Privacy notice

Last updated: 20 September 2026 · Demonstration

This notice explains how LVLMAX (“we”, “us”) processes personal data under UK GDPR and the Data Protection Act 2018, and EU GDPR where we offer the service into the EEA. Controller: LVLMAX. Contact: privacy@lvlmax.gg.

Demonstration

LVLMAX is currently a demonstration. New account registration is paused. Visitors sign in with a shared demonstration account. Match history, ranks, and coaching examples on that account are sample data, not live VAL-MATCH results from a personal Riot account. Do not type or upload personal information you would not expect other demo visitors to see.

Public profiles and research sharing stay off unless opted in. Features may change. When we open a personal service with official Riot Sign On, we will update this notice.

Lawful bases

Contract — signing in, displaying the demo career, Premium coaching features you request, strategy boards, and Privacy Center tools.
Consent — public profile, Improvement Corpus (help improve LVLMAX), non-essential analytics cookies. Never pre-ticked; withdraw anytime in Privacy Center.
Legitimate interests — security logs, abuse prevention (including misuse of the AI coach), rate limiting (short retention; you may object).

We do not collect payment card data in this demonstration and we do not retain invoices. If paid billing is later enabled, we will identify the payment processor and any tax-retention duties in an updated notice.

What we store

Account: email, display name, password hash, 16+ assertion, birth year (demo account included)
Optional Riot link fields on the demo persona (sample identifiers, not a live RSO token)
Sample match links, aggregates, detector findings, LVL Cards, strategy boards
Coaching replay derived from an uploaded .vrf if you attach one (subject-centric; teammates/enemies anonymized)
Coach chat transcripts for the signed-in account (findings-context only; emails and PUUIDs are stripped)
Consent events, Privacy Mode, DPI/sensitivity you enter, plan metadata (no card numbers)
Raw .vrf files: minutes only, then delete

AI coach

The AI coach, algorithm findings, habit tips, and LVL Cards are Premium features. When you use them, the coach is given detector findings, LVL Score, and aggregate stats for this account. We do not send raw replay ticks, Riot PUUIDs, emails, or payment details to the language model. Optional LLM vendors, if used, are contracted for zero-retention / no-train writing of coaching notes. Do not enter personal information in chat. Misuse (including attempts to jailbreak the coach) may be logged for security and may lead to withdrawal of Premium as described in the Terms of use.

Processors

We may use Vercel (hosting), Neon (database), optional LLM vendors under zero-retention / no-train contracts, and object storage for traces or exports. We do not use a payment processor in this demonstration. Prefer EU/UK regions when the vendor offers them.

Retention

Raw replays: minutes after parse
Coaching data and account: life of the account, or until you delete a match / erase the account
Sessions: about 30 days idle
Security logs: about 90 days
Backups: may linger up to ~30 days after erasure, then fall out of cycle

Your rights

Use the free Privacy Center to download data on the signed-in account, restrict processing, withdraw consents, or erase the account (Account settings). We aim for minutes, not 30 days, for the normal logged-in path. Because the demonstration account is shared, an export or erasure affects that shared demo persona. We cannot fully unwind rank histograms or model weights already computed from anonymized opted-in corpus data. Shared MatchDto cache for matches other users also played stays without your join row.

Public profile and Improvement Corpus

Public profiles are off by default. Linking Riot and enabling public profile makes opted-in match history, aggregates, and LVL Score visible on LVLMAX. Coaching chat, replays, email, and PUUIDs stay private. Improvement Corpus is a separate, off-by-default consent to use anonymized copies of your analysis for rank averages and models — never named teammates/enemies from someone else’s replay.

Cookies (PECR)

A session cookie is required to keep you signed in. Analytics stay off unless you accept. The banner offers Reject all / Accept analytics. No pre-ticked analytics.

International transfers

If processors store data outside the UK/EEA, we rely on appropriate safeguards (for example SCCs or UK IDTA) described in our processor contracts.

Complaints

Contact us first at privacy@lvlmax.gg. You may also complain to the UK Information Commissioner’s Office (ICO). When we open to the public we will complete any required UK controller fee registration.