PRIVACY POLICY

Empty Agenda LLC ("we," "us," "our") operates CLUTCH PLAY ("Platform"). This Privacy Policy describes how we collect, use, store, and protect your personal information when you use our Platform. We are committed to data privacy and process all personal data in accordance with applicable law, including the California Consumer Privacy Act (CCPA) and, where applicable, GDPR principles.

By using the Platform, you consent to the data practices described in this Policy.

Account Information: When you register, we collect your email address, display name, and account credentials. We do not store raw passwords — all credentials are hashed using industry-standard cryptographic methods.

Gaming Identity: To verify player eligibility and prevent cheating, we collect your PlayStation Network (PSN) ID, Xbox Gamertag, and/or Activision ID. These identifiers are used solely for match verification.

Financial Information: We do not store full credit card numbers, bank account numbers, or CVV codes. All payment processing is handled by Stripe, Inc., a PCI-DSS Level 1 certified payment processor. We retain only Stripe-issued tokens, payment intent IDs, and Connect account references necessary to manage your platform balance and payouts.

Transaction Records: We maintain a ledger of platform transactions (deposits, entry fees, prize payouts, withdrawals) associated with your account for financial accountability and dispute resolution.

Device and Usage Data: We may collect IP addresses, device identifiers, and usage analytics to detect fraud, enforce geographic restrictions, and improve platform performance.

Identity Verification: In the event of account disputes or security lockouts, we may collect identity documentation via Stripe Identity (a Stripe-operated identity verification service) including government-issued ID and biometric selfie data. This data is processed and stored by Stripe under their privacy policy — we do not retain raw biometric data.

• To create and manage your player account.
• To facilitate competitive match entry, escrow holding, and prize distribution.
• To verify match results using gaming platform APIs.
• To process deposits and withdrawals via Stripe.
• To enforce geographic eligibility restrictions.
• To detect and prevent fraud, cheating, and prohibited conduct.
• To send transactional notifications (match confirmations, security alerts, payout confirmations).
• To comply with legal obligations and law enforcement requests.

We do not sell your personal information to third parties. We do not use your data for behavioral advertising.

All match entry fees are processed through Stripe and held in a secure escrow structure. Match records — including entry amounts, participant identifiers, and verified outcomes — are retained indefinitely for financial audit purposes and dispute resolution. These records may be disclosed to regulatory authorities upon lawful request.

Match Result Data: We cross-reference match outcomes with gaming platform APIs (Activision, PlayStation, Xbox) to verify results. This verification occurs server-to-server and no client-side API keys are used in this process.

We share data with the following third-party service providers solely for the purpose of operating the Platform:

• Stripe, Inc. — Payment processing, escrow management, identity verification, and payout distribution.
• Activision / PlayStation / Xbox — Gaming identity linking and match result verification via official APIs.
• Base44 (platform infrastructure) — Application hosting, database, and authentication services.

All third-party providers are contractually required to process your data only for the purposes we specify and in compliance with applicable data protection law.

We retain your account data for as long as your account is active. Financial transaction records are retained for a minimum of 7 years in compliance with financial recordkeeping regulations. Upon account deletion, personal identifiers are anonymized within 90 days, except where retention is required by law or ongoing dispute resolution.

We implement the following technical and organizational measures to protect your data:

• 256-bit SSL/TLS encryption for all data in transit.
• Cryptographic hashing of all transaction PIN credentials.
• Stripe-managed tokenization of all payment instruments.
• PIN + optional biometric authentication for withdrawal operations.
• Server-to-server architecture for all match verification — no client-side API key exposure.
• Automated account freeze upon detection of unauthorized access patterns.

Despite these measures, no security system is impenetrable. In the event of a data breach that affects your personal information, we will notify you within 72 hours of discovery.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Deletion: Request deletion of your personal data, subject to legal retention requirements.
• Right to Correction: Request correction of inaccurate personal data.
• Right to Portability: Request your data in a machine-readable format.
• Right to Opt-Out: Opt out of any non-essential data processing (we do not conduct behavioral advertising).

To exercise any of these rights, contact us at support@clutchplay.net. We will respond within 30 days.

The Platform uses strictly necessary cookies and session tokens for authentication and security purposes. We do not use advertising, tracking, or analytics cookies without your explicit consent.

CLUTCH PLAY is not directed to individuals under 18 years of age. We do not knowingly collect personal data from minors. If we discover that a user is under 18, we will immediately terminate their account and delete all associated data.

For privacy inquiries, data requests, or to report a security concern:
Empty Agenda LLC
Email: support@clutchplay.net