Challenge Privacy Notice

1. Information we collect

• Identity and access: email address, internal user and enrollment identifiers, single-use access-link status, session status, login/resend records, and account-security events.
• Payment and refund records: checkout name and billing/postal address, amount, currency, Stripe Checkout/payment references, payment status, purchase time, the accepted Terms and Privacy Notice versions, an immutable purchase-contract copy and integrity hashes, duplicate/replay evidence, refund claim, refund status, and dispute status. Stripe receives the card data; RaidReady does not store the full card number or card security code.
• Challenge activity: selected platform mode, quest progress and completion, reports, schedules, saved outputs, submitted links, review flags, support/admin actions, and the final 5+ result and refund receipt.
• Connected Twitch data: Twitch identity, authorized scopes, protected OAuth credentials, public channel/profile data, schedule and VOD references, stream start/end and duration, observed peak concurrent viewers, and EventSub/polling evidence needed to verify progress. Kick/manual mode instead uses the information and links you submit.
• AI tool data: prompt inputs, generated or fallback outputs, saved Challenge artifacts, usage/quota records, and sanitized provider-failure status. Do not enter secrets or sensitive personal information that the requested tool does not need.
• Technical and attribution data: IP address, user agent, request and error logs, security/rate-limit signals, referring page, UTM attribution, cookie preferences, and consented analytics events.

2. Why we use it

• create Checkout and reconcile a confirmed payment;
• grant one entitlement and enrollment, deliver and recover access, and maintain your Challenge session;
• create, retain, and securely provide your purchase contract as it existed when the payment completed;
• personalize quests, perform requested Twitch actions, generate AI tools, save progress, and provide manual-mode alternatives;
• observe eligible streams, settle the 5+ result, review missing or conflicting evidence, and process a refund claim;
• send required transactional messages, provide support, prevent fraud and abuse, diagnose failures, and maintain an audit trail; and
• meet accounting, tax, consumer-protection, privacy, and lawful request obligations.

Purchasing the Challenge does not by itself opt you into unrelated marketing. Marketing messages require the consent or other lawful basis identified where the address is collected and include an unsubscribe mechanism.

3. Services that process Challenge data

• Stripe — Checkout, payment, refund, and dispute processing.
• Supabase — internal account, purchase contract, entitlement, enrollment, progress, audit, and operational records.
• Brevo — transactional access, progress, support, and refund email transport. Buyer name, billing/postal address, and purchase contract text are not inserted into the access email.
• Twitch — connected identity, channel data, OAuth actions, VOD/schedule information, and stream observations requested by Twitch-mode participants.
• Anthropic — the prompt context needed to generate in-product Challenge tools when the AI service is available.
• Hosting, security, and consented analytics providers — infrastructure requests, operational logs, and the analytics events you allow through cookie settings.

RaidReady does not sell personal information. We disclose it only for the purposes above, with your direction, to investigate a security or fraud issue, or where law requires or permits it.

4. Access links, sessions, and cookies

Challenge access links are single-use and time-limited. Verification copies of their token material are hashed; restricted email-delivery records temporarily contain the private access URL so RaidReady can send or retry the message, and are access-controlled and retained only for operational delivery and audit needs. A signed first-party session cookie keeps you signed in. Essential security, session, and consent-preference storage cannot be disabled where the service cannot work without it. Analytics storage is used only after the applicable consent and can be changed through Cookie settings.

After sign-in, the private purchase-contract portal uses the signed session and the exact internal user and purchase identifiers to return only contracts belonging to that user. A contract URL contains only an opaque purchase identifier. Contract access does not depend on Challenge feature flags, current entitlement state, or later refund status.

5. Transactional email

RaidReady and Brevo use your purchase email to deliver the access link you requested, resend it, notify you about relevant Challenge progress or operational issues, and communicate about a refund or dispute. Delivery jobs and provider status are recorded so a queued message is not falsely treated as delivered. The access email links back to RaidReady and does not include buyer name, billing/postal address, or the retained legal copy. Do not forward private action links.

6. Retention

• Single-use access credentials expire after their stated period and are invalidated when claimed or replaced; limited audit evidence is retained to prevent replay and resolve access issues.
• Challenge enrollment, progress, result, refund, and support data is retained while needed to deliver the product, preserve your access, resolve disputes, prevent abuse, and maintain the promised refund record.
• Purchase, refund, invoice, and related accounting records are retained for the legally required period, generally at least six years from the end of the relevant Canadian tax year.
• The buyer identity/address and immutable purchase-contract copy are retained with restricted access for the applicable accounting, consumer-protection, transaction, refund, and dispute record period.
• Provider events, security logs, failed-job evidence, and analytics are kept only for their documented operational, security, fraud-prevention, or consented analytics purpose, then deleted or de-identified when no longer required.

7. International processing

Some providers may process information outside Quebec or Canada, including in the United States or European Union. Privacy laws in those locations may differ. RaidReady remains responsible for its handling of the information and uses provider and contractual safeguards appropriate to the service and applicable law.

8. Your choices and rights

Subject to applicable exceptions, you may ask what personal information RaidReady holds about you, how it is used or disclosed, request access or correction, withdraw consent for consent-based use, object to direct marketing, or request deletion. A deletion request may not remove purchase, refund, fraud, security, or other records that must be retained by law or are still needed to resolve a transaction or claim.

Send requests to the Privacy Officer at support@raidready.app. We may verify your identity before disclosing or changing account information.

9. Security and incidents

RaidReady uses measures appropriate to the information, including TLS, signed sessions, hashed verification copies of one-time credentials, encrypted Twitch OAuth custody, restricted operational access, forced row-level security on new Challenge tables, webhook signatures, audit records, and provider-access controls. No online service is risk-free. If a privacy incident creates a risk of serious harm, RaidReady will take reasonable mitigation steps and provide notices required by applicable law.

10. Age requirement

The Challenge is for people age 18 and older. RaidReady does not knowingly sell the Challenge to a minor. Contact the Privacy Officer if you believe a minor supplied information.

11. Complaints, changes, and contact

Questions or complaints can be sent to the Privacy Officer at support@raidready.app. If the response does not resolve your concern, you may contact the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada.

We will update the date above when this notice changes and will provide appropriate notice before a material change applies to existing participants.