Privacy Notice

ValoTour (operated by The SaaS People) ("ValoTour", "we") runs valotour.thesaaspeople.com, a platform where organisers host community Valorant tournaments and players register for them. We are the Data Fiduciary for the personal data described here under the Digital Personal Data Protection Act, 2023 (DPDP Act), and an intermediary under the Information Technology Act, 2000 and the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

This notice is version 2026-09-21. You accept it by a clear affirmative act when you finish setting up your account (a checkbox, after the itemised list below is shown). Browsing as a guest creates a throwaway account that holds no personal data.

Tournament hosts are separate people. When a host takes your entry fee over UPI or messages you on Discord, the host is handling your data outside ValoTour and is responsible for it.

When you sign in (Discord, Google, Twitch, GitHub, Microsoft or a one-time e-mail link):

• The provider's account id, your display name, e-mail address and avatar URL as the provider reports them.
• From Discord only: your Discord username, which becomes the contact handle hosts see.

When you set up your profile:

• Display name, Riot ID (Name#Tag), Discord username (if you did not sign in with Discord).
• Whether you are 18 or older, and for under-18s the fact that a parent or guardian agreed; the Terms version and time you accepted.
• Home Valorant server and preferred currency (guessed from your browser's timezone; you can change them).
• Optional referral or stream code.

When you register for and play in a tournament:

• Peak rank and tier you declare, team name, check-in time, whether the host marked you paid.
• Match records: maps, agents, kills, deaths, assists, combat score and placements entered by you, your opponent or the host.
• Messages you post in a match room, score reports, dispute evidence, roster-change and reschedule requests, no-show and player reports you make or receive.

When you host:

• Tournament details you publish, the Discord webhook URL you add, prize payout notes you write (for example a UPI reference), payments of the hosting fee.

Automatically:

• IP address and browser user agent on security-relevant actions (sign-in, profile edits, reports, host actions), kept in an audit log.
• Server logs and error reports (Sentry, if configured) which may include your user id and the page you were on.
• A Cloudflare Turnstile token when you complete sign-up, to keep bots out.
• Session recordings, only if you say yes (see Cookies and analytics).

From other people: hosts and other players enter results, placements and reports that mention you.

We do not collect government IDs, biometrics, precise location, or card numbers. Payment card and UPI details for the hosting fee are entered on Razorpay's page and never reach us.

1. Sign-in and account — provider id, e-mail, name, avatar: to create your account and keep you signed in.
2. Running tournaments — display name, Riot ID, Discord username, rank, team, check-in, results, messages: so hosts and opponents can seat you in a bracket, find you for a match, verify who played, and record what happened. Your Riot ID is public on your profile for this reason.
3. Fair play — reports, cheater marks, audit log: to act on smurfing, cheating and no-shows. Reports from three different tournaments ban an account.
4. Notifications — e-mail (when configured) and in-app: match reminders, results, disputes, payouts. Hosts you follow may notify you when a cup opens; turn it off in Notifications.
5. Hosting fee — Razorpay order and payment references: to charge hosts and issue refunds where due.
6. Age and consent — 18-or-over flag, guardian consent, Terms version: to meet the DPDP Act and keep under-18 accounts out of paid entry and analytics.
7. Security and abuse — IP, user agent, Turnstile: rate-limiting, bot prevention, investigating incidents.
8. Improving the product — session recordings (consent-based), error reports: to find and fix problems.
9. Legal — to respond to lawful orders and to keep records tax law requires.

Legal basis: your consent for 1–2, 4, 6 and 8; the legitimate uses in s.7 of the DPDP Act for 3, 5, 7 and 9 (performance of a function you asked for, compliance with law, security). We do not sell personal data and do not run advertising.

• Everyone (public pages): your display name, Riot ID, rank badges, tournament placements, match records, trust state (verified / flagged / banned), the organiser page if you host.
• Hosts of tournaments you enter: additionally your Discord username, declared peak rank, payment status, reports about you, and roster/reschedule requests.
• Your opponents in a match room: your messages, ready state and score reports.
• Your Discord server (host-configured webhook): tournament announcements with team and player names.

Processors we use:

• Hostinger International Ltd. — the virtual server and PostgreSQL database the site runs on.
• Resend, Inc. (USA) — transactional e-mail, when configured.
• Microsoft Corporation (Clarity, USA) — session recordings, only after you accept.
• Razorpay Software Pvt. Ltd. (India) — hosting-fee payments.
• Cloudflare, Inc. — Turnstile bot check at sign-up; Web Analytics page-view counts (cookieless, no personal data).
• Functional Software, Inc. (Sentry, USA) — error reports, when configured.
• Discord Inc., Google LLC, Twitch Interactive, GitHub Inc., Microsoft Corporation — sign-in; each shows you what it shares before you approve.
• valorant-api.com — public list of agents and maps; nothing about you is sent.

We disclose data to authorities only on a lawful request, and would transfer it in a merger only under this notice.

Strictly necessary (no consent needed): the sign-in session cookie (authjs.session-token or next-auth.session-token), the CSRF token and the OAuth callback cookie. Blocking them stops sign-in.

Traffic counts (no consent needed): Cloudflare Web Analytics counts page views and page speed. It sets no cookies, stores nothing in your browser, does not fingerprint you and does not keep your IP address, so it holds no personal data.

Session recordings (your choice): with your OK we load Microsoft Clarity, which replays how you use the site: pages, clicks, scrolling, and the text you type into fields other than passwords. Recordings are tagged with your ValoTour user id and role so we can find the session behind a bug report. Clarity sets its own cookies (_clck, _clsk). It is never loaded for accounts that told us they are under 18.

Say yes or no in the banner on your first visit, and change your mind any time under Account → Privacy or Privacy choices in any footer. Withdrawing stops the recorder in that browser immediately; recordings already made are deleted by Clarity on its schedule (currently 30 days) unless we have saved a link to one for an open investigation.

We use no advertising cookies and no cross-site tracking.

You must be at least 13 to have a Valorant account under Riot's terms, so we accept players from 13. Under the DPDP Act everyone under 18 is a child, and we treat them as such:

• At sign-up you tell us whether you are 18 or over. Under-18 accounts require a parent or guardian to agree to this notice and the Terms; we record that consent and when it was given. We do not yet verify the guardian's identity through a government scheme; when the DPDP Rules' verification methods come into force we will add them.
• Under-18 accounts are never session-recorded, receive no marketing, and cannot take paid entry plans.
• A parent or guardian can ask for a child's data or delete the account at hello@thesaaspeople.com.

If we learn that an account belongs to someone under 13, or that a child's account was created without a guardian's consent, we delete it.

• Account and profile: until you delete the account.
• Tournament and match records: kept with the tournament so brackets and results stay whole. When you delete your account they stay under "Deleted player" with no name, Riot ID or contact details attached.
• Match-room messages and notifications: messages are deleted with your account; notifications older than 365 days are deleted automatically.
• Audit log: IP address and user agent are blanked after 180 days; the record of what was done is kept for 3 years.
• Hosting-fee payment records: 8 years (Income-tax Act, 1961 and GST record-keeping).
• Guest accounts: deleted after 14 idle days.
• Banned accounts: the minimum needed to stop ban evasion (provider id and e-mail hash).

These periods are enforced by a daily job, not by hand.

Under Chapter III of the DPDP Act you can:

1. See your data — Account → Privacy → Download my data gives you a JSON file with everything keyed to your account, instantly.
2. Correct it — display name, Riot ID, Discord username, server and currency are editable under Account; anything else, e-mail us.
3. Erase it — Account → Privacy → Delete my account removes your name, e-mail, Riot ID, Discord username, picture, sign-in methods, messages and notifications and signs you out everywhere. Cups you still host must be finished or cancelled first.
4. Withdraw consent — session recordings: the checkbox under Account → Privacy; marketing from hosts you follow: Notifications; everything else: delete the account. Withdrawal does not undo processing that already happened.
5. Nominate someone to exercise these rights if you cannot: e-mail us with their details.
6. Complain — to our Grievance Officer first (below), then to the Data Protection Board of India.

We reply to e-mailed requests within 15 days and may ask you to confirm you own the account.

Traffic is encrypted with TLS. The database and its backups live on the server with access limited to the operator; secrets are kept out of the code. Administrative actions are audited. Session recordings, if you allow them, exclude password fields.

If personal data is breached we will tell the Data Protection Board and every affected user without delay, and in any case within 72 hours of becoming aware, with what happened, what data was involved and what to do (DPDP Rules, 2025, rule 7). Report a suspected breach to hello@thesaaspeople.com.

The server and database are with Hostinger; e-mail (Resend), error reports (Sentry) and session recordings (Microsoft Clarity) are processed in the United States and, for Microsoft, the EU. Sign-in providers process your data wherever they operate. Transfers are permitted under s.16 of the DPDP Act except to countries the Central Government restricts; none of our processors is in a restricted country.

When this notice changes materially we bump the version at the top, show a notice in the app until you have read the new version, and e-mail account holders where e-mail is configured. Earlier versions are in the public source history and available on request.

• Grievance Officer: being appointed; the operator handles complaints until then
• E-mail: hello@thesaaspeople.com
• Entity: ValoTour (operated by The SaaS People)

Complaints are acknowledged within 24 hours and resolved within 15 days (IT Rules 2021, rule 3(2); DPDP Act s.8(10)). See the Contact page for law-enforcement and takedown requests.

Paid entry plans are switched off on this platform; nothing in this notice about entry fees applies until they are enabled.