Privacy Policy

This policy operates concurrently with our Terms of Service. This policy focuses exclusively on end-user tournament participants; we do not operate developer-facing platform software.

Section 1 — WHO WE ARE (DATA CONTROLLER)

• Corporate Address: 30 N Gould St Ste R, Sheridan, WY 82801, United States
• Privacy and Regulatory Inquiries: support@skillhousemasters.com

Section 2 — INFORMATION WE COLLECT

We collect data through direct user submissions, passive technical interactions, and integrated third-party platforms. To maintain regulatory compliance over a forward-looking 12-month period, these disclosures account for both active features and components currently scheduled for deployment.

• Account Credentials: Account creation requires a valid email address, player-selected password, date of birth, gender selection, and your public Chess.com username.
• Player Portal Profiling: Financial payout documentation and future optional portal capabilities permit users to submit custom bio details and upload profile photos.
• Tax and Financial Verification: If you achieve a cash-prize rank on a tournament leaderboard, you must provide valid tax forms (IRS Form W-9 for U.S. residents or IRS Form W-8BEN for international players).
• Communications Lifecycle: Any correspondence sent to support@skillhousemasters.com or through contact forms records your name, email address, and the complete textual contents of your inquiry.

• Exact Geolocation & Geo-Fencing: To strictly enforce the geographic boundaries defined in our Terms of Service, we mandate browser and device-level GPS location permissions at account signup and prior to joining any tournament. We collect precise location coordinates (latitude/longitude) and real-time geo-fencing metadata via your device API. If location permission is denied, access to signup and tournament entry is strictly blocked.
• Technical Server Logging: Our backend registers your Internet Protocol (IP) address, operating system profile, browser type, device identifiers, and system timestamps. A mismatch between your network IP and device GPS triggers manual security reviews.
• Abuse and Rate Prevention Logs: Performance metrics and diagnostics are actively captured to mitigate security threats, handle rate-limiting thresholds, and resolve script-injection vulnerabilities.

• Chess.com Public API Ingestion: We pull real-time data from Chess.com's public API to evaluate your eligibility, covering your rapid performance ceiling, 6-month historical rating spikes, account creation age, and fair-play history.
• Compulsory Proctoring Audio/Video Feed: During live competition, the Chess.com Proctor software records and logs your device screen, ambient room audio, front-facing primary camera feed, and secondary mobile camera perspective. While Skillhouse facilitates these matches and broadcasts specific competition video streams, the underlying data recordings are captured and secured natively within Chess.com's system.
• Identity Verification (KYC) Results: Biometric liveness matching and government identity document extraction are performed by our third-party infrastructure partner, Didit. Skillhouse does not ingest, store, or host raw government ID photos, scans, or facial biometric geometry templates. Didit handles all media retention. We receive and locally store only the structured decision JSON, extracted demographic fields (including your legal name, verified date of birth, gender/sex as printed on the ID, and issuing state), and mismatch audit flags (e.g., dob_mismatch) to enforce our dual-eligibility parameters and prevent identity fraud.

Section 3 — HOW WE USE YOUR INFORMATION

We process personal data strictly to fulfill corporate operational mandates, satisfy legal burdens, and protect tournament integrity:

• Platform Administration: To execute your user account configuration, manage credit wallet balances, log entry token reservations, and track your portal registration parameters.
• Enforcing Dual Eligibility Gates: Utilizing precise device GPS data and verified ID residence data to ensure players meet both physical location and legal residence requirements, blocking access from prohibited jurisdictions.
• Demographic & Bracket Assignment: Using your KYC-verified gender/sex to enforce strict eligibility for specialized prize brackets, and using your KYC-verified date of birth to automatically correct provisional signup data and ensure age compliance.
• Forensic Fair Play Auditing: Combining Chess.com API indicators, IP/GPS mismatch flags, and verification milestones to investigate potential cheating, location spoofing, or bracket manipulation before confirming prize distribution.
• Transactional and Alert Messaging: Automatically routing entry receipts, wallet hold alerts, security alerts, and verification one-time passcodes (OTP).
• Media & Public Broadcasts: Utilizing your legal name, public Chess.com username, match metrics, and video likeness for real-time tournament commentary, promotional web content, and global media streaming.
• Targeted Optimization (Future Implementation): Deploying web analytics (such as Google Analytics 4) and tracking scripts within the next 12 months to measure marketing attribution, analyze conversion actions, and optimize user flows.

Section 4 — LEGAL BASES FOR PROCESSING (EEA/UK PLAYERS)

If you access our services from the European Economic Area (EEA) or the United Kingdom (UK), we process your personal data under the following statutory frameworks:

Section 5 — SERVICE PROVIDERS AND SHARING

We share personal data exclusively with trusted third-party service providers who act as our data processors under strict contractual safeguards. These vendors are legally prohibited from retaining, sharing, or using your personal information for any secondary commercial purpose outside of the specific operational tasks we instruct them to perform:

• Cloud Infrastructure & Database Vendors: Secure hosting platforms and managed database environments used to securely maintain player portal profiles and ledger records.
• Web Hosting & Performance Diagnostics: Frontend networks utilized to deliver our website interface and monitor aggregate loading metrics.
• Network Security & Abuse Mitigation Utilities: Dynamic caching layers and rate-limiting systems used to block malicious traffic and prevent automated script exploits.
• Transactional Communication Platforms: Third-party automated email delivery systems used to route verification links, receipts, and security alerts.
• Financial Administration Gateways: Authorized third-party payment processors used to manage real-money virtual credit package transactions (the platform does not store full credit card data internally).
• Identity Verification Infrastructure (Didit): Automated identity documentation processing and liveness verification services to eliminate duplicate profile fraud.
• Tournament Fair Play and Surveillance Partners (Chess.com): Interactive proctoring, fair-play monitoring, and platform synchronization engines required to execute and score tournament rounds.

We may also disclose information under narrow legal parameters: (i) to satisfy subpoenas, court orders, or federal investigatory demands; (ii) to investigate corporate identity theft or fraudulent financial chargebacks; or (iii) in connection with a corporate merger, restructuring, or asset acquisition where platform player ledgers are transferred to a successor entity.

Section 6 — COOKIES AND PASSIVE TRACKING

Our website separates site-essential local storage cookies from optional tracking scripts. You can review or adjust your preferences at any time by clicking the "Cookie Settings" link located in our footer.

These local storage items are technically necessary to establish basic platform utility and security:

• supabase.auth.token – Maintains your secure active login session status.
• sh_rid – Preserves state consistency across internal credit checkout pages.
• cookie-consent – Stores your affirmative cookie configuration selections.

• Performance Telemetry: Frontend diagnostic tools collect aggregated, anonymized frontend response delays only if you click "Accept".
• Future Tracking Roadmap: Within the next 12 months, we may integrate conversion tags, lookalike tracking identifiers, or Google Analytics 4. These external monitoring scripts are structurally hard-blocked by default and will never initialize or track your session activity unless you explicitly authorize them through our cookie compliance banner.

• When your browser transmits a valid Global Privacy Control (GPC) signal, we honor it as an affirmative opt-out of the sale or sharing of your personal information for cross-context behavioral advertising, consistent with applicable California privacy law.
• GPC opt-out is applied automatically on your first visit; you do not need to create an account or submit a separate request.
• You may also review or adjust sale/sharing and cookie preferences at any time through our California Privacy Choices page (skillhousemasters.com/privacy/choices) or by clicking "Cookie Settings" in the site footer.

Section 7 — SPECIFIC DATA RETENTION SCHEDULES

We reject infinite data retention policies and align our lifecycles with the principles of data minimization:

• Active User Accounts: Personal profiles, credit balances, and tournament histories are maintained while your account is active.
• Identity Verification (KYC) Data: Didit decision JSON and extracted demographic fields are maintained while your account is active. Upon formal account deletion, this structured data is purged, subject to legal hold exceptions. (Raw ID images are never stored by Skillhouse).
• Location and Audit Logs: Device GPS audit events, blocked access attempts, and IP logs are maintained while the account is active, plus an additional three (3) months following account deletion to protect against financial chargebacks and cross-account fraud.
• Security & System Event Logs: Standard system logs, server diagnostics, rate-limiting captures, and error diagnostic logs are automatically purged on a rolling 30-day schedule.
• Proctoring Telemetry: Video, audio, and screen logs captured during competitive rounds are managed directly within Chess.com's system according to their internal legal retention frameworks.
• Legal Hold Exception: Any data subject to a statutory requirement, active tax audit, payment dispute, or law enforcement preservation request will be retained beyond these windows until the matter is resolved.

Section 8 — INTERNATIONAL DATA TRANSFERS

We employ standard contractual clauses and appropriate safeguards for the transfer of data across international boundaries, ensuring compliance with global privacy regulations when utilizing our distributed cloud architecture.

Section 9 — CALIFORNIA PRIVACY RIGHTS (CCPA/CPRA)

This section applies exclusively to individual residents of the State of California. Residents of states explicitly blocked from our tournament ecosystem (such as Nevada) are excluded from these disclosures.

• Sale of Data: We do not sell your personal information for monetary compensation.
• Sharing for Cross-Context Ads: While we do not currently share user lists with social media platforms or ad networks for targeted behavioral advertising, our forward-looking 12-month roadmap accommodates these tracking capabilities. If activated, this tracking constitutes "sharing" under California law. You can opt-out of this future deployment at any time by configuring your cookie consent banner or by clicking a designated "Do Not Sell or Share My Personal Information" link in our site footer.

California residents have the right to request: (1) Access to specific data points collected; (2) Correction of inaccurate profile details; (3) Deletion of personal information; and (4) Restriction or opt-outs regarding the future sharing of behavioral marketing data.

You may submit a verified request using either of the following methods:

• Privacy Rights Request Web Form: Visit skillhousemasters.com/privacy/request to submit access, deletion, correction, or opt-out requests through our dedicated DSAR form. Select your request type, provide contact details, and describe your request. You will receive an automated receipt confirmation.
• Email: Send your request to support@skillhousemasters.com with the subject line "CCPA Privacy Rights Request".

To opt out of the sale or sharing of personal information for cross-context behavioral advertising, or to manage cookie and analytics preferences, visit our California Privacy Choices page at skillhousemasters.com/privacy/choices. If your browser sends a Global Privacy Control (GPC) signal, we honor it automatically as described in Section 6.3.

We will verify your identity by matching your provided identifiers against our verified ledger data. If you employ an Authorized Agent, we require written, signed proof of their authority alongside direct verification of your own identity.

California residents have the right to limit our use and disclosure of sensitive personal information to purposes necessary to provide the services you reasonably expect.

We collect sensitive personal information—including precise geolocation and government-ID-derived demographics (date of birth, gender, legal name)—solely to enforce tournament eligibility, geo-fencing compliance, and fraud prevention as described in Section 9.1. Certain categories are processed under CPRA exemptions where limitation requests do not apply to compliance-driven uses.

To exercise your right to limit sensitive personal information where applicable, visit skillhousemasters.com/privacy/choices and enable the "Limit Sensitive PI" preference. You may also email support@skillhousemasters.com with the subject line "Limit Sensitive PI Request".

Section 10 — EUROPEAN UNION & UNITED KINGDOM DATA RIGHTS

If you reside within the European Union or the United Kingdom, you possess clear statutory entitlements under the GDPR and UK Data Protection Act:

• Right of Erasure (Right to be Forgotten): You may demand the complete deletion of your account and historical records (including GPS audit rows and KYC JSON), subject to narrow exceptions where data is required for active tax tracking, legal holds, or regulatory compliance.
• Right of Restriction & Objection: You may block the processing of your data for direct marketing actions or challenge processing based on our corporate legitimate interests.
• Right of Portability: You may request that your personal identification files and transaction details be exported in a structured, machine-readable format.
• Right to Withdraw Consent: Where processing relies on your consent, you can withdraw that consent at any time.

To execute these rights, submit your request using either method described in Section 9.3: the Privacy Rights Request web form at skillhousemasters.com/privacy/request, or by emailing support@skillhousemasters.com. You also maintain the right to lodge an official complaint regarding our data handling with a recognized European Data Protection Supervisory Authority or the UK Information Commissioner's Office (ICO).

Section 11 — STRICT MINOR RESTRICTIONS

• General Minimum Age: 18 years of age.
• Alabama & Nebraska Residents: 19 years of age.
• Massachusetts Residents: 21 years of age.

We do not knowingly collect, process, or maintain information from any individual below these designated age limits. If we discover that an account has bypassed these restrictions and inadvertently submitted personal information, we will immediately delete all associated records and invalidate their virtual wallet assets.

Section 12 — POLICY REVISIONS AND CONTACT

We reserve the right to modify this Privacy Policy as our platform evolves. When changes are made, we will update the "Effective Date" at the top of this document and increment the policy version number. If a structural revision materially changes how your data is handled, we will provide a prominent notice across our player portal dashboard or deliver a direct notification to your registered email address.

For questions, technical clarifications, or to assert any data privacy rights, please contact our legal and support teams using any of the following channels:

• Privacy Rights Request Web Form: skillhousemasters.com/privacy/request (access, deletion, correction, opt-out)
• California Privacy Choices: skillhousemasters.com/privacy/choices (sale/sharing opt-out, sensitive PI limits, cookie settings)
• Email: support@skillhousemasters.com
• Postal Mail: Skillhouse Masters Inc., Attn: Legal Department, 30 N Gould St Ste R, Sheridan, WY 82801.