Privacy notice

1. Data processed by ScrimLab

• Account data: name and email address entered when an email account is registered. ScrimLab uses Supabase Auth to verify addresses and passwords and does not store passwords in its team database.
• Team data: team name, region, membership, role, lane, invitations and visibility settings.
• Planning and scrim data: availability and weekly notes, calendar entries, opponents, drafts, results, reviews, game events and statistics derived from imported replays.
• Riot data: Riot ID, PUUID, rank, mastery and match information requested through Riot services.
• Replay and technical data: member email, IP address, file name and size, timestamps, upload and processing identifiers, request information and security or diagnostic data. The IP address is also used to limit replay-upload abuse.
• Contact data: sender details, message content and any attachments when you contact ScrimLab.

2. Purposes and legal bases

For support, operation and troubleshooting, the website operator can view team workspaces through a restricted read-only interface. These accesses are logged internally with the operator account, team, section and time. This does not add the operator as a team member or send a notification for each access.

Data is processed to authenticate users, provide team workspaces, coordinate teams, import and analyse scrims, answer enquiries, protect the service against abuse and resolve errors. The legal basis is Article 6(1)(b) GDPR where processing is necessary to provide a requested function or answer a related enquiry, Article 6(1)(f) GDPR for operating and securing this private project, communication, abuse prevention and troubleshooting, and Article 6(1)(c) GDPR where a legal obligation applies. Account data is required for authenticated functions; other information is required only when the corresponding feature is used.

3. Service providers and external services

ScrimLab uses OpenAI Sites for project delivery, Cloudflare for application hosting, database and temporary replay storage, Supabase Auth for email registration, email verification, password sign-in and password recovery, and Namecheap Private Email to send account confirmation and password recovery emails and to receive and process contact messages. When the relevant feature is used, Riot IDs and related profile or match requests are sent to Riot Games services. Draft exports to drafter.lol include the team name, opponent, series format and selected draft mode. With consent, Google Analytics 4 from Google Ireland Limited is used for usage statistics. Only data required for the selected function is transmitted. ScrimLab uses no advertising trackers and does not sell personal data.

4. Replay uploads

Replay files are uploaded to private temporary object storage. Upload authorisations are short-lived, and an upload session expires after 15 minutes. The raw replay file is deleted after server-side processing. A storage lifecycle rule removes files as a fallback if immediate cleanup cannot be completed. Upload and processing metadata may be retained until the related workspace is deleted or the information is no longer needed for operation, security or troubleshooting.

5. Browser and session storage

ScrimLab uses local and session storage for language, the last opened section, workspace state, Riot-profile caching, local Draft Assistant configuration, learning and readiness data, and the saved privacy choice. The technical service providers may also use necessary authentication and session mechanisms. Analytics storage is used only after consent.

When email sign-in is used with “Keep me signed in”, technically necessary Secure/HttpOnly cookies keep the login on that device for up to 30 days. Without this option, session cookies are used and the server-side login expires after at most 12 hours. Browser session restore may retain session cookies. Password recovery permission lasts at most 10 minutes. A hashed session identifier is stored server-side; signing out invalidates that session.

6. Google Analytics

Google Analytics is not loaded and no request is sent to Google before statistics consent. If consent is given, ScrimLab processes page paths without query parameters, page titles, a shortened referrer without query parameters, approximate region, browser and device information, usage time and online identifiers in analytics cookies. ScrimLab does not intentionally transmit names, email addresses, team names, Riot IDs, replay file names or invitation parameters. Google Signals and advertising personalisation are disabled. The analytics cookies are configured for up to 90 days. The legal basis is consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. Consent can be changed or withdrawn at any time using “Cookie settings”; withdrawal applies to future processing. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, provides the service and may involve Google LLC and processing in the United States. More information is available in Google's privacy policy.

7. Retention and deletion

Workspace data is generally stored until it is deleted by the authorised team owner or is no longer required. Leaving a team removes the departing member's membership and personal availability entries; shared scrim and team content remains with the team. Riot profile and match information may be cached while required for the relevant feature. Contact messages are retained until the enquiry has been resolved and thereafter only where necessary for documentation or legal obligations. Deletion requests can be sent using the contact details below. Statutory retention duties and limited security or recovery copies may require longer storage.

8. Your rights and complaints

Subject to the applicable requirements, you have rights of access, rectification, erasure, restriction, data portability and objection. Consent can be withdrawn at any time with effect for the future. You may also complain to a data protection supervisory authority. The competent authority in Schleswig-Holstein is the Independent State Centre for Data Protection Schleswig-Holstein (ULD).

9. International processing

Some technical providers may process data outside the European Economic Area. Where required, such processing is protected by an adequacy decision, appropriate safeguards or another lawful transfer mechanism.

10. Automated decision-making

ScrimLab does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect users.

11. Status of this notice

8 September 2026.

12. Controller