Privacy policy

1. Who is the controller

The controller of your personal data is Patrick Gharapetians, operating ClutchLeague (clutchleague.gg). You can contact us with the details at the bottom of this page.

2. What we collect

We collect only what the service needs.

• From Discord when you sign in: your Discord ID, display name and avatar. We do not receive your email address or your password.
• From you: the username you choose, the Riot ID you declare (required to play), your language, your privacy and notification choices, and optionally an email address for notifications.
• About your play: matches, teams, results, ELO and level history, full statistics of every match (rounds, kills, damage, weapons, economy, performance score), reports, disputes and sanctions.
• End-of-match screenshots: used to read the result when the official data is not available, and deleted after 30 days; only the extracted result and statistics remain.
• Official match data: at the end of a match we request it from HenrikDev (an external, unofficial service that reads VALORANT data) using your Riot ID. From it we get the identifier (PUUID) of your Riot account, used to verify that the Riot ID is yours, and the full course of the match. The complete response, which also contains the names, identifiers and positions of all participants, is kept compressed for 180 days, is shown to nobody and is read only by administrators, with an audit trail. The tables derived from it (rounds, kills, statistics) stay without your name after deletion.
• Premium: subscription status, credit ledger, cosmetics and missions. Card data is handled only by Stripe; we receive the status of the payment and a customer reference.
• Technical: IP address and browser at sign-in and for security, a salted hash of IP and browser kept for 90 days to flag multiple accounts, and server logs.
• Notifications: if you enable them, your notification email and the push subscription of your browser.
• Academy: the agents you pick, the chapters you mark as read, your bookmarks and the error reports you send. If you are not signed in, these stay only in your browser. The in-game rank you declare in Academy never leaves your browser.

3. Why we use it and on what legal basis

Each use has its own legal basis under the GDPR.

• To provide the service you asked for (account, matchmaking, lobbies, results, rating, teams, tournaments, Premium, Academy): performance of the contract, art. 6(1)(b).
• To keep the platform fair and safe (verification of results, anti-cheating, sanctions, abuse and multiple-account detection): our legitimate interest, art. 6(1)(f).
• To meet accounting and tax duties on payments: legal obligation, art. 6(1)(c).
• To send notifications by email or push that are optional, and any marketing: your consent, art. 6(1)(a), which you can withdraw at any time without affecting the service.
• To record that you accepted the terms and the privacy policy, and your cookie choices: legal obligation and our legitimate interest in proving it.

4. How long we keep it

We keep personal data only as long as needed.

• Account data: until you delete your account. After the 14-day grace period it is erased or anonymised. This includes your Academy data (picked agents, progress, bookmarks and error reports), which is also in your data export.
• Screenshots: 30 days. Complete official match data response: 180 days. Device fingerprints (hashed): 90 days. Data exports: 7 days from when they are ready.
• Match history, ELO and statistics: kept after deletion without your name, so other players’ results and ratings do not change.
• Sanctions and moderation notes: kept after deletion, linked only to a salted hash of your identity, so that a ban cannot be avoided by deleting the account.
• Payment records and the credit ledger: kept for the period required by accounting and tax law.
• Consent records: kept as proof of what you accepted and when.

5. Who receives your data

We do not sell your data. We share it only with the providers that help us run the service, acting on our instructions: hosting and infrastructure, Stripe (payments), Discord (sign-in and, if you link it, server roles), HenrikDev (official match data, to which we send the Riot ID and the match identifier), and an email provider (notifications you enable). In Academy, a video is loaded from YouTube (youtube-nocookie.com) or Twitch only when you click it: from that moment that platform receives your IP address and may set its cookies; nothing is loaded before your click. Other players see your username, display name, avatar, level, statistics and, if you choose to show it, your Riot ID; a private profile hides these from non-participants.

6. Transfers outside the EU

Some providers (for example Stripe and Discord) may process data outside the European Economic Area. Where this happens it relies on an adequacy decision or on the standard contractual clauses approved by the European Commission.

7. Your rights

You have the right to access, rectify, erase, restrict and object to the processing of your data, to data portability and to withdraw consent. You do not need to write to us for the most common ones: from your privacy settings you can export your data (a zip with JSON and CSV, available for 7 days), correct your profile, change your consents and delete your account (with a 14-day period to change your mind).

You can also lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the authority of your country.

8. What deletion does

When your account is deleted we erase your Discord ID, name, avatar, Riot ID and PUUID, email, sessions, friends, notifications, devices, badges, cosmetics and missions, and we replace your name in free-text records. Your matches stay without your name and nobody else’s rating changes. Active bans stay linked to a hash.

9. Reports about data

If you think the service holds data that should not be there, write to us: we will check it and remove it if needed.

10. Security and changes

We protect data with encrypted connections, hashed session tokens, access controls and audit logs. We will publish a new version of this policy when something substantial changes, and you will be asked to review it.

Official document