We at Visage Esports (“we”, “us”, or “our”) respect your privacy and are committed to protecting your personal data. This Privacy Policy will inform you as to how we look after your personal data when you visit our website or use our SaaS platform (the “Service”) and tell you about your privacy rights according to the General Data Protection Regulation (GDPR).

1. Data Controller and Contact Details

The controller responsible for your personal data is:

Johannes Tornow
Visage Esports (sole proprietorship / Einzelunternehmen)
Sophie-Charlotten-Str. 84
14059 Berlin, Germany

Email: contact@visage.gg

We are not legally required to appoint a Data Protection Officer. For all questions concerning data protection, please contact us at the address above.

2. What Data We Collect and Why We Collect It

We collect and process personal data only when strictly necessary to provide our Service securely and reliably.

a) Server Log Files

When you visit our website, our server automatically collects technical information, including your IP address, browser type and version, time zone setting, and the time and date of your request.

Purpose: To ensure the technical stability, security, and performance of our Service (e.g., preventing DDoS attacks).

Legal Basis: Our legitimate interest (Art. 6(1)(f) GDPR).

Retention: Logs are retained for 30 days and are then automatically deleted, unless a specific log entry is required for longer to investigate or document a concrete security incident.

b) Account Registration and Authentication

To use our Service, you must create an account. We collect your email address and your hashed password. When you log in, we use technically necessary session cookies to keep you authenticated.

Purpose: To manage your account, authenticate you, and provide the contracted services.

Legal Basis: Performance of a contract (Art. 6(1)(b) GDPR).

Cookies: We do not use tracking or marketing cookies. Our authentication cookies are strictly necessary for the Service to function.

Retention: Account data are deleted within 90 days after the contract ends. Data contained in invoices and other accounting records are retained for the statutory periods (currently 8 years pursuant to Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB)) and are restricted from further processing during that time.

c) Billing and Contract Management

If you enter into a paid subscription, we process your billing details (name, address, and, where applicable, VAT ID and company details) in order to issue invoices and fulfil our tax obligations.

Purpose: Performance of the contract and compliance with statutory accounting and tax obligations.

Legal Basis: Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR in conjunction with Sections 147 AO, 257 HGB.

Retention: See the statutory retention periods stated above.

Payment processing: Payments are handled by Stripe (see Section 3). When you pay, the payment details you enter — for example card or bank account data — are transmitted directly to Stripe and are processed by Stripe, not by us. We do not collect or store card or other payment instrument data ourselves; we receive from Stripe only the information we need to allocate the payment and issue the invoice, such as the payment status, the amount, the payment method type, and the last four digits of the card where applicable.

d) Contacting Us and Support

This section covers every way you communicate with us outside the Service itself: writing to us by email or phone, contacting us through one of the messaging channels we publish on our website, and using the support function inside the Service.

What we process: the contact details you give us — typically your email address or messaging handle, and any name, organization, role, or other details you choose to provide — together with the content of your message and the technical metadata needed to deliver and process it. We only process what you choose to send us.

Purpose: to answer your enquiry, to provide support, and to prepare or perform a contract with you.

Legal Basis: Art. 6(1)(b) GDPR where your request relates to a contract or to steps taken at your request prior to entering into one; otherwise our legitimate interest in responding to enquiries and in developing our Service (Art. 6(1)(f) GDPR). Where a message is not necessary for either — for example if we ask to send you product updates — we rely on your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.

Processing and recipients: these communications are processed on our own infrastructure in Germany, including our self-hosted automation and support tooling. They are not passed to any third party, except where a message reaches us through a channel operated by someone else — an email delivered by our email provider, or a message you send us on a third-party messaging platform, in which case that platform processes it under its own privacy policy before it reaches us.

Retention: we keep enquiries and support conversations for as long as needed to deal with the matter and, afterwards, for up to two years so that we can follow up on related questions — or longer where the exchange forms part of a contractual relationship subject to the statutory retention periods described above.

e) Publicly Available Match and Player Data

Our Service analyses Dota 2 match data. We obtain this data from publicly accessible sources, in particular the official Steam Web API operated by Valve Corporation and comparable public match data services. This concerns matches and accounts that are already publicly visible.

What we process: Publicly available account identifiers (e.g., Steam/Dota 2 account IDs), the public in-game name, and match-related information such as match IDs, heroes played, in-game statistics, results, and timestamps.

Purpose: To produce statistical, tactical, and performance analyses of Dota 2 matches — for example team and opponent analysis, draft statistics, and aggregated benchmarks.

Legal Basis: Our legitimate interest and the legitimate interest of our users in analysing publicly available competitive match data (Art. 6(1)(f) GDPR). We consider this interest to outweigh the interests of the individuals concerned because the data are already public, relate to a person’s participation in a public competitive game rather than to their private life, and are not used to evaluate them outside that context.

Source and notification: As we do not obtain this data from you directly, we rely on Art. 14(5)(b) GDPR: because the data originate from public sources and typically contain no contact details, individually notifying every player concerned would involve disproportionate effort. This Privacy Policy serves as the corresponding general information.

Retention: We retain match data for as long as it is useful for the analyses described above.

Objection (Art. 21 GDPR): If you are a player whose publicly available data we process, you may object to this processing at any time on grounds relating to your particular situation by contacting contact@visage.gg and stating the account ID concerned and the grounds for your objection. We will then assess whether your interests, rights, and freedoms override the legitimate grounds set out above, and will inform you of the outcome. Aggregated statistics that no longer permit any identification of you are unaffected, as they are no longer personal data.

We do not sell your personal data. We only share data with trusted infrastructure providers required to operate our Service.

Hosting (Hetzner): Our Service and all data are hosted on servers provided by Hetzner Online GmbH, located entirely within Germany.

Transactional Emails (Brevo): We use Brevo (Sendinblue GmbH, Berlin, Germany) to send necessary transactional emails, such as password resets and account notifications. We only share the email address required for this purpose.

Content Delivery Network (Fastly): Our website is delivered via the content delivery network of Fastly, Inc., 475 Brannan Street, San Francisco, CA 94107, USA. When you access our website, your request is routed through Fastly’s servers, which process your IP address, the requested resource, and technical connection metadata in order to deliver content quickly and to protect the site against attacks. Legal basis is our legitimate interest in a secure and performant website (Art. 6(1)(f) GDPR). See Section 4 regarding the transfer to the USA.

Payment Processing (Stripe): Payments and subscription billing are handled by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland, together with its affiliated companies including Stripe, Inc. (USA). We share with Stripe the data required to process your payment — in particular your name, email address, billing address, and the amount and reference of the transaction. Your payment instrument details are entered directly with Stripe and are not accessible to us. Legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR). Stripe additionally processes this data as a controller in its own right for the purposes of executing payments, meeting its own regulatory obligations, and preventing fraud and misuse; Stripe’s own privacy policy applies to that processing. Stripe may transfer data to the USA — see Section 4.

AI Service Providers: We use external providers of AI models to deliver parts of the Service, in particular analysis and assistance features. Data processed within the Service — including match data and content you create or upload — may be transmitted to these providers in order to generate the requested results. Legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR). The providers currently used are named in Annex 3 of our Data Processing Agreement; we will also tell you on request which provider is used for a given feature. Some of these providers are established outside the EEA — see Section 4.

Except where stated otherwise above, each of these providers acts as a processor on our behalf and is bound by a data processing agreement pursuant to Art. 28 GDPR as part of their respective terms of service.

If you are a business customer and process personal data of your own players, staff, or other individuals within the Service — for example by inviting users, creating notes, or uploading replay files — you act as the controller for that data and we act as your processor. Our Data Processing Agreement (Auftragsverarbeitungsvertrag) pursuant to Art. 28 GDPR applies to that processing and is concluded in electronic form together with your contract. It also contains the current list of sub-processors, including those used for any AI-assisted features. You can request a copy of the version you accepted at contact@visage.gg.

This means that where your organization has entered data about you into the Service, your organization — not we — is the controller for that data, and requests concerning it should be directed to your organization. If you contact us about such data, we will forward your request to them.

4. International Data Transfers

Our application servers, databases, and email provider are located within the European Union (Germany).

Data are transferred to the USA in the following cases:

Content delivery: technical connection data, including your IP address, when you access our website.
AI service providers: data processed by AI-assisted features, where the provider used is established outside the EEA.
Payment processing: billing and transaction data, where Stripe involves its US affiliates in processing a payment.

These transfers are safeguarded by the Standard Contractual Clauses adopted by the European Commission pursuant to Art. 46(2)(c) GDPR. Please note that the level of data protection in the USA may not correspond to that of the EEA and that, in particular, access by US authorities cannot be entirely ruled out.

Beyond this, we do not transfer your personal data outside the EEA.

5. Data Security

We have implemented appropriate technical and organizational measures (TOMs) to prevent your personal data from being accidentally lost, used, accessed in an unauthorized way, altered, or disclosed.

6. Your Data Protection Rights

Under the GDPR, you have the following rights regarding your personal data:

Right of Access: You can request a copy of the personal data we hold about you.
Right to Rectification: You can ask us to correct inaccurate or incomplete data.
Right to Erasure (“Right to be forgotten”): You can ask us to delete your personal data when it is no longer necessary for the purposes we collected it for.
Right to Restriction of Processing: You can ask us to suspend the processing of your personal data.
Right to Data Portability: You can request the transfer of your personal data to you or a third party.
Right to Object: You can object to processing based on our legitimate interests.
Right to Withdraw Consent: Where processing is based on your consent, you may withdraw it at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.

To exercise any of these rights, please contact us at contact@visage.gg.

You also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence or place of work, if you believe that the processing of your personal data violates the GDPR. The authority responsible for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61, 10555 Berlin, Germany

7. Automated Decision-Making

We do not use your personal data for automated decision-making producing legal effects concerning you or similarly significantly affecting you within the meaning of Art. 22 GDPR, and we do not carry out profiling for such purposes.

8. Minimum Age

Our Service is directed exclusively at businesses and is not offered to consumers. Accounts may only be created by persons aged 16 and over acting on behalf of a business. We do not knowingly collect personal data from children under the age of 16. If we become aware that we have collected such data without the required consent of the holder of parental responsibility, we will delete it without undue delay.

9. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to our Service or to legal requirements. The version published on this page at the time of your visit applies. The date of the last update is shown above.

Privacy Policy