THE DARTS ATLAS CORPORATION
Privacy Policy
Effective Date: September 15, 2026. Last Updated: October 5, 2026.
This Privacy Policy includes notices for California residents (CalOPPA, CIPA, CCPA/CPRA), children (COPPA), the United Kingdom and European Economic Area (UK GDPR and EU GDPR), Canada, Australia, New Zealand, and other U.S. state privacy laws.
1. Scope and Controller
1.1 This Privacy Policy describes how The Darts Atlas Corporation, a Delaware corporation, State File Number 7124386 (“Darts Atlas,” “Company,” “we,” “us,” or “our”) collects, uses, discloses, and otherwise processes personal information in connection with www.dartsatlas.com, kiosk.dartsatlas.com, related applications, and related services (the “Services”).
1.2 Darts Atlas is the controller (or “business”) of personal information it processes to operate the Services. Organizers may independently determine how they use participant information they obtain in administering their events. Stripe is an independent controller or processor of payment and identity-verification information as described in Stripe’s terms and privacy notice.
1.3 This Policy should be read with the Terms of Use and Cookie Notice. Regional rights in Sections 12 through 17 apply in addition to the rest of this Policy.
1.4 Privacy lead: Matthew Langan, privacy@dartsatlas.com. UK representative: Lewis Tuck, lewis.tuck@dartsatlas.com. EU GDPR representative: VeraSafe Ireland Ltd., Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork T23AT2P, Ireland. If you are in the European Economic Area, VeraSafe may be contacted, in addition to Darts Atlas, only on matters related to Darts Atlas’s processing of personal data. To make an inquiry, contact VeraSafe through its data protection representative contact form at https://verasafe.com/public-resources/contact-data-protection-representative or by telephone at +420 228 881 031.
2. Personal Information We Collect
2.1 Information You Provide
Account and profile: email address, password, given name, last name, language, optional location, nickname, profile image, Spotify walk-on song, and links to external sites. Nationality may be inferred from GeoIP and edited or removed by you.
Communications: inquiries to Organizers, coaches, and administrators; administrator messages to associated participants; support correspondence (including through Intercom as an internal inbox); survey and feedback responses.
Organization and competition administration data submitted by Organizers, including event configuration, participant management, scoring, and membership administration.
2.2 Information Generated Through Use
Identifiers: internal database identifiers, public-facing HashIDs used in URLs, IP addresses, and request metadata.
Competition records: registrations, matchups, scores, brackets, schedules, standings, rankings, ratings, statistics, ranking history, and participant names recorded at the time of competition.
Search queries; application and infrastructure logs (IP address, URL/path, timestamps, events, errors) via New Relic and Better Stack.
Approximate location from IP-based geolocation. Location or address text may be geocoded by Google and OpenCage into latitude and longitude. We do not request device GPS permissions and do not collect precise geolocation through device location services.
A first-party authentication cookie, including a one-year persistence if you select “Remember me,” as described in the Cookie Notice.
UTM parameters from Google Ads landing URLs may appear in server logs retained approximately 30 days. We do not currently store UTM parameters on the user record.
2.3 Payment and Identity Information
Internal Receipt records: currency, amount, customer, marketplace recipient where applicable, Stripe Charge identifier, fees, net amount, underlying registration, membership, or subscription, and refund date where applicable. Where an Organizer submits compliance materials under the Connected Account Payments Compliance Program, Version 1.0, effective October 5, 2026, we collect and retain the Organizer’s attestation record, approval status, approved event conditions, check-in records, and references to prize-funding or sponsor documents in order to administer that Program and to demonstrate those controls to our payment processor. We do not collect copies of government identification for ordinary player accounts. Billing country, where provided by the payment method or processor, may be used to apply payment-eligibility rules.
Card numbers, CVV/CVC, and bank credentials are collected on Stripe-hosted Checkout pages and are not received or stored by Darts Atlas.
Coach identity-verification status from Stripe Identity. Government-identification documents are submitted through Stripe, not collected as copies by Darts Atlas.
2.4 Information We Do Not Collect as Structured Attributes
We do not currently collect age or date of birth as structured user attributes, except to the extent we implement age collection to enforce the minimum age of 13 for self-service accounts. We do not collect gender or sex as structured attributes, accessibility needs as a standard field, health, biometric, criminal-history, or government-identification information as part of standard account use.
2.5 Sources
We collect personal information from you; automatically from devices and logs; from Organizers, leagues, venues, and coaches in connection with competitions they administer; from Stripe (payments, disputes, payouts, Identity status); and from geocoding and email-delivery providers acting on our instructions.
3. How We Use Personal Information
3.1 We use personal information to: (a) create, authenticate, and administer accounts; (b) provide, maintain, secure, and improve the Services; (c) enable registration, scoring, rankings, and publication of sporting records; (d) display public profiles and generate social sharing images where permitted; (e) communicate, including service messages and optional marketing; (f) provide support, including using historical support correspondence as context and for internal support training; (g) process payments, refunds, disputes, accounting, and taxes; (h) verify coaches through Stripe Identity; (i) detect and investigate fraud, abuse, cheating, and security incidents; (j) comply with law and establish, exercise, or defend legal claims; and (k) enforce the Terms of Use, including the prohibition on self-service accounts for users under 13. We also use organizer compliance information, including attestation status, event-review decisions, check-in status, prize-funding evidence references, and payment-enablement status, to administer the Connected Account Payments Compliance Program and enforce the Terms of Use.
3.2 Rankings, ratings, standings, and statistics are automated sporting calculations. We do not use automated decision-making that produces legal or similarly significant effects concerning employment, credit, housing, insurance, or comparable interests.
3.3 We do not sell personal information, share it for cross-context behavioral advertising, rent or license user lists, or use Google Analytics, Meta Pixel, session replay, heatmaps, or advertising pixels.
4. Disclosures
4.1 Organizers, limited to information needed for competitions and organizations they administer.
4.2 Service providers and processors: Stripe; SendGrid (open and click tracking for marketing and ordinary service emails disabled); Intercom (internal support inbox, not embedded on the website); Heroku (United States region hosting and PostgreSQL); Redis provider; AWS S3; Cloudflare; New Relic; Better Stack; Judoscale; Google and OpenCage (geocoding); Spotify (walk-on-song association); HTML/CSS to Image (image generation); GitHub (source control; production customer data is not intended to be stored there).
4.3 Professional advisers, including accountants and tax advisers.
4.4 The public, for public profiles and public competition records.
4.5 Successors in the event of a merger, acquisition, or sale of assets.
4.6 Government authorities or other parties where required by law, legal process, or to protect rights, safety, and the integrity of the Services.
5. Retention
5.1 We retain personal information only as long as reasonably necessary for the purposes described in this Policy, including legal, accounting, and reporting requirements, or as described below.
5.2 Account and profile information: retained while the account is active; user-provided profile and contact information is scrubbed immediately from active systems upon account deletion.
5.3 Account record and identifiers: retained as needed for referential integrity and historical competition records. Former profile URLs display “Account Deleted.”
5.4 Competition records: retained as a historical sporting record, with exceptional-case review as described in the Terms of Use.
5.5 Logs: approximately 30 days, unless incident, fraud, abuse, complaint, or legal hold requires longer preservation. Accessible New Relic and Better Stack retention may vary with the service plan.
5.6 Support, feedback, and surveys: retained for ongoing support, service history, product improvement, internal training, disputes, and legal purposes, without an automatic purge.
5.7 Payment and Receipt records: retained for operations, accounting, tax, audit, refunds, chargebacks, disputes, and legal compliance, without an automatic purge. Stripe separately retains payment-processing records. Organizer compliance records maintained under the Connected Account Payments Compliance Program, including attestations, approval decisions, and prize-funding references, are retained for at least five years where needed for payment-processor, audit, or legal purposes.
5.8 Heroku Postgres backups: daily, retained 7 days. Deleted production data may remain in provider backups until expiration or overwrite. Darts Atlas does not currently maintain a separate off-provider backup or formal legal-hold process.
5.9 Marketing suppression records: retained as needed to honor unsubscribe requests.
6. Security
6.1 We implement administrative, technical, and physical safeguards appropriate to the nature of the information, including HTTPS/TLS in transit, Heroku-managed AES-256 disk encryption at rest for production PostgreSQL, provider-managed encryption at rest for AWS S3, multi-factor authentication for employee access to company systems, role-based access, and manual offboarding. Security reports: security@dartsatlas.com.
6.2 No method of transmission or storage is completely secure. We do not currently maintain a formal documented incident-response plan; incidents are handled by management and technical personnel as they arise.
7. International Transfers
7.1 Production application and database hosting is in the United States through Heroku. Personal information of users in the United Kingdom, EEA, Canada, Australia, New Zealand, and other countries is transferred to and processed in the United States and in other locations where the providers in Section 4 operate.
**7.2 **Where we transfer personal information from the United Kingdom, the European Economic Area, or another jurisdiction that restricts international transfers, we do so on the basis of an adequacy decision where one is available or otherwise on the basis of appropriate safeguards. Those safeguards include the European Commission’s Standard Contractual Clauses and, where UK law applies, the UK International Data Transfer Addendum or UK International Data Transfer Agreement, together with supplementary measures where required. You may request further information about these safeguards by emailing privacy@dartsatlas.com.
8. Children; COPPA
8.1 The Services are not directed to children under 13. Self-service accounts are not permitted for users under 13, consistent with the Children’s Online Privacy Protection Act, 15 U.S.C. §§ 6501–6506, and the FTC COPPA Rule.
8.2 We do not knowingly collect personal information from a child under 13 through a self-service account. If we learn we have done so, we will delete or disable that account information as required, subject to historical competition-record rules.
8.3 Youth events may involve younger participants through Organizers with parent or guardian consent, event terms, and payment authorization, as described in the Terms of Use. Public profiles, photos, activity, and social sharing images may include a minor only with required parent or guardian consent. Minor profiles are not private by default.
**8.4 **Parents or guardians may contact privacy@dartsatlas.com.
9. California Online Privacy Protection Act (CalOPPA)
9.1 CalOPPA, Cal. Bus. & Prof. Code §§ 22575–22579, requires operators of commercial websites that collect personally identifiable information from California residents to post a privacy policy. This Policy identifies the categories of information collected, how we use and disclose it, how we notify users of changes, and how to contact us.
9.2 Do Not Track. We do not currently respond to browser Do Not Track signals. We do not deploy third-party advertising or analytics cookies on the website. If our practices change, we will update this Policy and the Cookie Notice.
9.3 We will post material changes to this Policy and, for material changes, require renewed affirmative acceptance as described in the Terms of Use. The Effective Date appears at the top of this Policy.
10. California Invasion of Privacy Act (CIPA)
10.1 CIPA, Cal. Penal Code §§ 630 et seq., restricts certain recording, monitoring, and interception of confidential communications.
10.2 Darts Atlas does not use session-replay, heatmap, keystroke-logging, call-recording, or similar technologies to record the contents of communications. Intercom is used as an internal support inbox and is not embedded on the website. We do not intercept the contents of communications to which we are not a party.
10.3 We process messages that users intentionally send to Darts Atlas, Organizers, or coaches through the Services, as the intended recipient or platform operator. The first-party authentication cookie is used solely to maintain a requested session.
10.4 If we later deploy recording, session-replay, or similar technologies that implicate CIPA, we will update this Policy and obtain any consent then required.
11. Other U.S. Federal Privacy Laws
11.1 COPPA is addressed in Section 8.
11.2 We do not collect protected health information subject to HIPAA and do not provide PHI to Stripe.
11.3 Payment-card data is handled by Stripe on Stripe-hosted pages. Darts Atlas does not receive full PAN or CVV.
11.4 CAN-SPAM: marketing emails include an unsubscribe mechanism. We honor unsubscribe requests and maintain a suppression record.
11.5 If another U.S. federal privacy statute applies to a particular processing activity, we will honor non-waivable rights under that statute.
12. California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA)
12.1 This Section 12 is a notice at collection and a CCPA/CPRA disclosure for California residents, pursuant to Cal. Civ. Code §§ 1798.100 et seq. and CPPA regulations.
12.2 Categories Collected, Purposes, Sale/Share, and Retention
Identifiers (name, email, IP address, account identifiers, HashIDs): collected from you and automatically; used to provide accounts, security, and communications; not sold or shared; retained while the account is active, then identifiers may remain for referential integrity as described in Section 5.
Customer-records information (Cal. Civ. Code § 1798.80(e)) such as name and address if you or an Organizer enter it: used to provide the Services; not sold or shared; retained as account/profile or Organizer records.
Commercial information (transactions, Receipts, subscriptions, memberships): used for payments, accounting, support, and disputes; not sold or shared; retained without automatic purge for tax, accounting, and legal purposes.
Internet or other electronic network activity (logs, search queries, authentication cookie): used to operate, secure, and improve the Services; not sold or shared; logs approximately 30 days.
Geolocation data that is approximate (IP-derived location; geocoded addresses): used for nationality inference, localization, and mapping features; not sold or shared; retained with the related account or event record. We do not collect precise geolocation.
Audio/electronic/visual information (profile photos; generated social images): used to operate profiles and promotion of the Services where consented; not sold or shared; retained while the profile is active, then scrubbed on deletion.
Professional or employment-related information (coach directory listings and Stripe Identity verification status): used to operate coaching listings; not sold or shared; retained while the listing is active and as needed for integrity and compliance.
Inferences drawn from competition results to produce rankings, ratings, and statistics: used solely as sporting functionality; not sold or shared; retained as historical sporting records.
Sensitive personal information: account log-in in combination with password or credentials, used only to provide the requested account; coach government-identification data processed by Stripe Identity, not collected as copies by Darts Atlas. We do not use or disclose sensitive personal information for purposes that require a right to limit beyond providing the Services. Not sold or shared.
12.3 We have not sold or shared personal information for cross-context behavioral advertising in the preceding 12 months. We do not have actual knowledge of selling or sharing the personal information of consumers under 16.
12.4 Categories of sources and recipients are described in Sections 2.5 and 4.
12.5 California rights: know/access; deletion; correction; opt out of sale or sharing (not applicable to current practices, but you may still email a request); limit use of sensitive personal information (used only to provide the Services); non-discrimination; and, where applicable, appeal. Submit requests to privacy@dartsatlas.com. Matthew Langan monitors that address. We do not currently operate a web form or toll-free number.
12.6 We may need to verify your request. We do not currently operate a separate authorized-agent portal. Authorized agents may email privacy@dartsatlas.com with proof of authorization.
12.7 Shine the Light. We do not disclose personal information to third parties for their direct marketing. California residents may email privacy@dartsatlas.com to request confirmation of that practice.
13. Other U.S. State Privacy Laws
13.1 Residents of states that have enacted comprehensive consumer privacy laws (including, without limitation, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Tennessee, Iowa, Delaware, New Jersey, New Hampshire, Nebraska, Minnesota, Maryland, Indiana, Kentucky, and Rhode Island, as those laws are in effect) may have rights to access, correct, delete, obtain a copy, opt out of targeted advertising, sale, or certain profiling, and appeal a denial.
13.2 We do not sell personal information or process it for targeted advertising or for profiling in furtherance of decisions that produce legal or similarly significant effects. You may still submit a request to privacy@dartsatlas.com.
13.3 We will honor non-waivable rights under the state law that applies to you. Where a law requires a defined appeal process, you may appeal a denial by replying to our decision email with the word “Appeal.”
14. United Kingdom and European Economic Area (UK GDPR and EU GDPR)
14.1 This Section 14 applies where the UK GDPR or EU GDPR applies, including for users in the United Kingdom, Ireland, the Netherlands, Sweden, Greece, and other EEA states.
14.2 Controller: The Darts Atlas Corporation, 252 Larkspur Way, Charlottesville, Virginia 22902, United States. Privacy lead: Matthew Langan, privacy@dartsatlas.com. UK representative: Lewis Tuck, lewis.tuck@dartsatlas.com. EU GDPR representative: VeraSafe Ireland Ltd., Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork T23AT2P, Ireland. If you are in the European Economic Area, VeraSafe may be contacted, in addition to Darts Atlas, only on matters related to Darts Atlas’s processing of personal data. To make an inquiry, contact VeraSafe through its data protection representative contact form at https://verasafe.com/public-resources/contact-data-protection-representative or by telephone at +420 228 881 031.
14.3 Legal bases: (a) performance of a contract (accounts, Services, registrations, payments, support); (b) legitimate interests in operating a global sporting platform, publishing an accurate historical sporting record, securing the Services, improving the product, and sending B2B or existing-customer communications, balanced against your rights; (c) legal obligation; (d) consent, including parent or guardian consent for children and marketing consent where required. You may withdraw consent without affecting prior processing.
14.4 Recipients, transfers, and retention are described in Sections 4, 7, and 5.
14.5 Rights: Subject to applicable law, you may request access, rectification, erasure, restriction, objection, or portability, or withdraw consent. Submit requests to privacy@dartsatlas.com. If you are in the European Economic Area, you may also contact VeraSafe, Darts Atlas’s EU GDPR representative, only on matters related to Darts Atlas’s processing of personal data, through its data protection representative contact form at https://verasafe.com/public-resources/contact-data-protection-representative or by telephone at +420 228 881 031. You may lodge a complaint with the supervisory authority in your habitual residence, place of work, or place of the alleged infringement, or with the ICO if you are in the United Kingdom.
14.6 Erasure of an account does not automatically rewrite public historical competition records. Exceptional suppression requests may be submitted to privacy@dartsatlas.com.
14.7 We do not engage in automated decision-making with legal or similarly significant effects.
14.8 PECR / ePrivacy. The authentication cookie is strictly necessary to provide a requested session. We do not currently set non-essential analytics or advertising cookies on the website and do not display a cookie-consent banner. If that changes, we will update the Cookie Notice and implement consent where required.
15. Canada (PIPEDA and Provincial Law)
15.1 We process personal information of individuals in Canada in accordance with the Personal Information Protection and Electronic Documents Act and applicable provincial legislation, including Quebec’s Law 25 to the extent it applies.
15.2 Accountability contact: Matthew Langan, privacy@dartsatlas.com, The Darts Atlas Corporation, 131 Continental Drive, Suite 305, Newark, Delaware 19713, United States.
15.3 We collect, use, and disclose personal information for the purposes in Section 3. You may withdraw consent to optional marketing through account settings or privacy@dartsatlas.com, subject to legal or contractual restrictions. Transactional messages may continue.
15.4 Personal information may be processed in the United States and other countries and may be accessible to courts, law enforcement, and national-security authorities in those countries.
15.5 You may request access or correction via privacy@dartsatlas.com. You may complain to the Office of the Privacy Commissioner of Canada or a provincial commissioner.
16. Australia and New Zealand
16.1 Australia. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles to the extent they apply. You may request access or correction via privacy@dartsatlas.com. You may complain to us and, if unresolved, to the Office of the Australian Information Commissioner.
16.2 New Zealand. We handle personal information in accordance with the Privacy Act 2020 to the extent it applies. You may request access or correction via privacy@dartsatlas.com. You may complain to the New Zealand Privacy Commissioner.
16.3 Overseas disclosure: personal information is stored in the United States as described in Section 7.
17. Other Jurisdictions
17.1 The Services are internationally available, including in European markets beyond those named above and in other countries from which users access Darts Atlas. Where the law of your country of residence grants privacy rights that cannot be waived, we will honor those rights.
17.2 Planned expansion markets identified by Darts Atlas include Southeast Asia, the Middle East, and South America. This Policy will be updated with additional local notices when those operations require them.
17.3 Nothing in this Policy limits any non-waivable statutory right.
18. Your Choices and Requests
18.1 Email privacy@dartsatlas.com. We do not currently operate a web form.
18.2 Manage non-essential email categories in account settings and unsubscribe from marketing.
18.3 Set your profile to Private as described in the Terms of Use. Historical competition records are treated separately.
18.4 Cookie choices are described in the Cookie Notice.
19. Changes
19.1 We may update this Policy. For a material change, we will require renewed affirmative acceptance. We will update payment-processor descriptions when Darts Atlas selects a new payment processor.
20. Contact
20.1 General.
The Darts Atlas Corporation
131 Continental Drive, Suite 305
Newark, Delaware 19713, United States
Privacy: privacy@dartsatlas.com
Legal: legal@dartsatlas.com
20.2 UK Representative: Lewis Tuck, lewis.tuck@dartsatlas.com
20.3 EU GDPR representative: VeraSafe Ireland Ltd., Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork T23AT2P, Ireland. EEA data protection inquiries concerning Darts Atlas’s processing of personal data may be submitted through VeraSafe’s data protection representative contact form at https://verasafe.com/public-resources/contact-data-protection-representative or by telephone at +420 228 881 031.