Privacy
Privacy Policy
This policy explains how PlayStake handles personal information when you visit the website, create an account, play a match, connect Kick, make a transaction, file a dispute or act as a referee.
Last updated:
A plain-language promise
We use personal information to operate and protect PlayStake. We do not sell personal information. We do not currently use advertising or marketing cookies.
Who we are and scope
PlayStake Ltd is the controller of the personal information described in this policy. References to “PlayStake”, “we”, “us” and “our” mean PlayStake Ltd.
This policy applies to playstake.org, the PlayStake web application, game widget, developer interfaces, referee tools and related support. A third-party game, Kick, Google, Stripe or another external service may process information under its own privacy notice when you use it.
For privacy questions or requests, contact support@playstake.com.
Information we collect
| Category | Examples |
|---|---|
| Account and profile | Email address, display name, password hash, avatar, verification status, role, account settings and last-login time. |
| Linked services | Google identity details when you use Google sign-in; Kick user ID, email where provided, channel slug, display name, profile image, live status, declared game, approved permissions and encrypted access credentials. |
| Payments and balances | Stripe customer and payment identifiers, deposit and withdrawal status, amounts, currency, ledger entries, fees, reversals and transaction history. PlayStake does not normally receive your complete card number. |
| Matches and disputes | Challenges, opponents, games, stakes, consent, results, game events, technical result hashes, dispute reasons, messages, evidence and settlement information. |
| Referee information | Application status, availability, qualifications, biography, assignments, decisions, evidence, performance record and append-only audit events. |
| Device and security | IP address, hashed IP in referee audit records, user agent, session token hash, cookie identifiers, timestamps, failed-login and rate-limit information, and security or anomaly alerts. |
| Developer information | Company name, website, contact email, registered games, API-key metadata, webhook configuration and delivery logs. |
| Communications | Messages and information you send when contacting support, reporting a problem, applying as a referee or communicating in a dispute. |
If identity or age verification is enabled, a specialist provider may collect identity-document, address, date-of-birth, liveness or source-of-funds information. PlayStake may receive the verification outcome and limited supporting details rather than the complete document. The collection screen will identify the provider and information required.
Where information comes from
We receive information:
- directly from you when you register, play or contact us;
- from Google or Kick when you authorise the relevant connection;
- from Stripe, banks and verification providers in connection with payments and checks;
- from games, approved developers and the PlayStake widget through match events and result reports;
- from opponents, referees and administrators during challenges, disputes and reviews; and
- automatically from your browser, device and use of the service.
How and why we use information
| Purpose | What this involves | UK GDPR basis |
|---|---|---|
| Provide the service | Create and secure accounts, connect integrations, match players, reserve stakes, administer games, settle results, operate referee assignments and process transactions. | Performance of our contract with you. |
| Safety and integrity | Prevent cheating, fraud, payment abuse and account compromise; investigate anomalies and disputes; enforce our Terms; preserve audit trails. | Our legitimate interests in providing a fair and secure service, and where applicable legal obligations. |
| Legal and regulatory compliance | Age and identity checks, financial-crime controls, accounting, tax, sanctions checks, lawful requests and regulatory reporting. | Legal obligation and, where appropriate, substantial public interest or legitimate interests. |
| Maintain and improve PlayStake | Diagnose faults, measure reliability, understand feature usage and improve usability and performance. | Our legitimate interests in operating and improving the service. |
| Service communications | Send security, transaction, match, dispute, policy and account notices. | Performance of our contract, legal obligation and legitimate interests. |
| Optional marketing or analytics | Send marketing or use non-essential analytics only where introduced and permitted. | Consent where consent is required. You may withdraw it at any time. |
Where we rely on legitimate interests, we consider the service need, the impact on you and the safeguards available. You can object to processing based on legitimate interests; see “Your rights” below.
Providing core account, match and payment information is generally necessary to enter and perform our contract with you. If you do not provide it, we may be unable to create an account or provide the requested feature.
Automated match decisions and fraud checks
PlayStake may use deterministic game rules and recorded events to validate a result and trigger settlement. The system compares reported outcomes with game events, scores, win conditions and result hashes. It may also flag unusual activity for investigation.
An automated result may have a financial effect because it can release or return a reserved stake. Players can dispute a result within the displayed deadline and provide evidence. A disputed or anomalous result can be reviewed by a human referee or administrator, who can uphold, correct or void it.
You may contact us to ask for information about a significant automated decision, express your point of view or request human review, subject to any legal exceptions.
International transfers
Some providers may process information outside the United Kingdom. Where UK data-protection law requires a transfer safeguard, we use an applicable adequacy regulation, approved contractual safeguards or another lawful transfer mechanism and assess supplementary safeguards where appropriate.
Contact us if you would like information about the safeguard relevant to a particular provider or transfer.
How long we keep information
We retain personal information only for as long as reasonably needed for the purposes described above, including legal, accounting, security, dispute and regulatory requirements. Typical periods are:
- active login sessions normally expire after 7 days;
- account and linked-service information is kept while the account is active and then for a limited closure and claims period;
- encrypted Kick access credentials are kept until you disconnect, close the account or the credentials are revoked, subject to backup cycles;
- transaction, ledger, match, settlement, dispute and referee audit information is ordinarily retained for up to 6 years after the relevant relationship or transaction, and longer where law, an investigation or a legal claim requires it; and
- failed-login, anomaly and security information is retained according to risk and investigation needs.
Some referee audit records are designed to be append-only so that a decision history cannot be altered. We may retain those records where necessary to establish, exercise or defend legal claims and protect match integrity. Where possible, data that no longer needs to identify a person will be deleted or anonymised.
How we protect information
We use technical and organisational safeguards intended to protect personal information, including encrypted HTTPS connections, hashed passwords and session tokens, encrypted Kick credentials, access controls, rate limits, transaction idempotency, security monitoring and tamper-evident referee audit records.
No internet service can guarantee absolute security. Keep your account credentials private and contact us promptly if you believe your account or personal information has been compromised.
Your data-protection rights
Depending on the circumstances, UK data-protection law may give you rights to:
- obtain a copy of your personal information;
- correct inaccurate or incomplete information;
- request deletion or restriction;
- object to processing based on legitimate interests;
- receive certain information in a portable format;
- withdraw consent where processing relies on consent; and
- request safeguards around certain solely automated decisions.
These rights are not absolute. For example, we may need to keep transaction, fraud-prevention, dispute or audit records to comply with law or establish and defend legal claims.
To exercise a right, email support@playstake.com. We may need to verify your identity before acting on the request.
Questions and complaints
Please contact us first so we can try to resolve your concern. You also have the right to complain to the UK Information Commissioner’s Office:
If you live outside the UK, you may also be able to contact the data-protection authority where you live.
Children
PlayStake is intended only for people aged 18 or over. We do not knowingly offer accounts to children. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.
Changes to this policy and contact
We may update this policy when the service, providers or law changes. We will update the date above and provide additional notice where a change is material.
Privacy questions and requests can be sent to PlayStake Ltd at support@playstake.com.