Privacy Policy – LCS Fantasy

Introduction

Welcome to LCS Fantasy, a free esports fantasy game operated by Fracassi Tech. Protecting your privacy and personal data is very important to us. This Privacy Policy describes how we collect, use, store, and share your information when using the LCS Fantasy platform, in accordance with Brazil’s General Data Protection Law (LGPD – Law No. 13.709/2018) and industry best practices.

By using LCS Fantasy (available at ltafantasy.com), you agree to the terms of this Privacy Policy. We recommend reading this document carefully. If you have any questions, you can contact us at pedro@fracassi.tech.

Personal Data Collected

We only collect personal data strictly necessary to identify you as a user and link your LCS Fantasy account to your Riot account (used for authentication). This data includes:

• • Riot Account Data: When you log in via Riot Sign On (RSO), we receive certain information from Riot Games, such as your Summoner Name (your public in-game username) and an encrypted player identifier provided via Riot’s APIs. Important: We do not receive your Riot account password, email, or any sensitive credentials — authentication is handled directly by Riot Games’ servers, which return only the aforementioned data to us.
• • Session Token: After login, our system generates a unique encrypted session token for LCS Fantasy. This token is stored in your browser (e.g., in a functional cookie) and in our systems, to keep you securely authenticated and identify your session while using the platform.
• • Gameplay Data: We collect information about your interactions within LCS Fantasy, such as your player/team selections, scores, and performance in fantasy competitions. This game data is linked to your user identifier in LCS Fantasy (associated with your Riot account) to support game functionality, such as score calculation and leaderboard displays.
• • Browsing Data (Cookies): When you access our web pages, we may automatically collect some technical browsing data through cookies and similar technologies (as detailed in the "Cookies and Similar Technologies" section below). This may include IP address, browser type, accessed pages, and access date/time. This data is mainly collected to ensure platform functionality, ensure security, and eventually for aggregated site usage analysis.

Data Not Collected: We do not collect sensitive personal data (as defined by the LGPD, such as racial or ethnic origin, religious beliefs, health data, biometric data, etc.) nor excessive or unnecessary information for the purposes of LCS Fantasy. For example, we do not ask for your real name, CPF (tax ID), address, phone number, or financial information. In addition, we do not have access to your Riot account credentials (such as password or email) nor to any other personal data maintained by Riot Games beyond the specific information listed above.

Purposes of Data Processing

We use the data collected exclusively for the following purposes, related to the operation of LCS Fantasy and the provision of the service to you:

• • Authentication and platform access: Using your Riot account data (Summoner Name and identifier) to confirm your identity and allow secure login to LCS Fantasy. The session token is used to keep you logged in and manage your user session while browsing the site.
• • Linking to Riot account and game features: Associating your LCS Fantasy profile with your Riot account, enabling the import of necessary information (e.g., your Summoner Name) and ensuring that each user has a single registration linked to a real player. This allows the fantasy game to accurately reflect your performance tied to your player profile.
• • Game operation and score calculation: Using your game data (such as your team/player selections and earned points) to calculate results, generate leaderboards, display your scores, and provide all other expected features of a fantasy esports game.
• • Platform improvement and support: Analyzing platform usage in an aggregated and anonymized manner (e.g., number of users, most visited pages) to understand site performance, fix issues, optimize features, and enhance the user experience. We may eventually use traffic analytics services for this purpose (see “Cookies” section below), always aiming to improve LCS Fantasy.
• • Security and fraud prevention: Ensuring the security of the system and your account, guaranteeing that only you access your account (through the secure session token) and preventing misuse. We may also use technical data (such as IP logs and session identifiers) to monitor and detect suspicious activity, prevent fraud in the game, or protect our infrastructure.
• • Compliance with legal obligations: Using or retaining data when necessary to comply with legal or regulatory obligations or respond to requests from competent authorities (e.g., retaining access logs as required by the Brazilian Internet Civil Rights Framework or providing information pursuant to a court order).

Important: Personal data collected is not used for advertising or commercial purposes unrelated to the platform. This means we do not use your information to send ads, nor do we sell or share it with third parties for marketing purposes outside the context of LCS Fantasy. All processing of personal data is solely intended to enable your access and use of the fantasy game and improve the platform, as described above.

Legal Basis for Data Processing

The LGPD establishes several legal bases that authorize the processing of personal data. In LCS Fantasy, we primarily rely on the following legal grounds (as per Article 7 of the LGPD):

• • Performance of contract and preliminary procedures (Art. 7, V): The processing of your data is necessary for the provision of the LCS Fantasy service, understood as a relationship akin to a free service contract between us and you as a user. In other words, we use your data to allow your access and use of the fantasy game as expected — e.g., to authenticate you, maintain your account, and calculate your scores. Without this data, we would not be able to provide a functional platform.
• • User consent (Art. 7, I): For any data processing that does not fall under the above bases or is not strictly necessary for the functioning of the service, we may request your consent. For example, we may ask for your consent to use analytics cookies on public-facing pages. You can withdraw your consent at any time, as detailed in the “Data Subject Rights” section below.
• • Legitimate interest (Art. 7, IX): In some cases, we may process data based on our legitimate interest, provided that it does not override your fundamental rights and freedoms. This may include technical improvements to the platform, information security, fraud prevention, or basic usage metrics to evaluate the website's performance. In such cases, we ensure that processing is minimally invasive and proportionate, and you have the right to object if applicable.
• • Compliance with legal obligations (Art. 7, II): When storage or provision of certain data is required to fulfill legal or regulatory obligations. For example, Brazilian law (Marco Civil da Internet – Law 12.965/2014) requires that internet applications retain certain access records for a defined period; if applicable to LCS Fantasy, we will comply accordingly.

Data Storage and Retention

We process and store collected data in secure cloud computing environments operated by trusted third-party providers. These providers may have servers located outside Brazil. Therefore, your data may be transferred to and stored in data centers abroad (e.g., in the United States or other locations where our providers operate). In such cases, we ensure that these international transfers are conducted in accordance with the LGPD and applicable regulations, using appropriate safeguards (such as contracts or certification mechanisms that ensure an adequate level of data protection).

Retention period: Personal data collected by LCS Fantasy is stored for the minimum time necessary to fulfill the purposes for which it was collected. In general, we retain your data while you actively use the platform and for up to one (1) year after your last use or the end of the collection period. This one-year period may be necessary to preserve recent game history, allow your return to the platform without immediate data loss, and meet legal or dispute-resolution needs. After this period, we may proceed with the deletion, anonymization, or secure archiving of your personal data, as applicable.

If you request deletion of your data (see “Data Subject Rights”), your data will be removed from our systems within a reasonable timeframe, subject to any legal retention obligations. Note that some residual data may remain in backup systems for a limited time, but it will be purged in accordance with our backup cycles. We may also retain anonymized data (which no longer identifies you) for a longer period, exclusively for statistical or platform improvement purposes.

Data Sharing with Third Parties

We treat your data confidentially and do not sell or share personal data with third parties for purposes unrelated to those described in this policy. Data sharing involving LCS Fantasy users only occurs in the following situations and with appropriate safeguards:

• • Service providers (data processors): We may share strictly necessary data with third-party service providers contracted to support the operation of LCS Fantasy. This includes, for example, cloud hosting and infrastructure providers (such as Fly.io and PlanetScale, as mentioned above), content delivery and security services (e.g., Cloudflare, which acts as a security proxy and may process IP addresses and requests to protect our site), and potentially analytics tools (e.g., Google Analytics, if used for traffic analysis). These vendors process data on our behalf, according to our instructions, for specific purposes like technical support, storage, or analytics, and are subject to data security and confidentiality obligations. In other words, they are not authorized to use your data for their own purposes.
• • Riot Games (authentication and APIs): We use Riot Games' authentication technology for login (Riot Sign On) and consult Riot’s official APIs to obtain necessary game information (such as your Summoner Name and public game data). In these cases, there is controlled data sharing between you, Riot, and LCS Fantasy:
  • • When you choose to log into LCS Fantasy with your Riot account, you are redirected to Riot Games’ servers for authentication. In this process, Riot verifies your credentials and, with your authorization, provides us with your Riot account data listed under “Personal Data Collected” (Summoner Name and encrypted identifier). Riot Games does not receive any new personal data from us during this process; it acts primarily as a provider of login technology and source of your Riot account data.
  • • It is important to clarify that in the context of LCS Fantasy, Riot Games is not a data controller of the personal data we process. Fracassi Tech is the data controller for LCS Fantasy and is responsible for determining how user data is processed under this Policy. Riot Games remains the controller of your Riot account data and handles authentication processing in accordance with its own policies. To understand how Riot Games collects and processes your data when you use your Riot account (e.g., during RSO login or general use of Riot services), please refer to Riot’s Privacy Policy available on their official website.
• • Legal requirements and rights protection: We may disclose your personal data to comply with legal obligations, respond to court orders, requests from competent government authorities, or other legal duties. We may also share information if necessary to enforce our legal rights or defend ourselves in case of disputes, as well as to protect the rights, property, or safety of Fracassi Tech, our users, or third parties. For example, in the case of fraud investigations, hacking attempts, or any situation requiring data sharing to prevent harm, we may do so as permitted by law.
• • Corporate transfers: If Fracassi Tech undergoes a corporate restructuring, such as a merger, acquisition, incorporation, or sale of assets related to LCS Fantasy, user data may be transferred to the new responsible entities, under the same privacy obligations outlined in this Policy. In such cases, you will be notified of the change in data controller, and this Policy may be updated accordingly.

Regarding any data sharing, we emphasize that none of your personal data is shared with third parties for marketing or advertising purposes outside the scope of LCS Fantasy. We also do not publicly disclose personally identifiable user data. Any public displays of performance within the game (e.g., top rankings) are done using only Summoner Names or other public in-game data — never private personal information.

Data Security

Fracassi Tech implements technical and organizational security measures to protect your personal data from loss, misuse, unauthorized access, leaks, alteration, or destruction. These include:

• • Encrypted communications: All communication between your browser and LCS Fantasy is protected via encryption (HTTPS/TLS), which prevents third parties from intercepting transmitted data (such as your session token). Additionally, internal communication between our cloud services is encrypted (e.g., we use secure tunnels between infrastructure components).
• • Secure storage: Personal data collected (such as user identifiers and tokens) is stored in encrypted format or in a way that only our systems can interpret. As mentioned earlier, we store encrypted player identifiers provided by Riot — we do not have access to the decryption keys, and these identifiers cannot be reversed into readable personal information without proper authorization.
• • Access control: Access to personal data within Fracassi Tech is restricted to authorized personnel directly involved in the operation and development of LCS Fantasy, and only when necessary to perform their duties. Our employees and any service providers are subject to contractual confidentiality obligations and trained in security and privacy best practices.
• • Monitoring and prevention: We monitor our systems to prevent, detect, and mitigate potential vulnerabilities, suspicious activity, or unauthorized access. We maintain updated software and follow security recommendations from the tech sector and Riot Games (note that our infrastructure has previously passed Riot’s security assessments for other esports projects).
• • Incident response plans: We have procedures in place to respond to security incidents or data breaches, including measures to contain the incident, assess impacts, and notify users and authorities as required by the LGPD and applicable laws.

Despite our best efforts, no data transmission method over the internet or electronic storage system is 100% secure. Therefore, while we strive to protect your information, we cannot guarantee absolute security. In the event of a security incident compromising your personal data, you will be notified in accordance with legal requirements, and we will take all appropriate measures to minimize any harm.

Data Subject Rights

As a user and data subject, you have several rights under the LGPD regarding your personal data. We value these rights and provide ways for you to exercise them simply and free of charge. Your rights include:

• • Confirmation and access: Request confirmation whether we process your personal data and access to that data, including a copy of the information we hold about you.
• • Correction: Request correction of incomplete, inaccurate, or outdated data. For example, if your Summoner Name is incorrect or changes (e.g., due to a change in your Riot account), we commit to updating our records accordingly once we are notified or detect the change via API.
• • Anonymization, blocking, or deletion: Request that we anonymize, block, or delete unnecessary, excessive, or unlawfully processed data. In practice, we collect only what is necessary. If you believe any of your data is unnecessary or misused, you can request its removal or anonymization.
• • Deletion of data processed with consent: You can request the deletion of personal data collected based on your consent. For instance, if we ever ask for your consent to collect analytics data, you may revoke that consent and request removal of the related data. Note: In some cases, we may retain certain data due to legal obligations even after a deletion request, but we will inform you if this applies.
• • Data portability: Request a report of your personal data in a structured and interoperable format so that it can be transferred to another service provider, subject to commercial and industrial confidentiality. In the context of LCS Fantasy, this may include your scores and participation history linked to your identifier.
• • Information on data sharing: Request details about public or private entities with which we share your data. This Policy already outlines this information (e.g., vendors like Riot Games, hosting services), but we can provide further clarification upon request.
• • Information on the option to not give consent: Be informed that you are not required to provide consent in certain situations and understand the consequences. For example, you are not required to allow analytics cookies to use LCS Fantasy — declining them may affect usage metrics but will not limit access to core features.
• • Revocation of consent: Withdraw your consent at any time, easily and freely, by clearly expressing your decision. If in the future we collect data based on your consent (e.g., analytics or optional integrations), you may revoke that consent by contacting us or through automated settings (e.g., cookie preferences).
• • Objection (Right to object): If we process your data based on legitimate interest, you may object if you believe it violates your fundamental rights. We will assess your request and, if appropriate, cease the processing in question.
• • Review of automated decisions: While we currently do not conduct automated decision-making that significantly affects users (e.g., profiling beyond the game context), you have the right to request human review if such decisions are introduced in the future.
• • Complaint to the ANPD: You may file a complaint with Brazil’s National Data Protection Authority (ANPD) if you believe we have not adequately responded to your requests or are violating the LGPD. We encourage you to contact us first so we can try to resolve any issues, but your right to appeal to the authority remains protected.

To exercise any of these rights, contact us at pedro@fracassi.tech. For security, we may take steps to verify your identity before fulfilling requests for access or modification of data, to prevent fraud. We will aim to respond to all requests promptly and within legal timeframes (generally up to 15 days under the LGPD).

Cookies and Similar Technologies

Cookies are small text files stored on your device (computer, mobile phone, etc.) when you visit a website. LCS Fantasy uses cookies and similar technologies mainly to ensure

the platform functions properly and to improve your user experience. Below is how we use them:

• • Strictly necessary cookies: Essential for LCS Fantasy to operate. For example, when logging in via Riot, we use a cookie (or equivalent storage) to store your encrypted session token and keep you authenticated as you navigate the site. Without this, you would need to log in again on every page. These cookies do not collect unnecessary information and cannot be disabled via our site settings.
• • Functional cookies: We may use additional cookies or local storage to remember preferences and optimize the experience. For example, if LCS Fantasy allows you to choose a language or UI theme, a functional cookie may store that preference.
• • Performance/analytics cookies: We may eventually use analytics tools (e.g., Google Analytics) on public-facing pages (like the homepage) to better understand traffic and site usage. These tools may place cookies that collect browsing info such as visited pages, time spent, access origin, device type, etc. These cookies would only be used for statistical and improvement purposes — not to identify users or for advertising. If used, we will inform you and request your consent where required. You will have the option to opt out.
• • Third-party cookies: While using LCS Fantasy, you may receive cookies from third-party services involved in the platform’s operation. For example, when redirected to Riot Games' authentication domain, Riot may apply its own cookies according to its policy. Similarly, if analytics services are used, those tools may also place cookies. We reiterate that we do not use third-party cookies for marketing purposes in LCS Fantasy.
• • Local storage and similar technologies: In addition to cookies, we may use similar technologies like localStorage or sessionStorage in your browser to temporarily store necessary information (e.g., UI preferences or cached content). These follow the same principles and are not used to track you outside the scope of LCS Fantasy.

Managing cookies: You can configure your web browser at any time to refuse some or all cookies or to alert you when a cookie is being sent. Check your browser’s help section for instructions. However, note that if you block or delete essential LCS Fantasy cookies (like the session token), you may be unable to use the service or lose saved preferences. For analytics cookies (if and when used), we will provide clear opt-out mechanisms (e.g., a cookie banner).

Riot Games Authentication and Third-Party Links

Our website may contain links or integrate with third-party services, especially Riot Games’ authentication system. Here’s how we handle them:

• • Riot Login (Riot Sign On): As previously described, LCS Fantasy uses Riot account authentication. When you click “Login with Riot” or a similar function, you are directed to Riot’s environment to securely enter your credentials. This process is subject to Riot’s Terms of Service and Privacy Policy — we recommend reviewing them on Riot’s official website. After successful login, Riot provides us with basic necessary data (Summoner Name and encrypted identifier). We do not receive sensitive information from your Riot account.
• • Riot Games APIs: LCS Fantasy interacts with Riot’s public APIs (e.g., to retrieve match statistics or pro player information). These API calls are made by our servers directly to Riot’s servers. We may send Riot your player identifier or other query parameters to fetch this data. These exchanges are limited to gameplay purposes and follow Riot’s developer guidelines.
• • External links: LCS Fantasy may contain links to partner websites or related information (e.g., official league sites, social media). When you follow these links, this Privacy Policy no longer applies, and your browsing is subject to the third party’s policies. We recommend reviewing the privacy policies of any sites you visit before submitting any personal information.

In summary, with respect to Riot Games: they assist by providing login infrastructure and game data, but Fracassi Tech is responsible for data within LCS Fantasy. Riot does not determine how we process data internally and does not use it for their own purposes in this context. Any data you provide directly to Riot (like login credentials) is governed by Riot’s terms, and any data we collect after login is governed by this Policy.

Changes to This Privacy Policy

This Privacy Policy may be updated. As we continue to improve LCS Fantasy and potentially add new features or services, we may adjust our privacy rules to reflect new data practices or comply with new legal requirements.

Whenever we make material changes to this Policy, we will post the revised version on our site with the updated date at the top. If the changes are significant, we may also inform you via available communication channels (e.g., a notice on the site or email, if we have your contact information).

We recommend revisiting this page periodically to stay informed about how we are protecting your data. Continued use of LCS Fantasy after a new Privacy Policy is published constitutes acknowledgment and acceptance of the changes. If you do not agree with the updated terms, you should stop using the platform and may request data deletion as described above.

Contact Us

If you have any questions, comments, or requests related to this Privacy Policy or your data usage on LCS Fantasy, please feel free to contact us:

• • Data Protection Officer (DPO): For matters involving personal data, contact our data protection officer at pedro@fracassi.tech. This is the dedicated channel to exercise your LGPD rights or clarify any questions.
• • General contact: If preferred, you may contact Fracassi Tech through other available means on the site (e.g., a contact form, if provided). For privacy matters, we recommend using the email above for the most efficient response.
• • Response time: We strive to respond to requests as quickly as possible. Generally, you will receive a reply within a few business days. For formal data-related requests (e.g., access or deletion), we will respond within legal timeframes (usually up to 15 days as per the LGPD). We are here to help and hope you enjoy our platform with peace of mind, knowing your data is protected.

Last updated: April 28, 2025 (Version 1.0)