Privacy Policy

1. Introduction and Scope

This Policy describes the personal information we handle and your choices and rights. The specific data points below reflect what the Platform actually processes.

2. Who We Are (Data Controller)

RequestGG LLC is the controller responsible for your personal information processed through the Platform. For privacy questions or to exercise your rights, contact us at support@requestgg.com.

3. Information We Collect

We collect the categories of information described below. The specific data points reflect what the Platform actually processes.

3.1 Account and Authentication Information

When you create an account, you provide an email address and password. Authentication is handled by our backend provider (Supabase Auth), which stores your credentials in hashed/secured form and issues a session token stored in a secure, HTTP-only cookie. We also record your assigned role (Fan, Creator, or, for our staff, moderator) and your account creation date.

3.2 Profile Information

Depending on how you use the Platform, your profile may include:

• Display name;
• Profile avatar image and, for Creators, a cover image (where provided);
• In-game identifier (such as your Epic Games ID) and competitive rank, used to coordinate and deliver Sessions;
• Discord username, where you choose to link Discord (required for “MVP” Sessions, which take place in the Creator’s designated voice channel within the official RequestGG Discord server);
• For Creators: a public profile slug, biography, time zone, and listed social-media links (which may include X/Twitter, Twitch, YouTube, TikTok, and Instagram).

3.3 Creator Application Information

If you apply to become a Creator, we collect your display name, an application pitch, and any social-media URLs you submit (X/Twitter, Twitch, YouTube, TikTok, and Instagram), together with the status of your application.

3.4 Booking, Transaction, and Payout Information

When a Session is booked, we collect and store details of the transaction, including the Creator and Fan involved, the selected package (number of games and tier, including standard or MVP), the play mode (e.g., 1v1 or co-op), the scheduled date and time, the price and our platform service fee, the booking status, and identifiers returned by our payment processor (such as the Stripe Checkout session, payment intent, and refund identifiers). We also store a snapshot of the Fan’s display name with the booking and, where applicable, refund-related details (including the time of a no-show report and the stated reason) and dispute/moderation timestamps.

3.5 Payment Information

Payments and Creator payouts are processed by Stripe, Inc. (“Stripe”) using Stripe Connect. Stripe collects and processes payment and identity information directly — including, as applicable, payment card details, bank account details, and the identity/verification information Creators must provide to receive payouts. RequestGG does not collect or store full payment card or bank account numbers. We receive and store only limited transaction metadata and Stripe identifiers (for example, a Creator’s connected-account identifier and charge status, and the transaction identifiers described above). Stripe’s processing of your information is governed by Stripe’s own privacy policy.

3.6 Communications: Messages, Reviews, and Support

• Messages. We store the content and metadata of messages exchanged between Fans and Creators in a Session’s message thread, including who sent each message and when. As described in Section 6, RequestGG staff (moderators) may access these messages, including when a dispute is escalated.
• Reviews and ratings. If you submit a review, we store the star rating, any written comment, and the date, which are displayed publicly on the Creator’s profile together with your display name.
• Contact form. If you contact us, we store your name, email address, the subject category, and your message.

3.7 Information Collected Automatically

When you use the Platform, we and our infrastructure providers automatically collect certain technical information, including:

• IP address. We process your IP address to operate rate-limiting and anti-abuse controls on sign-in, sign-up, contact-form, and booking actions, and to maintain the security of the Platform. Rate-limit counters keyed to an IP address or account are stored transiently.
• Cookies and session data. We use a secure, HTTP-only authentication cookie to keep you signed in, an administrative-access cookie for our staff console, and transient parameters used to display one-time status messages. See Section 4.
• Log and request data. Our hosting provider (Vercel) and backend provider (Supabase) process standard server logs, such as request times, pages or endpoints accessed, and error data, for operation, security, and debugging.
• Approximate location and time zone. We may derive an approximate region from your IP address and store a time zone for Creators to schedule Sessions. We do not collect precise geolocation.

3.8 Anti-Spam (Honeypot)

Our contact form includes a hidden “honeypot” field that is not visible to humans. If it is completed, we treat the submission as automated and discard it. We do not use this field to collect information about legitimate users.

4. Cookies and Similar Technologies

We use a small number of strictly necessary cookies and similar technologies to operate the Platform:

• Authentication cookies (set by Supabase Auth) keep you signed in and maintain your session securely (HTTP-only).
• Administrative-access cookie restricts our internal staff console to authorized personnel.
• Transient UI parameters are used briefly to show confirmation messages and are then cleared.

We do not use third-party advertising cookies, cross-site tracking, or behavioral-advertising technologies. Because the cookies we use are strictly necessary to provide the service you request, they operate without separate consent where permitted; you can block cookies in your browser, but the Platform may not function properly without them.

5. How We Use Your Information and Legal Bases

We use personal information for the following purposes. For users in the EEA, United Kingdom, and Switzerland, the corresponding GDPR legal basis is noted in brackets.

• Provide and operate the Platform — create and manage accounts, list Creator profiles and availability, enable discovery, booking, scheduling, and delivery of Sessions, and coordinate via messaging. [Performance of a contract.]
• Process payments and payouts — facilitate charges, the platform service fee, Creator payouts, and refunds through Stripe. [Performance of a contract; legal obligation.]
• Send transactional communications — booking confirmations, reminders, refund and dispute notices, and account or service messages via our email provider (Resend). [Performance of a contract; legitimate interests.]
• Security, fraud, and abuse prevention — rate limiting, honeypot filtering, and protecting the Platform and Users. [Legitimate interests; legal obligation.]
• Disputes and moderation — review message threads and booking details to resolve disputes and enforce our Terms. [Legitimate interests.]
• Reviews and reputation — publish reviews and aggregate ratings on Creator profiles. [Legitimate interests; consent where required.]
• Support — respond to your inquiries submitted through the contact form or by email. [Legitimate interests; performance of a contract.]
• Legal and compliance — comply with tax, accounting, and other legal obligations, and establish, exercise, or defend legal claims. [Legal obligation; legitimate interests.]

We do not engage in solely automated decision-making that produces legal or similarly significant effects about you; dispute and moderation decisions involve human review.

6. How We Disclose Your Information

We do not sell your personal information. We disclose personal information only as described below.

6.1 With Other Users

By design, certain information is shared with other Users: Creator profile information (name, avatar/cover image, bio, social links, packages, availability, and ratings/reviews) is publicly visible; a Fan’s display name appears with their reviews and is shared with the Creator on a booking; and messages are shared with the other party to the booking and may be read by RequestGG moderators.

6.2 With Service Providers (Sub-Processors)

We use the following service providers to operate the Platform. They process personal information on our behalf, subject to contractual obligations:

Sessions also take place within third-party games and platforms (such as Rocket League and other supported titles, operated by their respective publishers, e.g. Psyonix/Epic Games). Those platforms independently collect information under their own privacy policies; RequestGG does not control them.

6.3 For Legal Reasons and Business Transfers

We may disclose personal information if required to do so by law or in response to valid legal process; to enforce our Terms; to detect, prevent, or address fraud, security, or technical issues; or to protect the rights, property, or safety of RequestGG, our Users, or the public. If RequestGG is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy.

7. International Data Transfers

RequestGG is based in the United States, and our service providers (including Supabase, Stripe, Resend, and Vercel) process information in the United States. If you access the Platform from outside the United States, including from the EEA, the United Kingdom, or Switzerland, your personal information will be transferred to and processed in the United States, where data-protection laws may differ from those in your jurisdiction.

Where required, we rely on appropriate safeguards for such transfers, such as the European Commission’s Standard Contractual Clauses (and the UK Addendum) or other lawful transfer mechanisms.

8. Data Retention

We retain personal information for as long as your account is active and as needed to provide the Platform, and thereafter as necessary to comply with our legal obligations (for example, tax and accounting records related to transactions), resolve disputes, prevent fraud and abuse, and enforce our agreements. Transient data, such as rate-limiting counters and one-time status parameters, is kept only briefly. When information is no longer needed, we delete or de-identify it. Specific retention periods may vary by data type and legal requirement.

9. How We Protect Your Information

We implement technical and organizational measures designed to protect personal information, including: encryption of data in transit (HTTPS) and HTTP Strict Transport Security; row-level security in our database restricting access to authorized records; restriction of privileged (service-role) database access to trusted server-side operations; secure, HTTP-only session cookies and hashed credentials managed by our authentication provider; verification of payment webhooks via cryptographic signatures; rate limiting and anti-abuse controls; and security response headers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Your Rights Under the GDPR (EEA, UK, and Switzerland)

If you are located in the EEA, the United Kingdom, or Switzerland, you have the following rights with respect to your personal information, subject to applicable law:

• Access — obtain confirmation of whether we process your data and a copy of it;
• Rectification — correct inaccurate or incomplete data;
• Erasure — request deletion of your data (the “right to be forgotten”), subject to legal-retention exceptions;
• Restriction — request that we limit processing in certain circumstances;
• Portability — receive your data in a structured, commonly used, machine-readable format;
• Objection — object to processing based on legitimate interests, and to direct marketing at any time;
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing;
• Lodge a complaint — with your local supervisory authority (and, in the UK, the Information Commissioner’s Office).

To exercise these rights, contact us at support@requestgg.com. We will respond within the time required by law. We may need to verify your identity before acting on a request.

11. Your Rights Under the CCPA/CPRA (California Residents)

This Section applies to California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”). The categories of personal information we have collected in the preceding 12 months are summarized below.

11.1 No Sale or Sharing of Personal Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the CCPA. We have not done so in the preceding 12 months. We also do not use or disclose sensitive personal information for purposes that would require offering a right to limit under the CCPA.

11.2 Sources and Purposes

We collect the categories above from you directly, automatically through your use of the Platform, and from our service providers (such as transaction status from Stripe). We use them for the business and commercial purposes described in Section 5, and we disclose them to the service providers listed in Section 6 for those purposes.

11.3 California Privacy Rights

• Right to know the categories and specific pieces of personal information we have collected, the sources, purposes, and the categories of recipients;
• Right to delete personal information we have collected, subject to exceptions;
• Right to correct inaccurate personal information;
• Right to opt out of the sale or sharing of personal information (note: we do not sell or share);
• Right to limit the use of sensitive personal information (note: we already limit such use to providing the service);
• Right to non-discrimination for exercising your rights.

To exercise these rights, contact us at support@requestgg.com. You may use an authorized agent to submit a request on your behalf, subject to verification. We will not discriminate against you for exercising your rights.

12. Children’s Privacy

The Platform is not directed to children under 13, and we do not knowingly collect personal information from children under 13 without verifiable parental consent. If you are under 18, you may use the Platform only with the permission and supervision of a parent or legal guardian who consents on your behalf and agrees to our Terms of Service. A parent or guardian is responsible for a minor’s activity, including any bookings and payments. If you believe a child under 13 has provided us personal information without such consent, contact us at support@requestgg.com and we will delete it.

13. Marketing and Communications Preferences

We primarily send transactional messages necessary to provide the Platform, such as booking confirmations and reminders. Where we offer optional updates or a newsletter, we will send them only consistent with applicable law, and you may opt out at any time using the unsubscribe mechanism in the message or by contacting support@requestgg.com. You cannot opt out of essential transactional and account communications while you maintain an account.

14. Third-Party Services and Links

The Platform links to or integrates with third-party services, including Stripe, Discord, and Creators’ linked social-media profiles, and Sessions occur on third-party game platforms. We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy policies.

15. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will update the “Last Updated” date and may provide additional notice. Your continued use of the Platform after the changes take effect constitutes acceptance of the revised Policy.

16. How to Contact Us

If you have questions about this Policy or wish to exercise your privacy rights, contact us at support@requestgg.com (RequestGG LLC).