Privacy Policy

Information under Art. 13 and 14 GDPR for the openmatch app, the venue dashboard and the website open-match.com. The German version (Datenschutzerklärung) is the authoritative text; this translation is provided for convenience.

• 1. Controller
• 2. Contact
• 3. Data, purposes, legal bases (app)
• 4. Recipients and processors
• 5. Retention
• 6. Analytics and withdrawal
• 7. Minimum age and protection of minors
• 8. Forms and waitlist (website)
• 9. Hosting and server logs
• 10. Third-party services on the website
• 11. Cookies and local storage
• 12. Your rights
• 13. Data security
• 14. Data breaches
• 15. Automated decisions
• 16. Dispute resolution
• 17. Changes

---

1. Controller (Art. 13(1)(a) GDPR)

The controller for data processing on the openmatch platform and this website is:

When you book with a venue through openmatch, that venue operator is independently responsible for the data of your booking (Art. 4(7), Art. 6(1)(b) GDPR). openmatch and the operator are separate controllers in that respect, not joint controllers.

2. Contact

For any privacy question, email us at support@open-match.com. We have not appointed a separate data protection officer; there is currently no legal obligation to do so.

Part A: openmatch app and venue dashboard

3. Categories of data, purposes and legal bases (Art. 13(1)(c) GDPR)

We process your data only where necessary. In detail:

We do not process special categories of personal data (Art. 9 GDPR).

About the contacts feature: if you allow the app to access your address book, the phone numbers of your contacts are sent to our servers and matched against the phone numbers of existing openmatch accounts, so we can show you which of your contacts already play. The numbers are used only for this match and are not stored permanently. The match runs server-side against the existing user database; the request is not logged or archived. If you invite a contact who has no openmatch account, we keep their phone number only as long as needed to deliver and attribute the invitation, at most 90 days. Contact data is never passed on to third parties or sold. The feature is optional; you can revoke access at any time in your device's permission settings.

4. Recipients and processors (Art. 13(1)(e) and (f) GDPR)

We pass your data only to carefully selected service providers that support us in delivering our services (processing on our behalf under Art. 28 GDPR). Where data is transferred to the USA, we rely on the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023) and, as an additional safeguard, on the Standard Contractual Clauses (Implementing Decision (EU) 2021/914) (Art. 44 et seq., Art. 46 GDPR).

The venue operator you book with receives the data needed for the booking as an independent controller.

For the openmatch Pro subscription, Apple (App Store) and Google (Google Play) process the purchase itself as independent controllers under their own privacy policies; RevenueCat receives from us only the data listed above, needed to keep your subscription status in sync.

Legal situation (as of 2026): the adequacy decision for the EU-U.S. Data Privacy Framework is in force; the Latombe action was dismissed by the General Court of the EU on 3 September 2025. An appeal (C-703/25 P) is pending before the Court of Justice. Because of that residual risk we additionally rely on the Standard Contractual Clauses.

5. Retention (Art. 13(2)(a) GDPR)

We keep your data only as long as necessary for the purposes described or as required by statutory retention obligations.

• Account data: until you delete your account. On deletion your account is deactivated and your contact data (name, e-mail, phone number) is anonymised immediately; at the latest 30 days later an automated deletion worker permanently erases what remains of your personal data (e.g. photos, messages, activity data; Art. 17 GDPR). Deletion is irreversible; there is no recovery window.
• Tax and receipt data (payment receipts, invoices, booking tombstones): subject to the statutory retention period of 8 years (§ 14b UStG, § 147(3) AO as amended from 2025; legal basis Art. 6(1)(c) GDPR). They are kept after an account deletion until that period expires, with minimal fields (receipt number, amount, date, VAT ID), and are then deleted. Processing of these records is restricted.
• Chat messages: 90 days after the match.
• Server and error logs: 90 days.
• Phone numbers from your address book: not stored permanently; invitation data at most 90 days (see section 3).

6. Analytics and withdrawal (Art. 6(1)(a), Art. 7 GDPR, § 25 TDDDG)

Processing of your usage data for analytics (PostHog, EU-hosted) is based solely on your consent and is designed as an opt-in: the app asks you on first launch. Without your consent no analytics client is loaded and nothing is stored on your device for analytics purposes (§ 25 TDDDG). On iOS the system tracking prompt (App Tracking Transparency) is shown in addition.

You can withdraw your consent at any time with effect for the future in the settings of the app or the dashboard. Your choice is also sent to our server so that server-side usage measurement follows it. The lawfulness of processing carried out before the withdrawal is not affected.

We do not use advertising or third-party trackers, so there is no cookie banner for such trackers in the app. The app uses no cookies. Login tokens are stored in your device's protected storage.

7. Minimum age and protection of minors

Using openmatch requires a minimum age of 16 years. We collect your date of birth to check this limit. Persons under 16 may not use the platform. Individual venue operators may set a higher minimum age for their venue (18 or 21, for example where alcohol is served); we check that at booking time against your date of birth as well.

We also use your date of birth to protect minors: a private chat with a user who, according to the date of birth they provided, is under 18 can only be started by that user, by other users under 18, or by the openmatch team (for example support). Users without a date of birth on file count as adults for this rule. Existing chats, such as one the minor started, stay open for both sides. Group chats (for example of an Open Match, a booking or a tournament) and chats between a venue and its customer about a booking are not affected. Your date of birth is not shown to other users in the process. The legal basis is our legitimate interest in protecting minors on the platform from unsolicited contact by adults (Art. 6(1)(f) GDPR).

Part B: website open-match.com

8. Forms and waitlist

The website open-match.com is the information surface for the openmatch app. If you fill in a form here, we collect the following data depending on the form:

Legal basis: Art. 6(1)(a) GDPR (consent by actively submitting the form) and Art. 6(1)(b) GDPR (pre-contractual measures).

Double opt-in for the waitlist: waitlist sign-up uses a double opt-in procedure. After submitting the form you receive a confirmation email with a confirmation link. Only once you click that link is your sign-up complete and may we send you launch updates. To document your consent (Art. 7(1) GDPR) we record the time of sign-up and the time of confirmation. If you do not confirm, you receive no further emails and your details are deleted after 30 days at the latest. You can withdraw your consent at any time with effect for the future, for example by emailing support@open-match.com or via the unsubscribe link in our emails.

Processing and storage: form data is sent over an encrypted HTTPS connection to Google Apps Script (script.google.com) and forwarded by email to our team (Google Workspace, servers in the EU/USA). Google acts as a processor under Art. 28 GDPR; the Google Workspace DPA applies (also to Google Apps Script as part of the Google Cloud Platform).

Retention: waitlist entries are deleted no later than 12 months after the official launch unless you have consented to longer storage. You can request deletion of your data at any time.

9. Hosting and server logs (Cloudflare Pages)

This website is hosted by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) on the Cloudflare Pages platform. On every request Cloudflare processes technical data (IP address, browser headers, request timestamp, requested page) to deliver the service, defend against abuse (DDoS protection, bot filtering) and maintain availability. This data is not merged with other data sources and is deleted after 30 days at the latest in line with Cloudflare's standard retention. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in stable, secure operation). Transfer to the USA: Cloudflare is certified under the EU-U.S. Data Privacy Framework; EU Standard Contractual Clauses apply in addition (Art. 46 GDPR). Privacy policy: cloudflare.com/privacypolicy. DPA: cloudflare.com/cloudflare-customer-dpa.

10. Third-party services on the website

a) Bunny Fonts

This website uses fonts from Bunny Fonts, a privacy-friendly font CDN operated by BunnyWay d.o.o. (Slovenia, EU). Loading the fonts sets no cookies, logs no IP addresses and transfers no personal data to third parties outside the EU. More information: Bunny Fonts privacy. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in an appealing presentation). Because processing takes place within the EU and no data is passed to third parties, no separate consent is required.

b) Microsoft Clarity

This website uses Microsoft Clarity, a web analytics service of Microsoft Corporation. Clarity creates heatmaps and anonymised session recordings to understand how visitors interact with the website (e.g. clicks, scrolling, mouse movement).

Clarity is loaded only after your explicit consent (cookie banner). Without your consent no data is sent to Microsoft. The following data may be processed:

• IP address (anonymised)
• Screen size, browser type, operating system
• Click and scroll behaviour
• Pages visited and time spent

Microsoft Clarity does not store personal form data, passwords or keystrokes in form fields. More information: Microsoft Clarity privacy. Legal basis: Art. 6(1)(a) GDPR (consent).

You can withdraw your consent at any time by clicking “Cookie settings” in the footer of every main page (home, /venues, /investors), here on the privacy policy and in the Impressum. Withdrawal is as easy as consent: one click withdraws consent, ends the running Clarity session and removes the cookies set by Clarity from your browser. Alternatively, delete the localStorage entry om_analytics_consent in your browser settings or visit the site in private mode.

Transfer to the USA: Microsoft Clarity is a US service. When enabled, data is transferred to Microsoft Corporation (One Microsoft Way, Redmond, WA 98052, USA). Legal basis for the third-country transfer: Art. 49(1)(a) GDPR (your explicit consent) and the EU-U.S. Data Privacy Framework, under which Microsoft is certified. Please note that US authorities may, under the CLOUD Act / FISA 702, obtain access to data held by US providers, and that the level of data protection in the USA is not in every respect comparable to that in the EU.

c) Resend (transactional email)

Confirmation and transactional emails of the website (e.g. the double opt-in confirmation) are sent via Resend, Inc. (2261 Market Street #4889, San Francisco, CA 94114, USA). Resend processes the submitted email address, the sending time and delivery metadata. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(a) GDPR (consent) for marketing emails. Transfer to the USA: EU-U.S. Data Privacy Framework and Standard Contractual Clauses. Privacy policy: resend.com/legal/privacy-policy.

11. Cookies and local storage on the website

This website sets no cookies of its own. Cookies are set exclusively by two third parties, which we list transparently:

a) Cloudflare (strictly necessary, no consent required)

Our hosting provider Cloudflare (see section 9) may set the cookie __cf_bm for bot and abuse detection (lifetime approx. 30 minutes). This cookie contains no personal profile and is exempt from consent under § 25(2) no. 2 TDDDG, because it is strictly necessary to securely provide the service you explicitly requested.

b) Microsoft Clarity (consent required)

After your explicit consent (see section 10b) Microsoft Clarity may set the following cookies:

If you withdraw your consent, these cookies are actively removed from your browser and Microsoft Clarity is no longer loaded.

c) localStorage (stored locally in your browser)

We store two values in your browser's localStorage:

• Language preference (key om_lang, value en or de)
• Cookie consent (key om_analytics_consent, a JSON object with value, timestamp and the version number of the privacy policy)

This information never leaves your device and is not sent to our servers. You can clear localStorage at any time in your browser settings.

Part C: applies to the app, the dashboard and the website

12. Your rights (Art. 15 to 21 GDPR)

You have the right to:

• access the data stored about you (Art. 15 GDPR);
• rectification of inaccurate data (Art. 16 GDPR);
• erasure (“right to be forgotten”, Art. 17 GDPR);
• restriction of processing (Art. 18 GDPR);
• data portability (Art. 20 GDPR);
• object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR);
• withdraw consent you have given, with effect for the future (Art. 7(3) GDPR).

An informal message to support@open-match.com is enough. You can also delete your account yourself in the app at any time; instructions are at open-match.com/delete-account.

Right to lodge a complaint (Art. 13(2)(d), Art. 77 GDPR)

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

A list of all German supervisory authorities is published by the Federal Commissioner for Data Protection.

13. Data security

We use technical and organisational measures to protect your data against accidental or deliberate manipulation, loss, destruction or access by unauthorised persons:

• Encrypted transport (TLS/HTTPS) for all connections between the app, the dashboard, the website and our servers
• Passwords are stored only as a salted hash (bcrypt), never in plain text
• Card details are held exclusively by Stripe; openmatch stores no card numbers
• Access restrictions, rate limiting and error monitoring
• No disclosure to third parties beyond the recipients named in sections 4 and 8 to 10

14. Notification of data breaches (Art. 33, 34 GDPR)

In the event of a personal data breach we notify the competent supervisory authority without undue delay and, where feasible, within 72 hours (Art. 33 GDPR). Where the breach is likely to result in a high risk to your rights and freedoms, we also notify you without undue delay (Art. 34 GDPR).

15. Automated decision-making

There is no decision-making based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR. Suggestions in the app (such as suitable Open Matches) and skill ratings are convenience features with no legal effect on you. On the website Microsoft Clarity produces aggregated behavioural analyses (heatmaps, session recordings) to improve the site, but makes no decisions with legal effect concerning you.

16. Dispute resolution

No reference to the former EU platform for online dispute resolution (ODR platform) is required: the European Commission discontinued that platform on 20 July 2025. We are neither obliged nor willing to take part in dispute resolution proceedings before a consumer arbitration board (§ 36 VSBG).

17. Changes to this privacy policy

We update this policy when the legal situation or our service changes. We inform you of material changes in the app or by email 30 days before they take effect. The current German version is always available at open-match.com/datenschutz, the English version at open-match.com/en/privacy.

Last updated: 15 October 2026 (version 2.3). Version 1.4 (July 2026) covered the website only; from version 2.0 this policy also covers the openmatch app and the venue dashboard. In case of doubt the German text prevails.

---

Cookie settings · Impressum · Support · Deutsch · Home