, and delete the account (cancel). You can also email support@ligasync.app from the same account stating the right you want. We respond within 20 business days. If you are the only admin of a league, appoint another admin before deleting the account so the league is not left without an operator.
7. Cookies and session
We use essential session and active-league cookies so you can sign in and keep your tenant. We do not use advertising cookies. If PostHog is configured, it may use product identifiers for pages and events. Clearing cookies in the browser signs you out.
8. Retention
For as long as your account exists. If you delete it, we remove the profile, memberships, fees in your name, and the auth user. The league may keep game scores and stats (sporting history) without your account. Backups expire on the vendor’s normal cycle. Audit logs may keep an opaque identifier for security.
9. Minors
Accounts are meant for people 18 or older, or for a parent or guardian of a younger player. Whoever invites a minor is responsible for that consent. We do not knowingly collect children’s data for marketing.
10. Changes to this notice
If processing changes in a material way, we will update this notice and the date at the top. Continued use after publication means you have seen the current version. The Spanish text is authoritative; English is a courtesy translation.