Notice on the processing of personal data
Under Articles 13 and 14 of EU Regulation 2016/679 (GDPR). Last updated: 17 May 2026.
This translation is provided for convenience: the Italian text is the binding one.
1. Data controller
The data controller is Soloweb S.R.L., with registered office at Via Enrico Mattei 24, 28100 Novara (NO), Italy. VAT number and tax code 02927680344, registered with the Novara Companies Register under REA no. NO-247568, share capital €10,000.00 fully paid.
Contact email: info@soloweb.io · Certified email (PEC): pec@soloweb.io · Phone: +39 331 42 06 495.
For requests about the Rankly product specifically: support@rankly.it.
We have not appointed a Data Protection Officer (DPO) under Art. 37 GDPR, as the processing we carry out is not among the kinds that require one. For any privacy request, just write to the addresses above.
2. Personal data processed
Rankly collects and processes the following categories of personal data:
2.1 Data collected automatically via OAuth (Google/Discord)
When you sign up or sign in with Google or Discord, we receive from the provider: display name, email address, the provider’s unique identifier, the URL of your profile picture. We don’t receive passwords or any other data from the provider. We never post anything on your Google or Discord profile.
2.2 Data provided by the user
The chosen username (unique on the platform), the organisation’s name, the organisation’s public slug, data of the tournaments created (tournament names, participants, match results). Data of participants added manually by the organiser (name, email if any, role in the event) is processed on the organiser’s behalf for purposes the organiser defines.
2.3 Payment data
Payment data (card, IBAN, billing details) never passes through our servers: payment is handled entirely by Stripe Payments Europe Ltd., which acts as an independent controller for its part (see the Stripe privacy policy). From Stripe we only receive: Stripe customer identifier, subscription status (trial/active/expired), renewal date, payment status (succeeded/failed). No PAN or CVV.
2.4 Technical browsing data
IP address (used for security and anti-abuse purposes, kept in server logs for at most 30 days), browser user-agent, request timestamps. We don’t use Google Analytics, Facebook Pixel, Hotjar or other third-party advertising trackers. We don’t profile users.
3. Purposes and legal bases of processing
| Purpose | Legal basis | Retention |
|---|---|---|
| Providing the service (account, tournaments, ranking) | Performance of a contract (Art. 6.1.b GDPR) | Duration of the relationship + 90 days after deletion |
| Billing and tax obligations | Legal obligation (Art. 6.1.c GDPR) | 10 years (Italian tax law) |
| Security, anti-abuse, server logs | Legitimate interest (Art. 6.1.f GDPR) | 30 days |
| Transactional emails (registration confirmation, trial expiry reminder, failed payment notice) | Performance of a contract (Art. 6.1.b GDPR) | Duration of the relationship |
We don’t send marketing emails. If in future we decide to send commercial communications (newsletters, product news) we will update this notice and ask for separate explicit consent.
4. Sub-processors (providers that process data on our behalf)
To provide the service we rely on technical providers that may process personal data as Data Processors (Art. 28 GDPR):
| Provider | Service | Data location |
|---|---|---|
| Vercel Inc. | Frontend hosting (Next.js) | EU datacentre (Frankfurt) |
| Railway Corp. | Backend hosting (API + Postgres database) | EU datacentre (Amsterdam) |
| Stripe Payments Europe Ltd. | Payment processing and billing | EU + USA (with SCCs) |
| Google LLC | OAuth sign-in (only if the user chooses Google) | USA (with SCCs + EU-US DPF adequacy decision) |
| Discord Inc. | OAuth sign-in (only if the user chooses Discord) | USA (with SCCs) |
All sub-processors are bound by GDPR-compliant Data Processing Agreements (DPAs). Transfers outside the EU to US providers (Stripe USA, Google, Discord) take place under the European Commission’s Standard Contractual Clauses and/or the EU-US Data Privacy Framework.
A Rankly DPA is available on request at info@soloweb.io for B2B customers who need one.
5. Cookies and tracking technologies
Rankly only uses essential technical cookies needed for the service to work. We don’t use profiling cookies or third-party analytics trackers.
| Cookie | Purpose | Duration |
|---|---|---|
| __Secure-better-auth.session_token | Login session (signed cookie) | 7 days (renewed at every sign-in) |
| rankly_current_org | Stores the current organisation (multi-org users) | 365 days |
| rankly-theme | Light/dark theme preference | localStorage (no expiry) |
All the cookies listed above are strictly necessary for the service to work (except the theme preference, which is an explicit user choice stored locally). For this reason, under the Italian Data Protection Authority’s decision of 10 June 2021, no consent banner is required.
6. Data subject rights
Under Articles 15-22 GDPR you have the right to:
- Access: get confirmation that your data is processed and a copy of it
- Rectification: correct inaccurate data (you can do it yourself from the account panel)
- Erasure (right to be forgotten): ask for your data to be removed (with exceptions for data we must keep by law, e.g. invoices)
- Portability: receive your data in a structured, readable format (JSON export from the panel, coming soon)
- Restriction: ask for processing to be suspended temporarily
- Objection: object to processing based on legitimate interest
- Complaint: lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it)
To exercise these rights write to info@soloweb.io or support@rankly.it. We reply within 30 days (Art. 12 GDPR).
7. Data retention and deletion
If you delete your account or deactivate the organisation: the data is kept read-only for 90 days (so you can change your mind or export it). After 90 days identifiable personal data is removed (hard delete of completed matches, anonymisation of historical relations). Tax data (invoices) is kept for 10 years as required by law.
Public tournament pages stay reachable with an "archived tournament" banner during the 90 days, then are removed completely.
8. Security
We take appropriate technical and organisational measures to protect data: TLS 1.3 required on every endpoint, password hashing (for the few non-OAuth flows) with argon2, session cookies signed with HMAC, daily database backups with 7-day retention, database access limited to the application instances over a private network.
In the event of a data breach likely to result in a risk to the rights and freedoms of data subjects, we will notify you within 72 hours as required by Art. 33 GDPR.
9. Changes to this notice
We may update this notice over time (change of sub-processors, new features that process different data, regulatory changes). Changes are published on this page with the updated date at the top. For substantial changes (e.g. new processing purposes) we will notify you by email at least 30 days before they take effect.