Privacy Policy — Max The Cap

1. Who We Are

Max the Cap ("Max the Cap," "we," "our," or "us") operates a web platform for players, venues, organizers, and related business accounts.

Controller contact details:

Legal entity name: MAX THE CAP LLC
Mailing address: 3036 E Lanark St Ste A, Meridian, Idaho 83642
Privacy email: [email protected]
Privacy Officer / Responsable de la protection des renseignements personnels: Privacy Officer, [email protected]

2. Scope and Relationship to Other Policies

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you:

create or use an account,
use our website, applications, and APIs,
participate in messaging, events, listings, reviews, referrals, support, or moderation workflows,
receive communications from us.

Use of the Service is also governed by:

Terms of Service, and
Community Guidelines.

3. Definitions

"Personal Information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to an individual.
"Sensitive Personal Information" means data categories that receive heightened legal protection in some jurisdictions (for example precise geolocation, date of birth, account credentials, identity-verification documents, and certain financial data).
"Processing" means collecting, using, storing, disclosing, deleting, or otherwise handling personal information.

4. Information We Collect

A. Information you provide directly

Account, registration, and security data: email, password hash, date of birth, age-confirmation statements, account type, nickname, full name, share code, timezone, optional phone number, verification state, and security settings.
Profile and discovery data: avatar, bio, city/state/postal code/country, verified or normalized location details, game preferences, format preferences, travel and lifestyle preferences, sponsors, social handles, and privacy settings.
Stats and performance data: self-reported stats, imported or claimed stats, match/performance facts, ranking inputs, and related preferences or correction requests.
Social and messaging data: connection requests, external invites, DM requests, message content, read/archive state, inbox actions, and block actions including reasons or notes you choose to provide.
Business and organization data: operating name, business category, contact details, website, address, description, logos or photos, ownership attestations, and verification workflow fields or uploaded documents.
Content contributions and community data: venue, event, league, and dartboard submissions; ownership claims; reviews and votes; roadmap or feature-request submissions; support tickets; reports; appeals; responses; uploaded evidence; and other user-generated content you submit through the Service.
Referral and invite data: invitee email address, invitation status, unsubscribe or suppression data, attribution metadata, and referral reward or abuse-review information.
Privacy-rights and compliance data: deletion requests, access or correction requests, export/erasure workflows, identity-verification materials, and related support records.

B. Information collected automatically

Log and device data: timestamps, IP address, user agent, browser/device metadata, request metadata, session activity, and token metadata.
Usage and activity data: account actions, profile updates, search/discovery interactions, inbox/message events, referral activity, billing events, moderation actions, and other feature-usage events.
Security and integrity data: authentication activity, failed login events, abuse-prevention signals, overlap detection, fraud indicators, audit logs, and similar trust-and-safety records.
Presence and delivery data: online state, last-seen metadata, unread/read status, and delivery metadata for inbox, database, email, or similar communications we send.

C. Information we create or infer

Recommendation, compatibility, ranking, and profile-completeness signals generated from your activity, preferences, stats, and settings.
Risk, fraud, abuse, spam, safety, moderation, and enforcement signals or scores created to protect the Service and its users.
Product, operational, commercial, and analytics insights derived from personal information or user-generated content, including aggregated, de-identified, benchmarked, or statistical outputs.

D. Information from third parties

Payment and subscription providers (for example Stripe): customer/subscription identifiers, billing status, dispute or payment-failure metadata, and limited payment display metadata.
Business verification and onboarding providers (for example Stripe Connect and similar providers we enable): onboarding status, payout or verification status, and related metadata.
Geolocation/address services (for example Google Places, Google Geocoding, or Google Time Zone): normalized address data, place identifiers, mapping metadata, coordinates, and time zone data.
Content moderation, safety, and infrastructure vendors (for example OpenAI or similar services we enable): screening outcomes and related metadata for submitted text, images, or other content.
Communications or infrastructure providers (for example email, realtime, hosting, logging, customer-support, or security vendors we enable): delivery outcomes, message metadata, and operational records relevant to the services they provide.
Ingestion partners: partner-supplied event, stats, source, or listing records according to integration contracts or ingestion workflows.

E. Sensitive Personal Information we may process

Depending on the features you use and applicable law, we may process the following categories of sensitive personal information:

Date of birth (age-gate and safety/compliance only).
Account credentials and authentication/security metadata, including two-factor authentication data where enabled.
Precise geolocation and related verified location data where you provide or enable it.
Business or identity verification documents and related review outcomes when submitted in onboarding, support, compliance, or dispute workflows.
Limited payment-related metadata from processors.
Potentially sensitive support, moderation, appeal, safety, or legal evidence that you or others submit in high-risk cases.

User-generated content you choose to submit may also contain sensitive personal information, and we may process that information in connection with the feature, workflow, or request for which it was submitted.

We do not store full payment card numbers or CVV.

5. Sources of Information

We collect personal information from:

you directly,
your device/browser/app activity,
service providers and integrations,
other users when they interact with your account/content,
automated integrity/safety systems and moderation workflows.

6. How We Use Personal Information

We process personal information to:

provide and operate the Service,
authenticate users and secure accounts,
run discovery, compatibility, and recommendation features,
provide messaging, inbox, notifications, and support,
process subscriptions, billing, and referral rewards,
verify business accounts and enforce account-status rules,
review and publish user-generated content, listings, reviews, submissions, votes, and public roadmap content,
detect/prevent fraud, abuse, spam, and policy violations,
investigate reports and conduct moderation/enforcement,
fulfill data rights requests and legal obligations,
monitor and improve reliability, safety, and product quality, and
support business operations, research, analytics, marketing, partnerships, commercialization, and revenue generation related to the Service, subject to applicable law.

Subject to applicable law, your settings, and the rights granted in our Terms, we may combine personal information and user-generated content across product areas to personalize experiences, develop new features, train, test, and improve ranking, moderation, fraud, safety, support, and other internal systems, and support lawful business development and monetization of the Service.

We may use public-facing content, business-submitted content, de-identified data, aggregated data, benchmark data, and derived insights for analytics, operations, research, reporting, marketing, partner reporting, licensing discussions, sponsorship/ad products, and other lawful commercial purposes. We do not treat this paragraph as permission to use personal information in ways prohibited by law.

7. Legal Bases (Where Required)

If your jurisdiction requires a legal basis for processing, we rely on one or more of:

performance of a contract,
legitimate interests (safety, security, abuse prevention, service reliability),
compliance with legal obligations,
consent (for optional channels/features where required),
vital interests/public-interest grounds where applicable.

For users in Canada, including Quebec, we seek consent where required by applicable law and aim to present key privacy information in a clear and accessible manner. Depending on the sensitivity of the information and the context, consent may be express or implied where permitted by law. You may withdraw consent to certain processing, subject to legal, contractual, fraud-prevention, security, and service-operability limitations.

8. Cookies, Local Storage, and Similar Technologies

We may use cookies, local storage, and similar technologies for:

authentication/session continuity,
security and fraud prevention,
feature reliability and preference storage,
basic product/operational analytics.

Where legally required, we obtain consent for non-essential technologies.

Do-Not-Track note: browser "Do Not Track" signals are not uniformly supported across standards and do not, by themselves, trigger rights under all privacy laws. Where required by law, we honor legally recognized opt-out preference signals, such as Global Privacy Control, for applicable sale, sharing, or targeted advertising choices.

9. How We Share Personal Information

We may disclose personal information to:

vendors/processors performing services for us,
other users according to feature and privacy settings,
organizers/business operators for event and operational workflows,
affiliates and strategic partners involved in operating, improving, measuring, marketing, or monetizing the Service, subject to applicable law and appropriate contractual restrictions,
advisors, auditors, and professional service providers,
courts/regulators/law-enforcement where required,
transaction counterparties in merger/acquisition/reorganization contexts.

We require service providers to process information under contractual restrictions appropriate to their role.

Some information is shared or displayed by design when you use public or shared features, such as player profiles, venue/event/league listings, dartboard submissions, reviews, roadmap items, business pages, or other community content. Depending on the feature and your settings, this content may be visible to other users, businesses, partners, or the public and may be indexed, copied, cached, quoted, screenshot, or reshared by others.

Real names on player accounts. A player's real name is visible only to that player and to their accepted friends and partners unless the player chooses to show it. If you turn on Show my real name to signed-in users (in Settings → Privacy, from Edit privacy on your own profile, or when we ask you in the app), any signed-in user, including business accounts, can see your real name wherever the app names you, such as your profile, posts, reviews, messages, rankings, search results, and notifications, and other players who also show their real name can search for you by it. Only players who show their own real name can search other players by real name; any player can find their accepted friends and partners by real name. Signed-out visitors, search engines, and emails we send on your behalf do not show your real name, and anyone in a block with you sees only your nickname. You can turn this off at any time; other users then see your nickname, although we cannot recall information they have already seen.

Subject to applicable law, your settings, and the rights granted in our Terms, we may display, distribute, feature, analyze, and promote public-facing or business-submitted content across the Service and related communications, analytics, partner materials, or other commercial contexts connected to the Service.

10. Sale/Sharing for Advertising and Other Commercial Uses

As of the Effective Date of this Policy:

we do not sell personal information for monetary consideration, and
we do not knowingly share personal information for cross-context behavioral advertising, and
we may use and commercialize de-identified, aggregated, benchmarked, or otherwise non-personal information, content analytics, and business insights for lawful business purposes.

If we engage in activities involving personal information that applicable law treats as a sale, sharing, or targeted advertising, we will update this Policy and provide any required notices, consent mechanisms, and opt-out rights.

11. Communications and Notification Preferences

We send:

service and security communications,
safety/moderation and legal/compliance communications,
support and account-administration communications,
optional marketing/promotional communications where enabled.

Channel rules:

inbox notifications may be always-on for core/safety categories,
users can configure eligible channel/category preferences,
email marketing or similar optional communications include legally required unsubscribe/opt-out controls where applicable,
if we enable SMS, push, or similar channels, those channels may require separate opt-in, device registration, phone verification, or consent flows where required by law, and
service, security, safety, billing, and similar operational messages may remain non-optional where permitted by law.

12. Automated Signals, Profiling, and Decision Support

We use automated systems and rules to support:

recommendation ranking and eligibility gating,
risk scoring and abuse detection,
anti-manipulation controls (for example referral/review integrity),
moderation triage prioritization.

These systems support operational decisions. High-impact enforcement actions follow policy controls and human-reviewed workflows as defined by platform governance.

13. Data Retention

We retain personal information only as long as necessary for legitimate business, safety, legal, and compliance needs. Retention varies by data category and may be extended by legal hold.

Current operational windows and examples include:

Account, profile, and organization records: generally for the life of the account and a reasonable period afterward, including any deletion grace period, dispute window, or compliance hold.
Messaging, DM request, and inbox records: generally up to 365 days under current settings, although some requests or ephemeral states expire sooner.
Presence and similar operational metadata: generally from seconds to about 30 days depending on the function.
Support, feature-request, referral, claim, moderation, enforcement, appeal, audit, and anti-abuse records: as long as reasonably needed for safety, fraud prevention, dispute handling, legal defense, and compliance, which may in some cases be multi-year.
Uploaded files, imports, exports, and verification materials: short-lived or workflow-based periods where feasible, then deletion, archival, or restricted retention according to legal, security, or compliance needs.
Financial and billing records: retained per legal, tax, accounting, and contractual obligations (commonly multi-year).

If information is subject to legal hold, active dispute, or investigation, deletion may be delayed.

14. Account Deletion, De-Identification, and Residual Records

When account deletion is requested, we may apply a grace period before permanent deletion.

After permanent deletion, subject to legal exceptions:

core personal identifiers are purged,
authored content may be retained with de-identified attribution (for example [Deleted User]),
audit/moderation/compliance records may retain de-identified references,
records required for fraud prevention, legal defense, and financial compliance may be retained for required periods.

15. Your Privacy Rights

Depending on your jurisdiction, you may have rights to:

access/know what data we process,
correct inaccurate data,
request deletion,
portability/export of applicable data,
object to or restrict certain processing,
withdraw consent where consent is the basis,
appeal denial of a privacy request where required by law.

To submit a request, contact [email protected] or use in-product support/privacy workflows.

We may verify identity and authority before fulfilling requests.

Where required by law, we acknowledge and respond within statutory timelines. If additional time is permitted and needed, we will provide extension notice with the reason.

16. U.S. State Privacy Notices

Residents of certain U.S. states may have statutory rights relating to access, correction, deletion, portability, and opt-out choices, subject to applicable exceptions and verification requirements.

A. Request channels

Privacy email: [email protected]
Webform: https://maxthecap.com/support/tickets
Authorized agent requests: require legally sufficient authorization and identity verification.

B. Non-discrimination

We do not discriminate against users for exercising applicable privacy rights.

C. California Residents

If you are a California resident, you may have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, subject to applicable exceptions and limitations.

Your California rights

California residents may have the right to:

know the categories and specific pieces of personal information we have collected about them,
know the categories of sources from which personal information is collected, the business or commercial purposes for collecting, using, disclosing, selling, or sharing it, and the categories of third parties to whom it is disclosed,
request deletion of personal information we collected from them,
request correction of inaccurate personal information we maintain about them,
request portability of certain personal information,
opt out of the sale or sharing of personal information,
limit certain uses or disclosures of sensitive personal information where applicable, and
not receive discriminatory treatment for exercising applicable privacy rights.

Categories of personal information collected in the preceding 12 months

During the preceding 12 months, we may have collected the following categories of personal information, depending on how you use the Service:

identifiers and account information,
profile information and user-generated content,
commercial or billing information,
internet or other electronic network activity information,
geolocation and address information,
communications, support, moderation, risk, and compliance data,
inferences drawn from the information above, and
sensitive personal information, where applicable.

Sources of personal information

We collect personal information from the following categories of sources:

directly from you,
automatically from your device, browser, or app activity,
service providers, integrations, and platform infrastructure vendors,
payment, verification, communications, and location-related vendors,
other users when they interact with your account or content, and
automated integrity, safety, and moderation systems.

Business and commercial purposes

We collect, use, disclose, and otherwise process personal information for the business and commercial purposes described in this Policy, including to:

provide, operate, maintain, and improve the Service,
authenticate users and secure accounts,
support discovery, recommendations, messaging, notifications, support, and public or shared community features,
process subscriptions, billing, and referrals,
verify business accounts and enforce account-status rules,
detect, prevent, and investigate fraud, abuse, spam, cheating, and policy violations,
investigate reports and conduct moderation and enforcement,
develop analytics, insights, research, measurement, and lawful monetization or commercialization activities related to the Service,
comply with legal obligations and respond to lawful requests, and
protect our rights and the rights, safety, and security of users and others.

Disclosure of personal information for business purposes

During the preceding 12 months, we may have disclosed the following categories of personal information for business purposes to service providers, contractors, business partners, professional advisors, regulators, or other third parties as described in this Policy:

identifiers and account information,
profile information and user-generated content,
commercial or billing information,
internet or other electronic network activity information,
geolocation and address information,
communications, support, moderation, risk, and compliance data,
inferences, and
sensitive personal information, where necessary for permitted purposes.

Sale or sharing of personal information

As of the Effective Date of this Policy, we do not sell personal information for monetary consideration and we do not knowingly share personal information for cross-context behavioral advertising. We may, however, use or commercialize de-identified, aggregated, benchmarked, or otherwise non-personal information and related insights for lawful business purposes. If our practices change in a way that applicable law treats as a sale or sharing of personal information, we will update this Policy and provide any required notices and opt-out rights.

Sensitive personal information

We do not use or disclose sensitive personal information for purposes other than those reasonably necessary and proportionate to provide the requested services or as otherwise permitted by applicable law, unless we provide any additional notice and rights required by law.

How California residents can exercise rights

California residents may submit requests through the channels listed above. We may need to verify identity before processing certain requests. Authorized agents may submit requests on behalf of California residents where permitted by law.

Where legally required, we will process applicable opt-out preference signals, such as Global Privacy Control, for requests to opt out of sale or sharing.

D. Nevada Residents

Nevada residents may have the right to direct a business not to sell certain covered information under Nevada law. Nevada privacy requests may be submitted to [email protected] with "Nevada Privacy Request" in the subject line.

17. Additional Information for Residents of Canada and Quebec

If you are located in Canada, including Quebec, this section provides additional information about our privacy practices.

A. Privacy Officer and Contact Information

Our Privacy Officer / Responsable de la protection des renseignements personnels is the primary point of contact for privacy questions, complaints, and requests:

Privacy Officer: [email protected]
Mailing address: 3036 E Lanark St Ste A, Meridian, Idaho 83642

B. Consent and Your Choices

Where Canadian law applies, we seek consent for the collection, use, and disclosure of personal information except where otherwise permitted or required by law. We aim to present privacy information in a form that is reasonably understandable and accessible. Depending on the sensitivity of the information and the context, consent may be express or implied where permitted by law.

You may withdraw consent to certain processing, subject to legal or contractual restrictions and reasonable notice, by contacting us or using available in-product controls. Withdrawal of consent may limit our ability to provide parts of the Service that depend on that information.

Showing your real name to other signed-in users is off by default. You consent to it only by turning on Show my real name to signed-in users or by answering yes when we ask in the app, and you can withdraw that consent at any time with the same setting, which takes effect immediately.

C. Access, Correction, and Other Rights

Subject to applicable law and verification, residents of Canada may request access to personal information we hold about them and request correction of inaccurate or incomplete information. You may also ask questions about how your personal information has been used or disclosed and challenge our compliance with applicable privacy law by contacting our Privacy Officer.

If you are a resident of Quebec, you may also have additional rights under applicable law, including the right to withdraw consent, the right to request rectification, and, where applicable and technically feasible, the right to request computerized personal information collected from you in a structured, commonly used technological format or to request its transmission to another person or organization as permitted by law.

D. Information for Quebec Residents at Collection

If you are in Quebec, we intend for this Privacy Policy and any relevant in-product or just-in-time notices to provide the information required at or before collection, including:

the purposes for which we collect personal information,
the means by which we collect it,
your rights of access and rectification,
your right to withdraw consent to certain uses or disclosures,
the names of third parties or categories of third parties to whom it is necessary to disclose personal information to provide the Service or operate our business, and
the possibility that personal information may be communicated outside Quebec.

E. Cross-Border Processing for Canadian and Quebec Users

We are based in the United States, and personal information may be stored, processed, or accessed in the United States and other jurisdictions where we or our service providers operate. Those jurisdictions may have privacy laws that differ from the laws of your province or territory and may permit access by courts, regulators, or law-enforcement authorities under applicable law.

Where required by applicable law, we use contractual and other safeguards designed to protect personal information transferred across borders. If we communicate personal information outside Quebec where Quebec law applies, we will implement measures required by applicable law, which may include assessing whether the information will receive adequate protection and entering into written agreements with relevant service providers or partners.

F. Breach and Confidentiality Incident Information

If a breach or security incident involving personal information occurs, we will take steps required by applicable law. Where Canadian federal law applies, this may include reporting certain breaches creating a real risk of significant harm to the Office of the Privacy Commissioner of Canada, notifying affected individuals, and maintaining breach records as required by law.

Where Quebec law applies, this may include taking reasonable steps to reduce the risk of harm and prevent similar incidents, notifying the Commission d'accès à l'information du Québec and affected individuals with diligence if an incident presents a risk of serious injury, and maintaining an incident register as required by law.

G. Complaints

If you are in Canada and have a concern about our handling of personal information, we encourage you to contact us first at [email protected] so we can try to address it. Depending on your location and the nature of your concern, you may also have the right to contact the Office of the Privacy Commissioner of Canada or a competent provincial privacy regulator, including the Commission d'accès à l'information du Québec.

18. International Transfers

MVP operations are U.S.-focused. Personal information may be processed in the United States and, where relevant, in other jurisdictions where our service providers or partners operate. If we process personal information across borders, we apply transfer safeguards required by applicable law.

For users in Canada, including Quebec, please see Section 17 for additional information about cross-border processing and transfers outside Quebec.

19. Security

We use technical and organizational safeguards designed to reduce risk, including:

access controls and least-privilege practices,
encryption in transit and encryption at rest where appropriate,
secure storage and segregation of sensitive workflows,
abuse/fraud monitoring and incident response controls,
role-based access restrictions for moderation/compliance data.

No system is perfectly secure, but we work continuously to improve security posture.

If a security incident affects personal information, we will investigate, contain, and respond in accordance with applicable law. Where legally required, we will provide notices to affected individuals and regulators within applicable timelines. For additional information relevant to Canada and Quebec, including breach and confidentiality-incident practices, see Section 17.

20. Children's Privacy

The Service is intended for adults 18+ and is not directed to children under 18.

If we learn that under-18 data was improperly submitted, we will take appropriate remedial action, including account restrictions and removal steps consistent with legal obligations.

For age-gate failures at registration, our intended behavior is to reject account creation and avoid persistence of under-18 registration data.

Contact: [email protected]

21. Third-Party Services

Third-party integrations are governed by their own terms and privacy policies. We are not responsible for third-party data practices outside our control.

22. Changes to This Policy

We may update this Policy periodically. For material changes, we provide notice as required by law (for example in-app notice, email, and/or updated effective date).

23. Contact Us

Privacy Officer / Responsable de la protection des renseignements personnels: Privacy Officer, [email protected]
Privacy email: [email protected]
Mailing address: 3036 E Lanark St Ste A, Meridian, Idaho 83642