Privacy Notice

1. Data controller

The controller of your personal data is Julián Gálvez, an individual, who operates the platform under the trade name "Vyora" ("Vyora", "we"), domiciled at Toronja No. 1, Sm 2-A, C.P. 77500, Cancún, Quintana Roo, Mexico. You can reach us at privacidad@vyora.app with any question or request about your data.

2. Data we collect

We collect different categories of data depending on your account type and how you use the Platform:

• Identification and contact data: name, username, email address.
• Sports profile data: date of birth, sex, sport, position, performance stats, videos and photos you upload.
• Authentication data: password (stored encrypted, never in plain text), or, if you sign in with Google or Facebook, the basic information that provider shares with us (name, email, profile picture, unique account identifier).
• Minor and guardian data: if you are 16 or 17, we collect your guardian's name and email, and keep evidence of their authorization before your account is fully enabled.
• Professional verification data: if you register as a scout or institution, any documents you upload to validate your identity/affiliation.
• Technical data: IP address, device/browser type, language and session cookies, and usage logs used to prevent fraud and abuse (e.g. login attempt limits).
• Content you generate: posts, comments, messages, reactions, and any other content you share on the Platform.

3. What we use your data for

We use your personal data for the following purposes:

• Creating and managing your account, and validating your invite code (Vyora currently runs an invite-only closed beta).
• Verifying you meet the Platform's minimum age (16) and, if you are 16 or 17, processing your guardian's consent.
• Displaying your profile to other Platform users (e.g. scouts, if you're a talent user) and calculating your rating, XP and badges.
• Enabling messaging, notifications, and social features (following, commenting, challenges).
• Preventing fraud, impersonation, and abuse of the verification system.
• Sending you transactional communications necessary for the service: account confirmation, password changes, approval/status updates, guardian notifications if you are a minor.
• With your additional consent: sending you product updates or news, which you can opt out of at any time.
• Improving the Platform through aggregated, anonymized usage analysis.

4. Minors

Vyora has a minimum age of 16 — it is not directed at children under 16, and we do not knowingly allow registration by anyone below that age.

For users aged 16-17, the account is created but stays in a limited state until a parent or guardian gives verifiable consent by email. We only collect the data strictly necessary from guardians to manage that consent (name and email).

We do not use a minor's profile data to show them behaviorally-targeted advertising beyond what is strictly necessary to operate the Platform.

5. Who we share your data with

We do not sell your personal data. We share it only with providers that help us operate the Platform, under confidentiality obligations, and only to the extent needed for the service they provide:

• Supabase — database and account authentication.
• Cloudinary — storage and processing of videos you upload.
• Resend — transactional email delivery (confirmations, guardian notifications).
• Vercel — web application hosting.
• Sentry — technical error monitoring, so we can fix issues.
• Upstash — rate limiting to prevent automated attacks.
• Google and Meta (Facebook) — only if you choose "Continue with Google" or "Continue with Facebook" to sign in; in that case those providers handle your authentication under their own privacy policies.
• YouTube and TikTok — only if you connect those accounts to automatically sync your sports content.
• HaveIBeenPwned — we check whether your password appears in known breaches before accepting it; only an encrypted fragment of the password (k-anonymity) is sent, never your actual password.

6. International data transfers

Most providers listed above process data on servers outside your country (primarily in the United States), under their own security standards and, where applicable, data protection contractual clauses. By using the Platform, you agree to this transfer, necessary for the service to function.

7. How long we keep your data

We keep your data while your account is active. If you delete your account, we retain certain information for as long as needed to comply with legal obligations or resolve disputes, and until the database's automatic backup cycle expires (weekly backups, with a maximum of 14 kept at a time).

8. Your rights

You can exercise your rights to access, rectify, delete, or object to the processing of your personal data at any time, as well as withdraw any consent you have given (e.g. for marketing communications).

From Settings → Your data you can download a copy of your personal data (Access) and delete your account (Cancellation) without anyone's intervention. On deletion, your profile, sent messages, stories and other data are erased; your posts and comments are kept without your name, attributed to "Deleted user". For any other right (or if you prefer email), write to the contact address in this notice with your username and the right you wish to exercise. We will respond within a reasonable time under applicable law.

If you are the guardian of a minor with an account on the Platform, you may exercise these same rights on the minor's behalf.

9. Cookies

We use technical cookies necessary for the service to work: a preferred-language cookie, a session cookie to keep you signed in, and a short-lived (10-minute) cookie that preserves your registration data while you sign in with Google or Facebook. We do not use third-party advertising tracking cookies.

10. Security

We apply reasonable technical measures to protect your data: encryption in transit, passwords never stored in plain text, database-level access policies that prevent one user from reading another's data without authorization, and checks against known password breaches. No system is 100% infallible, but we actively work to keep these protections current.

11. Changes to this notice

We may update this notice as the Platform evolves. We will publish any material change on this same page along with its update date.

12. Contact

For any questions about this notice or your personal data, email us at privacidad@vyora.app.