Privacy policy
Version 1.0.0 · Effective date 2026-08-17
Purpose
Kiai is a platform for organising fighting-game tournaments. This policy describes which personal data is processed when you use the service, why, for how long, with whom it is shared, and how to exercise your rights.
It applies to kiai.gg and to the Discord bot that extends it. It does not apply to Discord itself, whose use is governed by that company’s own privacy policy.
Data controller
The data controller is Emmanuel Narcisse, the natural person publishing the Kiai service.
Contact for any question about personal data and for exercising your rights: kiai.fgc@gmail.com.
Given the nature and volume of the processing, no data protection officer has been appointed, such an appointment not being required under article 37 GDPR.
Data collected
Kiai applies a minimisation principle: only the data necessary to run tournaments is processed. No special-category data within the meaning of article 9 GDPR is collected. No banking details are collected.
| Category | Data | Source |
|---|---|---|
| Account identity | Discord identifier, username, profile picture | Supplied by Discord at sign-in |
| Player profile | Country of residence, country of representation, city, interface language, characters played, game platform handles (PSN, Steam, Xbox, Switch) | Entered by you |
| Approximate location | Geographic coordinates of your city, used to sort tournaments by proximity | Optional, entered by you |
| Competitive activity | Registrations, match results, scores, standings, belt progression, match attendance | Generated by your participation |
| Reachability | A flag indicating whether Discord private messages reach you, and when it was checked | Inferred from the bot’s sends |
| Moderation notes | Notes written about you by tournament organisers | Written by third-party organisers |
| Start.gg link | Start.gg identifier, Start.gg username and two years of public set history | Optional, on your explicit authorisation |
| Consent | Version of the documents accepted and date of acceptance | Recorded at sign-up |
| Technical data | Session cookies, refresh tokens, server logs | Generated by your browsing |
Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Create and manage your account, register you for tournaments, generate brackets, record scores | Performance of the contract formed by the terms of use (art. 6.1.b) |
| Notify you of your matches and tournament deadlines via Discord | Performance of the contract (art. 6.1.b) |
| Compute and display your belt progression and standings | Performance of the contract (art. 6.1.b) |
| Sort tournaments by geographic proximity | Your consent, withdrawable at any time (art. 6.1.a) |
| Enrich your profile with your Start.gg history | Your consent, withdrawable at any time (art. 6.1.a) |
| Retain proof of your acceptance of the contractual documents | Legal obligation and legitimate interest in being able to evidence it (art. 6.1.c and 6.1.f) |
| Preserve the integrity of competitive results after an account is deleted | Legitimate interest in the integrity of records and standings (art. 6.1.f) |
| Allow organisers to moderate their community | Legitimate interest in orderly events (art. 6.1.f) |
| Secure the service and diagnose incidents | Legitimate interest in system security (art. 6.1.f) |
Where processing relies on your consent, withdrawing it does not affect the lawfulness of processing already carried out and does not delete your account.
Retention periods
| Data | Period |
|---|---|
| Account and player profile | For the lifetime of the account |
| Competitive results, standings, belt progression | Indefinitely, under an anonymised identity once the account is deleted |
| Imported Start.gg history | A rolling two years — older sets are neither imported nor retained |
| Proof of consent | Five years from closure of the account |
| Session and refresh tokens | Revoked on sign-out or on account deletion |
| Technical logs | Twelve months at most |
| Internal tournament event journal | Indefinitely, your username being replaced by an anonymous marker when your account is deleted |
Recipients and processors
Kiai sells no personal data and transmits none to any third party for advertising or commercial purposes. The only recipients are the technical providers necessary to operate the service.
| Provider | Role | Location |
|---|---|---|
| Discord | Authentication, notifications and private messages, bot operation | United States and European Union |
| Scaleway | Hosting of the application servers and the database | France |
| Cloudflare | Storage of tournament artwork uploaded by organisers | United States |
| Railway | Staging environment, holding no production data | United States |
| Start.gg | Import of your public set history, only if you have linked your account | United States |
Some data is public by nature: your username, your belt and your results appear in brackets, standings and tournament pages, including to signed-out visitors. That is the very principle of a competition. Your player profile offers visibility settings letting you restrict the display of certain elements.
Transfers outside the European Union
Primary hosting, including the database, is located in France. Some ancillary providers are established in the United States, which entails a transfer of data outside the European Union.
Discord and Cloudflare participate in the EU-U.S. Data Privacy Framework (adequacy decision). Scaleway processes data in France, with no transfer outside the European Union. Start.gg (Startgg, Inc.) stores data in the United States and does not publish a DPF certification; the transfer occurs only if you link your Start.gg account, and is framed by standard contractual clauses. Details of the applicable safeguards are available on request at kiai.fgc@gmail.com.
Your rights
You have the following rights over your personal data:
- Right of access — confirm that data about you is processed and receive a copy, including moderation notes written about you
- Right to rectification — have inaccurate or incomplete data corrected
- Right to erasure — request deletion of your account, under the conditions described below
- Right to restriction — request a temporary freeze on processing while a dispute is resolved
- Right to portability — receive your data in a structured, machine-readable format
- Right to object — object to processing based on legitimate interest, on grounds relating to your particular situation
- Right to withdraw consent — at any time, for location and for the Start.gg link
These rights are exercised at kiai.fgc@gmail.com. A reply will be provided within one month, extendable by two months where the request is complex. Proof of identity may be requested where there is reasonable doubt as to the identity of the requester.
If you consider that your rights are not respected, you may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris CEDEX 07, or at www.cnil.fr.
Account deletion
You may request deletion of your account from your profile. The operation is immediate and irreversible.
Erased or anonymised: your Discord identifier, your username, your profile picture, your countries and city, your location, your language, your game platform handles, your characters, moderation notes about you, and your Start.gg link together with the imported history. Your active sessions are revoked.
Retained under an anonymous identity: your match results, your standings and your belt progression. You appear there as a deleted player. This retention rests on the legitimate interest in preserving the integrity of competitions already played: erasing a participant from a completed bracket would distort the record of every one of their opponents.
Also retained is the proof of your consent, for five years, so that the lawful basis for processing your data can be evidenced.
Minors
The service is restricted to persons aged at least fifteen. That threshold matches the age at which, under French law, a minor may consent alone to the processing of their data in an online service.
No age verification is carried out beyond your declaration. If you become aware that an account was created by a person under fifteen, report it to kiai.fgc@gmail.com: the account will be deleted and the associated data erased.
Cookies
Kiai uses no audience-measurement, advertising, profiling or tracking cookies, and relies on no behavioural analytics service.
The only cookies set are strictly necessary to the service: they maintain your authenticated session and remember your interface language. They are therefore exempt from prior consent, and no banner is imposed on you.
Security
The session is carried by cookies inaccessible to JavaScript, traffic is encrypted in transit, and tokens issued by third-party services are encrypted at rest. Database access is restricted to the private network of the infrastructure.
No system is infallible. In the event of a data breach likely to result in a risk to your rights and freedoms, the CNIL will be notified within the regulatory deadlines and you will be informed where the risk is high.
Changes to this policy
This policy carries a version number and an effective date. Every published version remains available: a revision does not replace the previous one, it is added alongside it.
Where a change is substantial, the new version will be presented to you at your next sign-in and your acceptance will be collected again. The version you accepted, and its date, are retained.