Privacy policy

Introduction

At nades.ai ("we," "our," or "us"), we are committed to protecting your privacy and keeping your personal information secure. This policy explains what we collect, how we use it, and the choices you have.

The data controller for the information described here is Avichai Nissim, Israel, who operates nades.ai. For any question about your data, or to exercise the rights below, contact us at [email protected].

By using nades.ai you agree to the collection and use of information in line with this policy. If you don't agree, please don't use the service.

Information we collect

Information you provide

• Account information: when you create an account we collect your email address and, if you sign up with email/password, your password (stored and verified securely by Firebase Authentication, so we never see or store your raw password). You may also add or change your email, or set a password, later from Settings. We also keep whether you ticked the box to receive marketing emails, and when you accepted our terms.
• Steam account: when you link Steam, we collect your Steam ID, persona (display) name, and avatar. Steam is the anchor identity that lets us recognize you in professional match data; either method (email/password or Steam) then signs into the same account.
• Communications: if you email us or use the contact form, we collect your name, email address, and the content of your message.
• Steam bot chats: if you add our Steam bot as a friend and message it, we keep your Steam ID, the message you sent, and the reply we gave; see Steam bot below.
• Searches: the words you type into site search. Words our own search cannot place are sent to OpenAI to find matching lineups (see below). We do not keep your searches against you or your account.
• Reports: if you report a lineup or a combo, we keep the reason you gave and, if you chose to leave one, your email address so we can follow up.
• Practice servers: where the feature is available, we keep a record of the sessions you started and the server logs from them.

Information collected automatically

• Usage data: how you interact with the platform, such as pages visited, features used, and time spent on the site.
• Device information: your IP address, browser type, operating system, and device identifiers.
• Server and security logs: every request to the site passes through Cloudflare and lands on our servers, and both keep short-lived logs of the IP address, the page requested, and the browser used. We use them to keep the site up and to stop abuse; they are not used to profile you.
• Cookies and tracking: cookies and similar technologies used to keep you signed in, remember preferences, and understand usage.
• Analytics and advertising: we use Google Analytics to understand how visitors use the site. Where advertising is enabled, third-party ad providers (including Google) may also set cookies and receive usage signals, subject to the consent choices described below.

How we use your information

• To provide, maintain, and improve the platform.
• To authenticate your identity and manage your account.
• To respond to your account, updates, and support requests.
• To personalize your experience and surface relevant content.
• To detect, prevent, and address technical issues and security threats.
• To comply with legal obligations and enforce our terms.
• To run research and analytics that improve the service.
• To send you marketing emails, only with your consent (you can unsubscribe any time).

Legal bases

Where the GDPR or UK GDPR applies, we rely on one of these for each thing we do:

• Performing our contract with you: running your account, keeping you signed in, saving your favorites, answering your Steam bot messages, and providing practice servers.
• Our legitimate interests: keeping the site secure and available (server logs, bot detection, rate limits), answering your messages and reports, understanding aggregate usage where no consent is required, and showing professional match data (see People in match data).
• Your consent: analytics and advertising cookies in the European Economic Area, the United Kingdom, and Switzerland, and marketing emails everywhere. You can withdraw it at any time: cookies from Cookie settings in the footer, emails from the unsubscribe link in any of them or by contacting us. Withdrawing does not affect what happened before.
• Legal obligations: where a law requires us to keep or hand over information.

Data sharing and disclosure

We do not sell your personal information. We share it only in these cases:

• Service providers: third parties that perform services on our behalf, each receiving only what its job needs and each processing it under its own data-protection terms (including a data processing agreement where the provider offers one): Google Cloud (hosting, in Belgium), MongoDB Atlas (our database, in Belgium), Cloudflare (delivery, security, storage and delivery of the site's images and videos, cookieless traffic counts, and the Turnstile bot check on our forms), Sentry (error monitoring: the IP address, browser and user agent, and the details of an error that occurs on the site, processed in its EU data region), Firebase Authentication (sign-in), Google Analytics (usage measurement, subject to your consent), CookieYes (consent management), Resend (the emails we send you, such as account deletion codes), OpenAI (the text of site searches and of Steam bot messages, to find matching lineups), and Steam (sign-in and the chat bot). Where advertising is enabled, Google is also an advertising provider, subject to your consent.
• Legal requirements: when required by law, court order, or regulation, or to protect our rights, property, or safety.
• Business transfers: in a merger, acquisition, or sale of assets, your information may transfer as part of that transaction.

Data security

We use industry-standard measures to protect your information:

• Encryption of data in transit using SSL/TLS.
• Secure authentication through Firebase Authentication.
• Regular security assessments and updates.
• Access controls for our team.
• Secure hosting infrastructure on Google Cloud Platform.

No method of transmission or storage is 100% secure, so while we work hard to protect your information we can't guarantee absolute security.

How long we keep it

• Your account and favorites: until you delete the account.
• Steam bot chats and practice-server logs: 180 days, then deleted automatically. Practice-server session records: 1 year.
• Reports and contact messages: as long as needed to act on them.
• Server and security logs: up to 30 days.
• Anonymous favorites: up to 15, tied to a cookie that lasts a year, and deleted after 6 months without use; they are merged into your account if you sign up.

Account deletion

You can delete your account at any time from Settings. Deletion is erasure, not deactivation:

• Your account record is deleted, along with your sign-in credentials: email, password, and the link to your Steam account.
• Everything attached to it goes with it: your favorites, any reports you filed, your practice-server sessions and their logs, and your Steam bot chat history.
• Any account with an email confirms deletion with a one-time code we email you; a Steam-only account confirms by typing DELETE.
• It cannot be undone. If you sign in again later with the same Steam account you get a brand-new, empty account. Nothing from the deleted one comes back, because none of it still exists.

If anything about a deletion is unclear, or you want confirmation that it went through, contact us at [email protected].

International data transfers

We operate from Israel, which the European Commission recognises as providing an adequate level of data protection. Personal data of visitors in the European Economic Area may therefore be transferred to and processed in Israel on that basis, without additional safeguards being required.

The site itself and its database are hosted in the European Union (Belgium). Some of our service providers process data in the United States, among them OpenAI, which receives the text of site searches and Steam bot messages. For those we rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the EU standard contractual clauses.

Your privacy rights

You have certain rights over your personal information:

• Access: request a copy of the personal information we hold about you.
• Correction: request that we fix inaccurate or incomplete information.
• Deletion: request that we delete your personal information.
• Objection: object to how we process your personal information.
• Restriction: ask us to pause processing while a dispute is resolved.
• Portability: receive the information you gave us in a machine-readable format.
• Withdrawing consent: for anything we do on the basis of your consent, at any time, from Cookie settings in the footer or by contacting us.

To exercise any of these, contact us at [email protected]. We respond within one month; if a request is complex we will tell you and may take up to two months more.

You also have the right to complain to a data protection authority: the Israeli Privacy Protection Authority, or, if you are in the European Economic Area or the United Kingdom, the authority in the country where you live.

Cookies and tracking

We use cookies and similar technologies to:

• Keep your session and authentication state.
• Remember your preferences and settings.
• Measure traffic and usage patterns.
• Where enabled, support advertising on the site.

Essential cookies, the ones that keep you signed in and remember your favorites, are always active because the site cannot function without them. Everything else is grouped into analytics and advertising categories.

If you are in the European Economic Area, the United Kingdom, or Switzerland, a consent banner asks you to choose before any analytics or advertising cookie is set, and no such cookie is set until you accept. Before you choose, Google Analytics may send anonymous, cookieless pings, which record that a page was viewed without any cookie or identifier that could recognise you on a later visit. Elsewhere, analytics run by default as permitted by local law. Either way you can change or withdraw your choice at any time from Cookie settings in the site footer.

Every cookie we set is listed on our Cookie policy page. You can also control cookies through your browser settings; disabling essential cookies may limit some features.

Children's privacy

Anyone can browse nades.ai without an account, but you must be 16 or older to create one, and we don't knowingly collect personal information from anyone younger. If you believe a child under 16 has given us information, contact us at [email protected] and we'll delete it.

Changes to this privacy policy

We may update this policy from time to time. We'll post the new version here and update the "last updated" date, so check back periodically.