Privacy Policy

Version: 1.4.0  ·  Effective date: 4 August 2026

LoL Sensei ("we", "us", "our") is operated by Adriano Di Pietro, Viale Europa, Anzio (RM), 00042, Italy. This policy explains what personal data we collect through the website lolsensei.com and the LoL Sensei desktop application, why we process it, and the rights you have under the EU General Data Protection Regulation (GDPR).

Contact: privacy@lolsensei.com.

1. What we collect

We never collect: IP addresses in clear text, real-time in-game data, payment card numbers (handled by our payment providers: Paddle and, for legacy licenses, Stripe), or biometric data.

2. How we use your data

• Provide and secure the LoL Sensei software (authentication, entitlement checks).
• Process and invoice Pro licenses via Paddle, our merchant of record and reseller of the software license for all new purchases (Stripe remains the processor for legacy licenses and historical billing records).
• Measure traffic with privacy-preserving analytics (only if you consent).
• Improve AI coaching quality through aggregate, non-identifying usage counters.
• Comply with legal obligations (consent record-keeping, tax records, fraud prevention).

We do not sell your data, share it with advertising networks, or use it to build behavioural profiles.

2.1 Riot account info shown to admin for support

When you link your Riot account, we cache a copy of your Riot ID (gameName#tagLine) on our servers and we tag each AI coaching session with the Riot match identifier of the game it belongs to. This allows our platform admins (a small allowlist of staff) to (a) identify you for support tickets when your display name alone is not enough, and (b) review AI cost per match for forensics and quality assurance. The legal basis is our legitimate interest (Art. 6(1)(f)): your Riot ID is already public to every other player in the lobby/leaderboard, and the match identifier is an opaque code already exposed by public stat-tracking websites — caching them on our side does not create any new public exposure of your identity.

What this means in practice:

• We never expose your Riot ID to other users through this feature; it is only visible to platform admins and to you.
• Your Riot ID is wiped (set to NULL) the moment you delete your account, in the same database transaction as the rest of the deletion. The match identifier is kept (it is not personal data on its own — it just labels a game) so we can preserve cost forensics for already-deleted accounts.
• A copy of these fields is included in your data export (see Section 5, Access and portability).

3. Data sharing

Riot Games is not a data processor of LoL Sensei: it is the upstream source we read your Riot ID and match metadata from when you ask us to. We do not send your LoL Sensei data to Riot.

3.1 AI providers

Three providers run the models behind our AI features today: Anthropic, Google and DeepSeek. Which one handles a given request depends on the feature and on our routing configuration, which can change without a new release of the app.

Alibaba Cloud (Qwen models) will be joining them. We have decided to adopt it, but as of this policy's effective date it is not yet enabled in production: no request is routed to it today. We name it here in advance so you know upfront which providers the service may draw on, instead of finding out when it goes live. The table above marks which providers are already live and which are planned, and we update it whenever that list changes, including when a provider moves from planned to live.

What we send them is the game context needed to produce the answer: champion, role, items, match timeline data and, for the coach, the question you typed. Payment data never reaches these providers.

Transfer Impact Assessments (TIA) for each non-EU processor are available on request.

4. Retention

5. Your rights (GDPR Art. 15-22)

You can exercise any of the following rights at any time:

• Access and portability — download a JSON copy of your account, licenses, consent history, Riot account snapshot and AI sessions list (with match identifiers) from Settings → Privacy & Data → Export my data.
• Erasure — delete your account from Settings → Privacy & Data → Delete my account. Consent history and aggregate audit logs are retained as required by law.
• Rectification — update profile data via Google account or by contacting us.
• Withdraw consent — at any time via Cookie preferences in the footer. Withdrawal does not affect the lawfulness of prior processing.
• Object / restrict processing — email privacy@lolsensei.com.
• Lodge a complaint — with your national Data Protection Authority (in Italy: Garante per la Protezione dei Dati Personali, garanteprivacy.it).

We respond within 30 days (Art. 12(3)).

6. Children (GDPR Art. 8)

LoL Sensei is not directed at children under 13. During onboarding you must confirm that you are at least 16 years old or that, if you are between 13 and 15, your parent or legal guardian has reviewed and agreed to our Terms of Service on your behalf and authorised the processing described in this policy (GDPR Art. 8). If we learn we collected data from a child under 13, or from a minor without the required parental authorisation, we will delete it promptly.

7. Security

• TLS everywhere (HSTS preload).
• Passwords: we never handle them (Google OAuth only).
• Database encryption at rest.
• Strict Content-Security-Policy; static-analysis of dependencies at build time.
• Incident response runbook with 72-hour breach notification (Art. 33).
• Admin access to your Riot ID and per-match AI logs is rate-limited and recorded in an append-only audit log.

8. Changes to this policy

We version this policy using Semantic Versioning. A MAJOR bump (e.g. 1.x.x → 2.x.x) represents a material change and triggers a re-consent prompt. MINOR / PATCH changes are informative.

Changelog

• 1.4.0 — 2026-08-04 — Added Alibaba Cloud (Qwen models) to the list of AI providers, flagged as a planned provider not yet enabled in production, carrying the same open point already flagged for DeepSeek: China is not covered by an EU adequacy decision and the Art. 46 GDPR transfer tool still has to be put in place by the controller. Section 3.1 updated accordingly. The processing actually in place is unchanged, since no data reaches this provider today; this is a disclosure update, no re-consent required.
• 1.3.0 — 2026-08-04 — Completed the list of AI providers: Google (Gemini) and DeepSeek are now named alongside Anthropic, each with the transfer tool that applies to it, including the open point on DeepSeek (third country with no adequacy decision, Art. 46 tool under assessment). Added Section 3.1 on how requests are routed between the three providers. The processing itself is unchanged; this is a disclosure update, no re-consent required.
• 1.2.0 — 2026-06-09 — Updated processors (DigitalOcean replaces Railway/Neon; Paddle added as merchant of record for all new purchases, with Stripe retained for legacy subscriptions); added controller postal address; aligned the minimum-age wording with the Terms of Service (Section 6). Informational change, no re-consent required.
• 1.1.0 — 2026-05-02 — Added Riot account snapshot for admin support and per-match AI audit (Section 2.1, 4, 5). Additive change, no re-consent required.
• 1.0.0 — 2026-04-22 — Initial WP24 release: cookie consent banner, DSR endpoints (export + delete), age gate, updated processor list.