Privacy Policy

Last updated: 30 May 2026 · Effective: 30 May 2026

This Privacy Policy describes how iGG SuperApp ("we", "us", "our") collects, uses, and protects your information when you use our platform at iggesports.com. We process personal data in compliance with the Personal Data Protection Act 2010 (Malaysia) and, where applicable, the Personal Data Protection Act 2012 (Singapore).

1. Information We Collect

Account information: name, email address, profile picture, and the unique identifier provided by your chosen sign-in provider (Google, Facebook, or TikTok).
Tournament & activity data: tournaments and series you join, registrations, match results, scores, leaderboard standings, and transactions.
Age & eligibility data: date of birth (for age-restricted leagues such as JEL), parental / guardian contact details (for participants under 18).
Technical data: IP address, browser user-agent, device type, and basic usage logs retained for security and reliability.
Storage data: we use localStorage for session continuity and offline-friendly demo modes. We do not set tracking cookies for advertising.

2. How We Use Your Information

Authenticate your account and provide access to the platform.
Process tournament registrations, payments, and related transactions.
Calculate match results, rankings, and cumulative leaderboard points.
Communicate with you about your account, tournaments, and service updates.
Detect, investigate, and prevent fraud, cheating, and abuse.
Improve and secure the platform.

3. PDPA Principles — How We Comply (Malaysia)

The Malaysian PDPA 2010 sets out seven principles. We address each as follows:

(a) General Principle — Lawful Purpose

We collect personal data only for the specific purposes set out above (account management, tournament operations, communication). We do not process data beyond these lawful purposes.

(b) Notice and Choice

This Privacy Policy serves as the notice required under Section 7 of the PDPA. By signing up you confirm you have read this policy. A consent checkbox is presented at signup; consent is recorded in our system with a timestamp.

(c) Disclosure

We disclose personal data only to the parties listed in Section 4 ("Third Parties") and to authorities when required by law. We do not sell your personal data.

(d) Security

We protect data through HTTPS-only transport, role-level access controls in Supabase, signed JWT session tokens, and SOC 2-aligned infrastructure providers (Supabase, Vercel).

(e) Retention

Account and activity data are retained for as long as your account is active. Tournament records are retained for 7 years for prize-disbursement and audit purposes. You may request deletion at any time (see Section 6).

(f) Data Integrity

You may correct your personal data through the in-app Profile settings or by emailing us. We act on correction requests within 30 days.

(g) Access

You may submit a Data Subject Access Request by emailing ahnafthaqeef@gmail.com with the subject line "DSAR". We respond within 21 days as required by PDPA.

4. Third Parties Named (Disclosure)

We share data only with these named providers to operate the platform:

Provider	Purpose	Region
Supabase	Authentication, database, file storage	Singapore (ap-southeast-1)
Vercel	Web hosting + CDN	Singapore (sin1) edge
Google	OAuth sign-in (your choice)	Global
Facebook (Meta)	OAuth sign-in (your choice)	Global
TikTok	OAuth sign-in (your choice)	Global

5. Singapore PDPA — Do Not Call

If you reside in Singapore, you may opt out of marketing calls or SMS by emailing the address in Section 8. We respect Do Not Call (DNC) Registry preferences for Singapore numbers.

6. Your Rights

Access: request a copy of your personal data (DSAR — see Principle (g) above).
Correction: update incorrect data via in-app Profile or email.
Deletion: request account deletion; we delete within 30 days subject to legal retention requirements (e.g. tax / audit).
Withdraw consent: you may withdraw consent at any time by emailing us — note this may prevent further use of the platform.
Revoke OAuth: revoke third-party sign-in access through that provider's settings.

7. Children's Privacy & Junior League

The iGG Junior Esports League (JEL) is open to participants aged 13–17. We require parental / guardian consent at registration for any user under 18. We do not knowingly collect data from children under 13 outside the JEL parental-consent flow.

8. Contact

For all privacy enquiries, DSARs, deletion requests, or DNC opt-out, contact: ahnafthaqeef@gmail.com

9. Changes to This Policy

We may update this Privacy Policy. Material changes will be announced in-app at least 14 days before they take effect. The "Last updated" date at the top reflects the most recent revision.