XPULZ Privacy Policy

Effective date: 6 October 2026

In short

• Who we are. XPULZ Gaming GmbH, a Swiss company, runs xpulz.com. Privacy questions: info@xpulz.com.
• What we collect. Your account details (email, username, country), the game accounts you link and the match statistics that come with them, your tournament activity, and technical data such as your IP address.
• Why. To run your account, show your statistics, run the tournaments you enter and keep the platform safe.
• Who sees it. Your profile and your tournament results are public. A tournament organizer sees what it needs to run its tournament. The companies that host and operate XPULZ handle data on our behalf.
• Marketing is always your choice. Entering a tournament never signs you up for anyone's marketing. That takes a separate box, unticked by default, that names the company.
• AI. Our coaching features send game statistics to OpenAI, never your email address or your real name.
• Where. Our servers are in Switzerland. Some of our providers work in the United States or the EU.
• How long. While your account exists. Tournament results stay in the public archive; if you delete your account, your name is removed from it.
• Under 18. You must be at least 13. We never share a minor's data for marketing.
• Your rights. You can get a copy of your data, correct it, delete it or object to a use: write to info@xpulz.com. You can also complain to your data protection authority.
• Cookies. Audience measurement runs only if you accept it. No advertising trackers. See the Cookie Policy.

1 Who we are and what this policy covers

XPULZ Gaming GmbH is a Swiss company. We run the XPULZ platform: player accounts, game statistics and tournaments.

Address: Fällandenstrasse 3c, 8124 Maur, Switzerland
Company number: CHE-166.807.703
Privacy contact: info@xpulz.com

This policy applies when you use xpulz.com, an XPULZ app, a tournament page, or a tournament platform we run under another brand's name and that links here. "Personal data" means anything that can be linked to you, including a player ID and the game statistics attached to it.

Three roles come up below:

• An Organizer runs a tournament on XPULZ. It can be a company, an association, a school, an academy or XPULZ itself.
• On a platform run under a brand's name, the Brand Customer is the company the platform is run for, and the Tournament Operator is the company that runs its tournaments. They can be the same company.

The page where you sign up or enter a tournament names these companies and says what each one does with your data. It also says whether signing up creates an account for that platform only, links your existing XPULZ account, or creates an XPULZ account too. We never enroll you in a second service without telling you.

Game publishers and social networks handle your data on their own platforms under their own privacy policies.

2 Who is responsible for your data

The tournament page gives the responsible company's legal name, country and contact details. Running or paying for a branded platform does not by itself make a company responsible for your data, and does not give it access to it.

Not sure who to write to? Write to us. We answer for our part and pass the rest to the right company.

3 What we collect and where it comes from

We only require what a feature needs. Required fields are marked where you fill them in, with the reason; without them that feature cannot work. Everything else is optional.

A match involves other players. We therefore hold the gamer tags and identifiers of the people you played with or against, and their match records include yours. When we get your data from a publisher, an Organizer or a teammate rather than from you, we tell you the source and the kind of data, as the law requires. A public profile elsewhere is not a permission for us to reuse it freely.

Linked accounts

Once a game account is linked, we fetch your match history and statistics from the publisher's official API (for example Riot Games, PUBG, Steam) and refresh them regularly while the link is active.

Organizers can link their own Twitch, X, Discord, YouTube and Google Calendar accounts to publish tournament announcements. Those links concern the Organizer's accounts, not players'.

4 Why we use your data

The right-hand column is the legal basis under the EU and UK GDPR, where those laws apply. Section 13 covers other countries.

When we rely on a legitimate interest, we weigh it against your rights, with extra care for minors, and you can object (section 12).

5 What Organizers, brands and other users see

When you enter a tournament

Before you enter, the tournament page tells you:

• who the Organizer is and how to reach it;
• what data it receives, why, and which of its staff or providers can see it;
• what is shown publicly;
• which countries are involved and how transfers are protected;
• how long the data is kept and how to use your rights.

An Organizer normally receives your gamer tag, game account ID, team, eligibility status and results. It receives your email address, real name or prize details only when the tournament needs them, for example to pay out a prize, or when you agree separately. If a message through the platform or a simple "eligible: yes" is enough, we do not hand over your contact details or your proof.

No Organizer, Brand Customer or Tournament Operator gets the XPULZ user database. Each one sees only the data agreed for its tournaments, for the agreed purpose and period. Sponsors receive audience figures that identify no one, unless you were told otherwise beforehand and, where the law requires it, agreed.

Marketing by an Organizer or a brand

Entering a tournament, accepting the Terms, linking an account or accepting cookies never signs you up for marketing by anyone.

When a platform offers marketing from a brand or an Organizer, it is a separate box, unticked by default. It names the company, what it receives, what it will send you and how, the country where it handles your data, its privacy notice and how to withdraw. It also says whether that company collects your details itself or receives them from XPULZ. Saying no changes nothing to your account or your place in the tournament. Where no such box is offered, no participant data is passed on for marketing.

Agreeing to emails does not let that company receive your game statistics, build advertising audiences or combine your profiles across tournaments. Using your statistics to personalize marketing is a second, separate choice.

We do not share data for marketing, or allow advertising based on a profile, for users we know are under 18.

Public profiles and results

Your gamer tag, avatar, team, rank and tournament results are public. Your email address and other contact details never appear on a profile or a leaderboard. Your settings control which optional details and linked accounts are shown. A tournament that publishes its results says so before you enter.

Public pages can be copied or indexed by search engines. We act on removal requests for what we control, but we cannot recall copies made by others. Extra limits apply to minors (section 7).

6 Linked accounts, AI and automated decisions

Linking and unlinking

You choose which accounts to link. Some features need a specific link: Valorant statistics need your Riot account. We use the access only for what the link screen describes, and within the provider's rules.

You can unlink an account at any time in your settings, and also revoke the access on the provider's side. We then stop collecting through that link and drop our access. Data still needed for something this policy describes, such as an open tournament dispute, is kept as section 10 says.

AI coaching

Our AI provider is OpenAI, through its API. It powers:

• the Valorant coach: match briefings and duo reports built from your match statistics;
• the XPULZ AI assistant, a chat that answers questions about your games and tournaments;
• for Organizers, suggested tournament descriptions and social posts generated from the settings they enter.

We send only what the feature needs. Your email address, real name and Riot ID are not sent. Game statistics travel with an opaque player identifier, which is still personal data. OpenAI processes these requests in the United States (section 9). OpenAI does not use data sent through its API to train its models unless we opt in, and we have not. It keeps the data up to 30 days for abuse monitoring.

What you should know:

• An AI result is an automated evaluation of your play. It can be wrong or incomplete, and it promises no result. It is not medical or mental-health advice.
• Each AI feature says, before you use it, what it analyzes, who can see the result and whether it runs on request or automatically.
• Your coaching reports are yours. An Organizer or a brand cannot see them unless that is disclosed to you beforehand.
• Using AI coaching is never treated as agreeing to marketing or advertising profiling.
• We do not use your identifiable inputs or results to train AI models, or to infer anything about your health. If that ever changed, we would tell you first and ask for your permission where the law requires it.

Automated decisions

Coaching is advice. It never decides who is eligible, who is sanctioned, who wins or who gets a prize. Tournament scoring follows the published rules.

If an automated system ever makes a decision that has a legal or similarly significant effect on you, we tell you so. You can then give your view, contest the decision and ask for a human to review it: info@xpulz.com.

7 Under 18

You must be at least 13 to have an XPULZ account. Children under 13 cannot have one. A higher minimum applies where your country's law, a game, a linked service, a feature or a tournament requires it. The age at which you can consent to the use of your data, or enter a contract on your own, also depends on your country: being 13 does not make every use of your data allowed.

Where the law requires a parent's or guardian's permission, the account or the feature stays locked until we have verified it. A school's or an Organizer's approval does not replace it.

For accounts we know belong to under-18s:

• no advertising based on a profile and no sharing of data for marketing;
• limited public visibility, location use and profiling;
• information written for their age.

Parents, guardians and young users can write to info@xpulz.com about an account, a permission, or to access, correct or delete data. We check who is asking, in a proportionate way, and take the young person's own rights into account. If we find data collected without a required permission, we stop using it and either obtain the permission or delete it.

8 Other recipients

Besides Organizers (section 5), your data can go to:

• the providers that host and operate XPULZ, listed in section 9. They are bound by contract on what they may do with the data, on confidentiality, security, retention and their own subcontractors;
• the game or social service you link, when the link involves sending it information;
• payment providers, which also act on their own account against fraud and for their legal duties;
• our advisers and insurers, and courts or authorities, where necessary and lawful;
• a buyer or successor of our business, under the same protections, and with notice to you where required.

9 Where your data is processed

The platform, its databases, files and backups are hosted in Switzerland, in Oracle Cloud's Zurich region. The providers below may process data elsewhere, and an Organizer based abroad may access tournament data from its own country.

When data leaves Switzerland, the EEA or the UK for a country without an equivalent level of protection, we rely on a recognized adequacy decision, on standard contractual clauses (with their Swiss and UK adaptations) or, for the United States, on the Data Privacy Framework when the recipient is certified, or on another safeguard or exception the law provides. Where the law requires it, we assess the transfer and add protections, and we stop a transfer whose conditions cannot be met. Other countries' transfer rules are in section 13. Accepting this policy is not a consent to transfers.

You can ask us which safeguard covers your data and for a copy of it (we may redact confidential parts): info@xpulz.com.

Unless stated otherwise, these providers work on our instructions, as processors.

10 How long we keep your data

We keep data while it is needed for the purpose it was collected for, then delete it or make it truly anonymous.

An exception to these periods covers only the records it needs, with restricted access. We do not keep a whole account because a legal claim is theoretically possible. Where your country's law requires deletion as soon as the purpose ends, that rule wins.

An Organizer that is responsible for its own use of your data has its own retention periods, which it must tell you. Deleting your XPULZ account does not erase what an Organizer must lawfully keep.

11 Security

We protect your data with measures suited to the risks: restricted access, confidentiality duties, encryption in transit and at rest where appropriate, and procedures to handle vulnerabilities and incidents. No service can promise absolute security. If a breach affects your data, we assess it, act on it and notify the authorities and you where the law requires.

Report a hacked account or a privacy incident to info@xpulz.com. Never send us a password or card details.

12 Your rights

You can manage your account, linked accounts, marketing subscriptions and cookie choices in your settings. For anything else, write to info@xpulz.com and tell us which account or tournament it is about. We ask only for what we need to confirm it is you.

Depending on your country, you have the right to:

• know what we do with your data and get a copy of it;
• have it corrected or deleted;
• have its use restricted, or object to a use;
• receive it in a portable format;
• withdraw a consent at any time, which does not affect what was done before;
• object to direct marketing, and to the profiling that goes with it, at any time and without giving a reason;
• contest certain automated decisions (section 6).

We answer without undue delay, and at the latest within the time your law sets: one month under the GDPR, 30 days in Switzerland. If the law allows more time, we tell you why. It is free unless the law allows a fee, and if we refuse we explain why. We pass on corrections, deletions and withdrawals to the companies that received the data, where the law requires it.

You can complain to us, and at any time to a data protection authority, without waiting for our answer: the Swiss FDPIC, the authority of your EEA country, the UK ICO, or the authority listed for your country in section 13.

13 Your country

These rules apply when that country's law governs the use of your data, which depends mainly on where you live, not on your nationality. Where a local rule protects you more than this policy, the local rule wins.

14 Changes and contact

We update this policy when our services or the law change, and publish the new version with its date. If a change matters for your data, we tell you before the new use starts and ask for your consent where the law requires it. A new version never authorizes after the fact something you were not told about.

Questions, requests and complaints: info@xpulz.com, or by post to the address in section 1.

See also the Cookie Policy and the Terms of Service. Accepting the Terms is not a consent to marketing or to optional tracking.