Privacy Policy

Who we are

StageOne Systems ("StageOne", "we", "us") is the data controller for the personal data described in this policy.

Address: Kråkstad, Norway.

For any privacy question or to exercise your rights, contact us at privacy@stageone.systems.

The personal data we collect

We collect the following categories of personal data:

• Account data: your name, email address, phone number, date of birth, country, preferred language, and the club and federation memberships and member numbers associated with your account.
• Competition data: match registrations, squad assignments, scores, classifications and grades, and series standings.
• Payment data: when you pay a registration or membership fee, payment is processed by Stripe. We do not store your full card number; we keep invoice records and a truncated reference (such as the last four digits) needed for accounting and reconciliation.
• Security data: two-factor authentication settings and trusted-device records.
• Technical data: IP address, browser/user-agent, and audit logs of significant actions (for example score submissions, role changes, and state transitions), kept for security and accountability.

Why we process your data, and our legal bases

We rely on the following legal bases under the GDPR:

• To provide the service - creating your account, registering you for matches, recording scores, issuing invoices, and showing results (Art. 6(1)(b), performance of a contract).
• To meet legal obligations - retaining invoices and accounting records as required by the Norwegian Bookkeeping Act (bokføringsloven) (Art. 6(1)(c)).
• For our legitimate interests - keeping the platform secure, preventing fraud and abuse, maintaining audit logs, and improving the product through privacy-respecting analytics (Art. 6(1)(f)).
• With your consent - where we ask for it specifically; you may withdraw consent at any time (Art. 6(1)(a)).

Public information

Some information is intentionally public so that competitions work: your shooter profile, your results and series standings (including your name, club, grade, category and country), and your federation member number may be visible to anyone, including people who are not signed in. Exposing a federation member number is comparable to a sporting licence.

Club member numbers are not public - they are visible only to administrators of that club and to you on your own profile.

You choose whether to upload a profile picture; if you do, it is shown on your public shooter profile, and you can remove it at any time.

Who we share data with

We use carefully selected service providers ("processors") who act on our instructions. We do not sell your personal data, and we share data with public authorities only where legally required. Our processors are:

• Supabase - authentication and database hosting.
• Stripe - payment processing and payouts.
• Resend - transactional email delivery.
• Tigris - file and document storage (for example invoice PDFs).
• Sentry - error monitoring.
• PostHog - privacy-respecting product analytics.

Where your data is stored

We store and process personal data within the EU/EEA. We choose service providers and regions that keep data inside the EU/EEA, and we do not transfer your personal data outside the EU/EEA without a lawful transfer mechanism.

How long we keep your data

We keep account and competition data while your account is active and for as long as needed for the purposes above.

Invoices and accounting records are retained for five years as required by the Norwegian Bookkeeping Act, even after you delete your account.

When you delete your account, we pseudonymise your profile - removing identifying details such as your name, email, phone, date of birth, and security secrets - while retaining the records the law requires us to keep. Audit-log entries are kept but have personal data redacted on display.

Cookies and similar technologies

We use a small number of strictly necessary cookies: a secure session cookie that keeps you signed in, a language-preference cookie, and a trusted-device cookie used for two-factor authentication. These are HttpOnly where possible and are essential to operate the service.

Product analytics are configured to minimise personal data (for example, input masking) and run on an EU host.

Security

We protect your data with measures including encryption in transit, row-level access controls, mandatory two-factor authentication for administrative roles, and EU-based hosting. No system is perfectly secure, but we work continuously to safeguard your data.

Children and young athletes

Shooting sport includes junior competitors. If you are under the age at which you can consent to online services on your own under Norwegian law, a parent or guardian must set up and manage your account and agree to this policy on your behalf.

Your rights

You have the right to access your data, correct it, delete it, restrict or object to processing, and receive a copy in a portable format. Much of this you can do directly in your profile and privacy settings; for anything else, contact privacy@stageone.systems.

You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet, www.datatilsynet.no).

Changes to this policy

We may update this policy from time to time. When we make material changes we will update the "Last updated" date and, where appropriate, notify you.

Contact

Questions or requests: privacy@stageone.systems - StageOne Systems, Kråkstad, Norway.