Privacy policy
Last updated: November 5, 2026
This policy explains what personal data we process when you use PlayFunded, why we use it, who we share it with and how you can exercise your rights.
1. Data controller
The controller of your data is PlayFunded (playfunded.lat). You can contact us about privacy at support@playfunded.lat.
If the controller identification details change, we will update this policy and notify you.
2. What data we collect
Account data: name, email, language, approximate country and sign-in credentials (your password is stored hashed by our authentication provider). If you sign in with Google, we receive your name, email and profile picture.
Verification data (KYC): full name, date of birth, country, document type and images of your identity document. We only ask for it before a payout or if there are risk signals.
Payment data: transaction metadata (amount, currency, status, processor identifiers and date). We do not store full card numbers: the payment provider processes them directly. For payouts to you we store the wallet address or other payout details you provide.
Platform activity: challenges, picks, simulated balances, payout requests and support messages (including WhatsApp, if you message us there).
Technical and usage data: IP address, country derived from IP, device and browser type, pages visited and usage events (analytics with PostHog), and error logs (Sentry).
Emails: we send transactional emails (verification, challenge and payout notices) through an email provider such as Resend, which records delivery.
3. Why we use your data
To create and manage your account; run challenges and the funded stage; process purchases and payouts; verify your age and identity; apply country restrictions; prevent fraud, multiple accounts and money laundering; provide support; send service emails; measure and improve the product; detect and fix errors; and meet legal obligations.
We do not sell your personal data or use it for third-party advertising.
4. Legal bases
We process your data under Ecuador's Organic Law on Personal Data Protection (LOPDP) and, where applicable, the EU General Data Protection Regulation (GDPR), Brazil's LGPD or other local laws.
The bases are: performance of the contract (providing the service you signed up for); compliance with legal obligations (for example identity verification, anti-money laundering and accounting records); our legitimate interest (security, fraud prevention, basic analytics and product improvement), always balanced against your rights; and your consent where we ask for it, which you can withdraw at any time.
5. Providers that process data for us
We use providers (processors) that only process your data to provide their service to us: Supabase (database, authentication and document storage), Vercel (site hosting), Stripe (card payments), NOWPayments (crypto payments), PostHog (usage analytics), Sentry (error monitoring), Resend or another SMTP provider (email), Google (sign-in, if you choose it) and Meta's WhatsApp (if you message us there). If we enable the chat assistant, messages you send it are processed with Anthropic.
We may also share data with authorities when the law requires it, or with professional advisers under confidentiality.
6. International transfers
Several of our providers store or process data outside your country, for example in Brazil, the United States or the European Union. When that happens, we use providers with appropriate safeguards, such as standard contractual clauses and recognized security measures.
7. How long we keep data
Account and activity data: while your account is active and for up to 5 years after closing it, to handle claims, prevent fraud and meet legal obligations.
KYC documents and payment records: for the period required by applicable anti-money laundering, tax and accounting rules, usually up to 5 years after the relationship ends.
Analytics and error logs: only as long as needed for their purpose, according to each provider's settings. When the period ends, we delete or anonymize the data.
8. Security
We use encryption in transit, role-based access control, private storage for identity documents and access reviews. No system is 100% secure; if an incident affects your data, we will notify you and the authority when the law requires it.
9. Your rights and how to exercise them
You can ask to access your data, correct it, delete it, object to or restrict its processing, receive it in a portable format, withdraw your consent and not be subject to decisions based solely on automated processing without human involvement.
To exercise them, write to support@playfunded.lat from your account email, stating which right you want to exercise. We may ask you to confirm your identity. We will reply within the deadlines of the applicable law. Some data may be kept if a legal obligation requires it.
If you are not satisfied with our reply, you can complain to Ecuador's Superintendency of Personal Data Protection or to the data protection authority in your country.
10. Automated decisions
The challenge engine applies the published rules automatically (for example, it fails an account that exceeds the max loss). This is part of the service you sign up for. You can ask for a person to review any decision by writing to us.
12. Minors
PlayFunded is for people 18 and over only. We do not knowingly collect data from minors. If we find that an account belongs to a minor, we close it and delete its data, except what the law requires us to keep.
13. Changes to this policy
We may update this policy. We will publish the new version with its date and, if the change is significant, notify you by email or on the platform.
14. Contact
For any privacy question, write to support@playfunded.lat.